Patching fast and slow: Ruby devs delay to defend against supply chain attack