I recently (few days ago) had to do 2. None of my gems are super popular but I have enough that there are some serious production workloads behind. It felt scrutinized enough. I can imagine if I had more popular libraries that it would have been much more so.