I recently found that, when deploying to Heroku (which is currently using Bundler 1.17.3), bundler's ouput was stalling for several minutes:

(... messages here ...)
remote: Installing devise-security 0.14.3
(... output **stopped for 4 minutes 45 seconds** - and then all the messages below showed immediately)
remote: Fetching bootstrap-sass 3.4.1
remote: Fetching sassc-rails 2.1.2
remote: Installing sassc-rails 2.1.2
remote: Installing bootstrap-sass 3.4.1
remote: Bundle complete! 56 Gemfile dependencies, 119 gems now installed.
remote: Gems in the groups development and test were not installed.
(... more messages here ...)

@schneems was very helpful in finding the source of the problem. At the beginning we thought it might be a problem with the devise-security gem, but we soon found that the culprits were bootstrap-sass and sassc, which were taking a long time to fech/install.

The thing is that bundler did not show the "Fetching bootstrap-sass" message until it was downloaded/installed - so we could not know why the output was stalling, as the last message shown was "Fetching devise-security" (that's why we though there was an issue with devise-security).

Could this somehow be an issue with bundler ordering, and how messages are shown on screen? Maybe something could be done so that bundler does not mislead us about which gem is taking so long to download/install?