bundler-multilock 2.0.0.beta4 → 2.0.0.beta6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45718b8a0410e25b206212808dd21eb5530561297393c3f6fca54a14acd26e40
-  data.tar.gz: 35245c2fc0f936995c0cbc5be482bf20dc6767de70cc23b41fe1b89b63e179cd
+  metadata.gz: 6bdc44af5344eed4edb2782c151e3ab714450bcd81003130fba1385247c227da
+  data.tar.gz: 77391ab3ec993404d7363736accb18921c8d1c5190c2609a3bf45e4e950c6f3f
 SHA512:
-  metadata.gz: 2e069c0c770748ebdfe957fc1c795553ecaa7afdd7655a180e5c6ced84f0e31840bd7f9233dcd6d07b70ac765fbde244624b1976a15f2d5dc31adb1e1accadaf
-  data.tar.gz: c70adec856e83bb4520d3705e714bd2d1e99672d8c866faf1718928d65c1b3062b004c242e353037f7d7a0b35ea7bfb0675b2af20afd64416c1f8a14d03c7421
+  metadata.gz: 38436b8ee5d0096b5387da472d11a543158dcb884143cbbd9cf8acf9f9dd76e91a644ffb4b3fcdadeb7768b7b0f87f5597531060633fdc1dca92c8893adc31eb
+  data.tar.gz: aad7cd30a4f7ef60aff473d0ac763dab63f33f7dbfddceb2b18748563294d9d49f414f44f067ec2bfe482edee9925a4242f0a34f5dbc0de0d4053564a1661fa7

data/lib/bundler/multilock/cache.rb

@@ -12,8 +12,10 @@ module Bundler
         @specs = {}
         @reverse_dependencies = {}
         @reverse_requirements = {}
+        @dependent_requirements = {}
         @base_checks = {}
         @deep_checks = {}
+        @dependency_options = {}
         @base_check_messages = {}
         @deep_check_messages = {}
         @missing_specs = Set.new
@@ -31,6 +33,7 @@ module Bundler
         @specs.delete(lockfile_name)
         @reverse_dependencies.delete(lockfile_name)
         @reverse_requirements.delete(lockfile_name)
+        @dependent_requirements.delete(lockfile_name)
         invalidate_checks(lockfile_name)
       end
 
@@ -42,6 +45,24 @@ module Bundler
         @deep_check_messages.clear
       end
 
+      # @param lockfile_name [Pathname]
+      # @param options [Hash<String, Array<Hash>>]
+      #   how the lockfile's Gemfile limits the dependencies that have `platforms:` or `force_ruby_platform`, by
+      #   gem name, with a hash for each time the gem is declared. `:force_ruby` is if only the source variant is
+      #   used, and `:platforms` is the lockfile's platforms that it's for (or nil for all of them)
+      # @return [void]
+      def record_dependency_options(lockfile_name, options)
+        @dependency_options[lockfile_name] = options
+      end
+
+      # (known once the lockfile's Gemfile has been evaluated by the base check)
+      #
+      # @param lockfile_name [Pathname]
+      # @return [Hash<String, Array<Hash>>] see {#record_dependency_options}
+      def dependency_options(lockfile_name)
+        @dependency_options.fetch(lockfile_name) { {} }
+      end
+
       # @param lockfile_name [Pathname]
       # @return [String] the raw contents of the lockfile
       def contents(lockfile_name)
@@ -92,6 +113,46 @@ module Bundler
         @reverse_requirements[lockfile_name]
       end
 
+      # The gems in a lockfile whose requirements a version of a gem doesn't satisfy, other than
+      # the gems that are being ignored (like because they're going to change themselves).
+      #
+      # Requirements from the lockfile's own dependencies (the Gemfile) are never ignored.
+      #
+      # @param lockfile_name [Pathname]
+      # @param name [String] the gem's name
+      # @param version [Gem::Version]
+      # @param ignored_dependents [Set<String>] names of gems whose requirements shouldn't be considered
+      # @param retained [Set<LazySpecification>] variants of gems that are still considered, even if the gem is ignored
+      # @param gemfile_requirements [Hash<String, Gem::Requirement>, nil]
+      #   the requirements of the lockfile's Gemfile, if they might be different from what's in the lockfile
+      # @return [Array<String, nil>] the names of the gems (or nil, for the Gemfile)
+      def blocking_dependents(lockfile_name,
+                              name,
+                              version,
+                              ignored_dependents,
+                              retained: nil,
+                              gemfile_requirements: nil)
+        ensure_reverse_data(lockfile_name)
+        blocking = []
+        @dependent_requirements[lockfile_name][name].each do |dependent, requirement, spec|
+          next if ignored_dependents.include?(dependent) && !retained&.include?(spec)
+          # (the lockfile's version of the Gemfile's requirements is replaced below)
+          next if dependent.nil? && gemfile_requirements
+
+          blocking << dependent unless requirement.satisfied_by?(version)
+        end
+        blocking << nil if gemfile_requirements&.key?(name) && !gemfile_requirements[name].satisfied_by?(version)
+        blocking.uniq
+      end
+
+      # @param lockfile_name [Pathname]
+      # @param name [String] the gem's name
+      # @param version [Gem::Version]
+      # @return [true, false] if a version of a gem satisfies everything in a lockfile that requires it
+      def requirements_satisfied?(lockfile_name, name, version)
+        reverse_requirements(lockfile_name)[name].satisfied_by?(version)
+      end
+
       def conflicting_requirements?(lockfile1_name, lockfile2_name, spec1, spec2)
         reverse_requirements1 = reverse_requirements(lockfile1_name)[spec1.name]
         reverse_requirements2 = reverse_requirements(lockfile2_name)[spec1.name]
@@ -134,21 +195,26 @@ module Bundler
         # can use Gem::Requirement.default_prelease when Ruby 2.6 support is dropped
         reverse_requirements = Hash.new { |h, k| h[k] = Gem::Requirement.new(">= 0.a") }
         reverse_dependencies = Hash.new { |h, k| h[k] = Set.new }
+        # name => [[dependent name, Gem::Requirement, dependent spec]] (nil for the lockfile's own dependencies)
+        dependent_requirements = Hash.new { |h, k| h[k] = [] }
 
         lockfile = parser(lockfile_name)
 
         lockfile.dependencies.each_value do |dep|
           reverse_requirements[dep.name].requirements.concat(dep.requirement.requirements)
+          dependent_requirements[dep.name] << [nil, dep.requirement, nil]
         end
         lockfile.specs.each do |spec|
           spec.dependencies.each do |dep|
             reverse_requirements[dep.name].requirements.concat(dep.requirement.requirements)
             reverse_dependencies[dep.name] << spec.name
+            dependent_requirements[dep.name] << [spec.name, dep.requirement, spec]
           end
         end
 
         @reverse_requirements[lockfile_name] = reverse_requirements
         @reverse_dependencies[lockfile_name] = reverse_dependencies
+        @dependent_requirements[lockfile_name] = dependent_requirements
       end
     end
   end

data/lib/bundler/multilock/check.rb

@@ -63,6 +63,7 @@ module Bundler
           definition = Bundler.with_default_lockfile(lockfile_name) do
             Definition.build(lockfile_definition[:gemfile], lockfile_name, false)
           end
+          @cache.record_dependency_options(lockfile_name, dependency_options(definition))
           unless definition.send(:current_platform_locked?)
             next base_check_failed("#{lockfile_path} does not include the current platform " \
                                    "(#{Bundler.local_platform}).")
@@ -121,6 +122,28 @@ module Bundler
         false
       end
 
+      # @param definition [Definition]
+      # @return [Hash<String, Array<Hash>>] how the Gemfile limits the variants of the gems it has dependencies
+      #   for, by gem name (see {Cache#record_dependency_options})
+      def dependency_options(definition)
+        # (a gem can be declared more than once, like in blocks for different platforms)
+        definition.dependencies.group_by(&:name).filter_map do |name, dependencies|
+          declarations = dependencies.map do |dependency|
+            platforms = if dependency.platforms.any?
+                          definition.platforms.select do |platform|
+                            dependency.expanded_platforms.include?(Gem::Platform.generic(platform))
+                          end
+                        end
+            { force_ruby: dependency.force_ruby_platform ? true : false, platforms: }
+          end
+
+          # (a declaration that isn't limited at all is for every platform, so that's what the gem is)
+          next if declarations.any? { |declaration| !declaration[:force_ruby] && declaration[:platforms].nil? }
+
+          [name, declarations]
+        end.to_h
+      end
+
       def source_changes_message(definition, lockfile_path, gemfile_path)
         locked = definition.locked_gems.sources
         current = definition.send(:sources).lock_sources
@@ -133,6 +156,36 @@ module Bundler
         message
       end
 
+      # @param unneeded_specs [Array<LazySpecification>]
+      # @param parser [LockfileParser]
+      # @return [Array<LazySpecification>] the specs that are only in the lockfile because of the given specs
+      #   (which aren't included), because they're needed with them, and not without them
+      def specs_only_needed_by(unneeded_specs, parser)
+        specs_by_name = parser.specs.group_by(&:name)
+        reachable_without = lambda do |excluded|
+          reachable = Set.new
+          pending = parser.dependencies.keys
+          until pending.empty?
+            name = pending.shift
+            next unless reachable.add?(name)
+
+            specs_by_name[name]&.each do |spec|
+              next if excluded.any? { |unneeded| unneeded.equal?(spec) }
+
+              pending.concat(spec.dependencies.map(&:name))
+            end
+          end
+          reachable
+        end
+
+        needed = reachable_without.call([])
+        still_needed = reachable_without.call(unneeded_specs)
+        parser.specs.select do |spec|
+          needed.include?(spec.name) && !still_needed.include?(spec.name) &&
+            unneeded_specs.none? { |unneeded| unneeded.equal?(spec) }
+        end
+      end
+
       # checks that every gem has a checksum, and that gems in common (same version
       # and source) with the parent lockfile have the same checksums
       def checksums_valid?(parser, parent_parser, lockfile_path)
@@ -194,6 +247,56 @@ module Bundler
             success = false
           end
 
+          # the variants of gems don't depend on the platforms that are listed, so check them separately
+          same_source = lambda do |spec, parent_spec|
+            Multilock.same_source?(spec, parent_spec, lockfile_name, parent_lockfile_name)
+          end
+          stale_variants, missing_variants = Multilock.variant_drift(
+            parser.specs,
+            parent_parser.specs,
+            parser.platforms,
+            parent_parser.platforms,
+            dependency_names: parser.dependencies.keys,
+            dependency_options: @cache.dependency_options(lockfile_name),
+            same_source:
+          )
+          stale_variants += specs_only_needed_by(stale_variants, parser) unless stale_variants.empty?
+
+          # the source variants of gems that the parent only has other variants of don't have to be in the
+          # parent lockfile, and aren't additional dependencies (nor are the gems that only they need).
+          # (but the ones the parent does have are just like any other gem, with dependencies that are needed)
+          parent_versions = parent_parser.specs.group_by { |spec| [spec.name, spec.version] }
+          source_variants = parser.specs.select do |spec|
+            next false unless spec.platform == Gem::Platform::RUBY
+            next false unless (parent_variants = parent_versions[[spec.name, spec.version]])
+
+            parent_variants.none? { |parent_spec| parent_spec.platform == Gem::Platform::RUBY } &&
+              parent_variants.any? do |parent_spec|
+                Multilock.same_source?(spec, parent_spec, lockfile_name, parent_lockfile_name)
+              end
+          end
+          exempt_from_pins = stale_variants + source_variants
+          exempt_from_pins += specs_only_needed_by(exempt_from_pins, parser) unless source_variants.empty?
+          unless stale_variants.empty? && missing_variants.empty?
+            parent_path = parent_lockfile_name.relative_path_from(Dir.pwd)
+            if stale_variants.any?
+              Bundler.ui.error("#{lockfile_path} has gem variants that #{parent_path} doesn't " \
+                               "(#{stale_variants.map { |spec| spec.lock_name.strip }.join(", ")}), " \
+                               "so it is out of sync with it.")
+            end
+            if missing_variants.any?
+              Bundler.ui.error("#{lockfile_path} is missing gem variants that #{parent_path} has " \
+                               "(#{missing_variants.map { |spec| spec.lock_name.strip }.join(", ")}), " \
+                               "so it is out of sync with it.")
+            end
+            if Bundler.frozen_bundle?
+              Bundler.ui.error("That can't be fixed while the bundle is frozen. Run `bundle install` " \
+                               "without frozen mode, and commit the updated #{lockfile_path}.")
+            end
+            success = false
+          end
+          exempt_from_pins = exempt_from_pins.to_set { |spec| [spec.name, spec.version] }
+
           # look through top-level explicit dependencies for pinned requirements
           if lockfile_definition[:enforce_pinned_additional_dependencies]
             find_pinned_dependencies(proven_pinned, parser.dependencies.each_value)
@@ -207,23 +310,14 @@ module Bundler
               # look through what this spec depends on, and keep track of all pinned requirements
               find_pinned_dependencies(proven_pinned, spec.dependencies)
 
-              needs_pin_check << spec unless parent_spec
+              # (already reported, and not actually additional)
+              needs_pin_check << spec unless parent_spec || exempt_from_pins.include?([spec.name, spec.version])
             end
 
             next unless parent_spec
 
-            # have to ensure Path sources are relative to their lockfile before comparing
-            same_source = if [parent_spec.source, spec.source].grep(Source::Path).length == 2
-                            lockfile_name
-                              .dirname
-                              .join(spec.source.path)
-                              .ascend
-                              .any?(parent_lockfile_name.dirname.join(parent_spec.source.path))
-                          else
-                            parent_spec.source == spec.source
-                          end
-
-            next if parent_spec.version == spec.version && same_source
+            next if parent_spec.version == spec.version &&
+                    Multilock.same_source?(spec, parent_spec, lockfile_name, parent_lockfile_name)
 
             # the version in the parent lockfile cannot possibly satisfy the requirements
             # in this lockfile, and vice versa, so we assume it's intentional and allow it

data/lib/bundler/multilock/ext/dsl.rb

@@ -99,10 +99,15 @@ module Bundler
           @allowed_duplicate_plugins = Set.new
         end
 
-        def lockfile(*, **, &)
+        # Significant changes:
+        #  * a lockfile with a block or options is managed by Multilock
+        #  * a bare lockfile name is just Bundler's own `lockfile`, for
+        #    Gemfiles that only want to name their lockfile
+        def lockfile(*args, **kwargs, &block)
           return true if Multilock.loaded?
+          return super(args.first) if args.length == 1 && args.first.is_a?(String) && kwargs.empty? && !block
 
-          Multilock.add_lockfile(*, builder: self, **, &)
+          Multilock.add_lockfile(*args, builder: self, **kwargs, &block)
         end
       end
     end

data/lib/bundler/multilock/ext/runtime.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module Bundler
+  module Multilock
+    module Ext
+      # Makes `bundle cache` (and `bundle install` when vendor/cache exists) package
+      # the gems from every lockfile, and only prune gems that none of them use.
+      # Likewise, `bundle clean` only removes gems that none of the lockfiles use, and the
+      # `prune` setting covers the git gems from all of them.
+      module Runtime
+        ::Bundler::Runtime.prepend(self)
+
+        def cache(custom_path = nil, *)
+          cache_alternate_lockfiles(custom_path)
+          super
+        end
+
+        def prune_cache(cache_path)
+          return super if multilock_alternate_definitions.empty?
+
+          ensure_multilock_cache_path(cache_path)
+
+          resolve = [@definition, *multilock_alternate_definitions].flat_map { |definition| definition.resolve.to_a }
+          prune_gem_cache(resolve, cache_path)
+          prune_git_and_path_cache(resolve, cache_path)
+        end
+
+        # Bundler's `clean` only keeps what the one definition needs, so keep what all of them need.
+        # It also keys the specs it keeps by name, which would drop all but one version of a gem
+        # that the lockfiles disagree on, so that's replaced for the duration. (Keyed by where they
+        # are installed, since different lockfiles can lock different revisions of the same git gem.)
+        def clean(*)
+          alternate_definitions = multilock_alternate_definitions
+          return super if alternate_definitions.empty?
+
+          combined = [specs, *alternate_definitions.map(&:specs)].flat_map(&:to_a)
+          rubygems = Bundler.rubygems
+          original_add_default_gems_to = rubygems.method(:add_default_gems_to)
+          rubygems.define_singleton_method(:add_default_gems_to) do |_specs|
+            (original_add_default_gems_to.call([]).values + combined).to_h { |spec| [spec.full_gem_path, spec] }
+          end
+
+          begin
+            super
+          ensure
+            rubygems.singleton_class.send(:remove_method, :add_default_gems_to)
+          end
+        end
+
+        private
+
+        # Same as Bundler's, except that it also covers the git gems that only other lockfiles use
+        def prune_git_metadata
+          return super if multilock_alternate_definitions.empty?
+
+          owned = "#{Bundler.install_path}#{File::SEPARATOR}"
+          git_sources = [@definition, *multilock_alternate_definitions].flat_map do |definition|
+            definition.sources.git_sources
+          end
+          git_dirs = git_sources.reject(&:local?).filter_map do |source|
+            install_path = source.install_path.to_s
+            next unless install_path.start_with?(owned)
+
+            git_dir = File.join(install_path, ".git")
+            git_dir if File.exist?(git_dir)
+          end.uniq
+          return if git_dirs.empty?
+
+          Bundler.ui.info "Removing git metadata from checked out git gems"
+          git_dirs.each do |git_dir|
+            ::Bundler::SharedHelpers.filesystem_access(git_dir) do |p|
+              FileUtils.rm_rf(p)
+            end
+          end
+        end
+
+        def ensure_multilock_cache_path(cache_path)
+          return if File.exist?(cache_path)
+
+          ::Bundler::SharedHelpers.filesystem_access(cache_path) do |p|
+            FileUtils.mkdir_p(p)
+          end
+        end
+
+        # @return [Array<Definition>] the definitions of the lockfiles other than the one being cached
+        def multilock_alternate_definitions
+          @multilock_alternate_definitions ||= Multilock.alternate_definitions
+        end
+
+        # Caches the gems that only the other lockfiles use. The ones in common are cached by the
+        # usual process, which also cleans up git sources and prunes afterwards.
+        def cache_alternate_lockfiles(custom_path)
+          return if multilock_alternate_definitions.empty?
+
+          cache_path = Bundler.app_cache(custom_path)
+          ensure_multilock_cache_path(cache_path)
+
+          cached = Set.new
+          multilock_alternate_definitions.each do |definition|
+            specs_to_cache = if Bundler.settings[:cache_all_platforms]
+                               definition.resolve.materialized_for_all_platforms
+                             else
+                               definition.specs
+                             end
+
+            specs_to_cache.each do |spec|
+              next if spec.name == "bundler"
+
+              source = spec.source
+              next if source.is_a?(::Bundler::Source::Gemspec)
+
+              # git sources are equal regardless of which revision is locked, but each one
+              # is cached separately
+              cache_key = source.respond_to?(:app_cache_dirname) ? source.app_cache_dirname : source
+              next unless cached.add?([spec.full_name, cache_key])
+
+              if source.respond_to?(:migrate_cache)
+                source.migrate_cache(custom_path, local: false)
+              elsif source.respond_to?(:cache)
+                source.cache(spec, custom_path)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/bundler/multilock/version.rb

@@ -2,6 +2,6 @@
 
 module Bundler
   module Multilock
-    VERSION = "2.0.0.beta4"
+    VERSION = "2.0.0.beta6"
   end
 end

data/lib/bundler/multilock.rb

@@ -4,6 +4,7 @@ require_relative "multilock/ext/bundler"
 require_relative "multilock/ext/definition"
 require_relative "multilock/ext/dsl"
 require_relative "multilock/ext/plugin/dsl"
+require_relative "multilock/ext/runtime"
 require_relative "multilock/ext/shared_helpers"
 require_relative "multilock/ext/source"
 require_relative "multilock/ext/source_list"
@@ -40,11 +41,15 @@ module Bundler
                        parent: nil,
                        enforce_pinned_additional_dependencies: false,
                        &block)
+        # remembered for gems that need to be kept for the primary lockfile, even if it was never
+        # declared and an alternate lockfile is active (which may use its own Gemfile)
+        @primary_gemfile ||= Bundler.default_gemfile
+        @primary_lockfile ||= Bundler.default_lockfile(force_original: true)
+
         active = true if active.nil? && lockfile_definitions.empty? && lockfile.nil? && gemfile.nil?
 
         # if a gemfile was provided, but not a lockfile, infer the default lockfile for that gemfile
         lockfile ||= "#{gemfile}.lock" if gemfile
-        # allow short-form lockfile names
         lockfile = expand_lockfile(lockfile)
 
         raise ArgumentError, "Lockfile #{lockfile} is already defined" if lockfile_definitions.key?(lockfile)
@@ -139,9 +144,6 @@ module Bundler
 
         Bundler.ui.debug("Syncing to alternate lockfiles")
 
-        attempts = 1
-        previous_contents = Set.new
-
         default_root = Bundler.root
 
         cache = Cache.new
@@ -158,17 +160,6 @@ module Bundler
 
             relative_lockfile = lockfile_name.relative_path_from(Dir.pwd)
 
-            # prevent infinite loops of tick-tocking back and forth between two versions
-            current_contents = cache.contents(lockfile_name)
-            if previous_contents.include?(current_contents)
-              Bundler.ui.debug("Unable to converge on a single solution for #{lockfile_name}; " \
-                               "perhaps there are conflicting requirements?")
-              attempts = 1
-              previous_contents.clear
-              next
-            end
-            previous_contents << current_contents
-
             # already up to date?
             up_to_date = false
             conflicts = Set.new
@@ -178,11 +169,7 @@ module Bundler
                              checker.deep_check(lockfile_definition, conflicts:)
               end
             end
-            if up_to_date
-              attempts = 1
-              previous_contents.clear
-              next
-            end
+            next if up_to_date
 
             # a missing lockfile that enforces pinned additional dependencies has nothing
             # to be out of sync with, so even a frozen bundle just generates it
@@ -201,7 +188,7 @@ module Bundler
               Bundler.ui.info("Installing gems for #{relative_lockfile}...")
               write_lockfile(lockfile_definition, lockfile_name, cache, install:)
             else
-              Bundler.ui.info("Syncing to #{relative_lockfile}...") if attempts == 1
+              Bundler.ui.info("Syncing to #{relative_lockfile}...")
               synced_any = true
 
               parent_lockfile_name = lockfile_definition[:parent]
@@ -230,6 +217,9 @@ module Bundler
                 TEXT
               end
 
+              added_platforms = []
+              removed_platforms = []
+              unlock_gems = Set.new
               if lockfile_name.exist?
                 # if the lockfile already exists, "merge" it together
                 parent_lockfile = if adjusted_parent_lockfile_contents == cache.contents(lockfile_name)
@@ -242,24 +232,13 @@ module Bundler
 
                 dependency_changes = false
 
-                spec_precedences = {}
-
-                check_precedence = lambda do |spec, parent_spec|
-                  next :parent if spec.nil?
-                  next :self if parent_spec.nil?
-                  next spec_precedences[spec.name] if spec_precedences.key?(spec.name)
-
-                  precedence = if !(cache.reverse_dependencies(lockfile_name)[spec.name] & conflicts).empty? # rubocop:disable Style/ArrayIntersect -- not an array
-                                 :parent
-                               elsif cache.conflicting_requirements?(lockfile_name,
-                                                                     parent_lockfile_name,
-                                                                     spec,
-                                                                     parent_spec)
-                                 :self
-                               end
-
-                  spec_precedences[spec.name] = precedence || :parent
-                end
+                precedences, unlock_gems = spec_precedences(
+                  cache,
+                  lockfile_name,
+                  parent_lockfile_name,
+                  conflicts,
+                  gemfile_requirements: gemfile_requirements(lockfile_definition)
+                )
 
                 lockfile.sources.map! do |source|
                   parent_lockfile.sources.find { |s| s == source } || source
@@ -268,7 +247,7 @@ module Bundler
                 lockfile.specs.map! do |spec|
                   parent_spec = cache.find_matching_spec(parent_specs, spec)
                   next spec unless parent_spec
-                  next spec if check_precedence.call(spec, parent_spec) == :self
+                  next spec if precedences[spec.name] == :self
 
                   dependency_changes ||= spec != parent_spec
 
@@ -279,8 +258,63 @@ module Bundler
                   parent_spec
                 end
 
-                lockfile.platforms.replace(parent_lockfile.platforms).uniq!
-                lockfile.instance_variable_set(:@ruby_version, parent_lockfile.ruby_version) if lockfile.ruby_version
+                # the parent's versions might depend on gems this lockfile didn't need before.
+                # without them, Bundler considers the lockfile broken, and ignores what's
+                # locked in it, which can update everything
+                names = lockfile.specs.to_set(&:name)
+                pending = lockfile.specs.dup
+                until pending.empty?
+                  pending.shift.dependencies.each do |dependency|
+                    next if names.include?(dependency.name) || !(dependency_specs = parent_specs[dependency.name])
+
+                    names << dependency.name
+                    dependency_changes = true
+                    dependency_specs.each_value do |dependency_spec|
+                      source = dependency_spec.source
+                      lockfile.sources << source unless lockfile.sources.include?(source)
+                      lockfile.specs << dependency_spec
+                      pending << dependency_spec
+                    end
+                  end
+                end
+
+                # leave the lockfile's platforms alone, and let Bundler add and remove them itself
+                # (in write_lockfile), like `bundle lock --add-platform` and `--remove-platform`,
+                # so that it also adds or removes the gems needed for them
+                removed_platforms = lockfile.platforms - parent_lockfile.platforms
+                added_platforms = parent_lockfile.platforms - lockfile.platforms
+
+                # the lockfiles can agree on platforms, but still not on the variants of gems for them (perhaps
+                # due to merging of semantics conflicts), so clean up and/or add any missing variants.
+                # (the parent lockfile's specs have had their paths rebased to be relative to this lockfile)
+                same_source = lambda do |spec, parent_spec|
+                  same_source?(spec, parent_spec, lockfile_name, lockfile_name)
+                end
+                stale_variants, missing_variants = variant_drift(
+                  lockfile.specs,
+                  parent_lockfile.specs,
+                  lockfile.platforms,
+                  parent_lockfile.platforms,
+                  dependency_names: lockfile.dependencies.keys,
+                  dependency_options: cache.dependency_options(lockfile_name),
+                  same_source:
+                )
+                stale_variants.map(&:platform).uniq.each do |platform|
+                  entries = matching_platforms(lockfile.platforms, platform)
+                  # Bundler can only remove a platform that's listed (and gems can have variants for
+                  # platforms, like ruby, that never are)
+                  lockfile.platforms << platform if entries.empty?
+                  removed_platforms |= entries.empty? ? [platform] : entries
+                end
+                missing_variants.map(&:platform).uniq.each do |platform|
+                  # (only platforms that the parent still lists)
+                  entries = matching_platforms(lockfile.platforms, platform) & parent_lockfile.platforms
+                  # and it can only add a platform that isn't listed
+                  lockfile.platforms.reject! { |entry| entries.include?(entry) }
+                  added_platforms |= entries
+                end
+                removed_platforms -= added_platforms
+                lockfile.instance_variable_set(:@ruby_version, parent_lockfile.ruby_version)
                 unless lockfile.bundler_version == parent_lockfile.bundler_version
                   unlocking_bundler = parent_lockfile.bundler_version
                   lockfile.instance_variable_set(:@bundler_version, parent_lockfile.bundler_version)
@@ -307,24 +341,13 @@ module Bundler
                                                  cache,
                                                  install:,
                                                  dependency_changes:,
-                                                 unlocking_bundler:)
+                                                 unlocking_bundler:,
+                                                 added_platforms:,
+                                                 removed_platforms:,
+                                                 unlock_gems:)
                 end
               end
               cache.invalidate_lockfile(lockfile_name) if had_changes
-
-              # if we had changes, bundler may have updated some common
-              # dependencies beyond the default lockfile, so re-run it
-              # once to reset them back to the default lockfile's version.
-              # if it's already good, the `check` check at the beginning of
-              # the loop will skip the second sync anyway.
-              if had_changes
-                attempts += 1
-                Bundler.ui.debug("Re-running sync to #{relative_lockfile} to reset common dependencies")
-                redo
-              else
-                attempts = 1
-                previous_contents.clear
-              end
             end
           end
         ensure
@@ -386,10 +409,509 @@ module Bundler
         return [] unless lockfile
         return [lockfile] if recovered
 
-        # we can't tell if Bundler expanded a short name (or "active") to an
-        # absolute path, or if it was written that way, so allow either
+        # we can't tell if Bundler expanded "active" to an absolute path,
+        # or if it was written that way, so allow either
         relative = Pathname.new(lockfile).relative_path_from(Pathname.pwd).to_s
-        relative.include?("/") ? [lockfile] : [lockfile, relative]
+        (relative == "active") ? [lockfile, relative] : [lockfile]
+      end
+
+      # @!visibility private
+      # @param lockfile_definition [Hash]
+      # @return [Hash<String, Gem::Requirement>] the requirements that the lockfile's Gemfile has for its
+      #   dependencies, which are only in the lockfile itself after it's synced
+      def gemfile_requirements(lockfile_definition)
+        gemfile = lockfile_definition[:gemfile]
+        prepare_block = lockfile_definition[:prepare]
+
+        builder = Dsl.new
+        builder.eval_gemfile(gemfile, &prepare_block) if prepare_block
+        builder.eval_gemfile(gemfile)
+        builder.dependencies.group_by(&:name).transform_values do |dependencies|
+          Gem::Requirement.new(dependencies.flat_map { |dependency| dependency.requirement.as_list })
+        end
+      end
+
+      # @!visibility private
+      # Decides, for each gem in a lockfile that is also in its parent lockfile, which one's version wins when
+      # syncing the lockfile.
+      #
+      # A gem follows the parent, unless something that's staying as it is requires its version, and the
+      # parent can't use that version either (so it's different on purpose). Gems that follow the parent
+      # have different requirements from what they had, so they don't count. Neither do gems that nothing
+      # needs any more, once the others follow the parent. If the parent can use the version, the gems that
+      # are in the way have to be updated instead, so they're unlocked. And they also don't count, since
+      # they'll have different requirements, once they're updated.
+      #
+      # Each of those can change the others, so this starts out assuming that every gem that's different from
+      # the parent is going to follow it, and repeats, until that matches which ones actually do. And then
+      # repeats that, until the gems that are unlocked don't change.
+      #
+      # @param cache [Cache]
+      # @param lockfile_name [Pathname]
+      # @param parent_lockfile_name [Pathname]
+      # @param conflicts [Set<String>] names of gems that are out of sync, with no reason to be
+      # @param gemfile_requirements [Hash<String, Gem::Requirement>, nil]
+      #   the requirements of the lockfile's Gemfile. The lockfile's own copy of them may be about to change
+      # @return [Array(Hash<String, Symbol>, Set<String>)]
+      #   gem name to +:parent+ or +:self+, and the names of the gems that have to be unlocked for the ones
+      #   that follow the parent to be able to
+      def spec_precedences(cache, lockfile_name, parent_lockfile_name, conflicts, gemfile_requirements: nil)
+        parent_specs = cache.specs(parent_lockfile_name)
+        own_specs = cache.specs(lockfile_name)
+        roots = gemfile_requirements&.keys || cache.parser(lockfile_name).dependencies.keys
+
+        # every platform variant of a gem gets replaced with its parent's, so any of them can change
+        variants = Hash.new { |hash, name| hash[name] = [] }
+        cache.parser(lockfile_name).specs.each do |spec|
+          next unless (parent_spec = cache.find_matching_spec(parent_specs, spec))
+
+          variants[spec.name] << [spec, parent_spec]
+        end
+        # (and the ones that the variants the lockfile has are replaced with)
+        matched = variants.transform_values { |gem_variants| gem_variants.map(&:last).uniq }
+
+        # other variants of a gem that follows the parent, that the parent doesn't have a counterpart for,
+        # are kept as they are
+        unmatched = cache.parser(lockfile_name).specs.select do |spec|
+          variants.key?(spec.name) && !cache.find_matching_spec(parent_specs, spec)
+        end.group_by(&:name)
+
+        # a gem can change what it depends on without changing its version (like a git gem)
+        differing = variants.select do |_name, gem_variants|
+          gem_variants.any? { |spec, parent_spec| spec_changed?(spec, parent_spec) }
+        end.keys
+
+        # the variants that stay, but that cleaning up the variants after replacing the gems will remove
+        counterparts = {}.compare_by_identity
+        variants.each_value do |gem_variants|
+          gem_variants.each { |spec, parent_spec| counterparts[spec] = parent_spec }
+        end
+        removed = lambda do |following_parent|
+          merged = cache.parser(lockfile_name).specs.map do |spec|
+            following_parent.include?(spec.name) ? counterparts.fetch(spec, spec) : spec
+          end
+          stale, = variant_drift(merged,
+                                 cache.parser(parent_lockfile_name).specs,
+                                 cache.parser(lockfile_name).platforms,
+                                 cache.parser(parent_lockfile_name).platforms,
+                                 dependency_names: roots.to_a,
+                                 dependency_options: cache.dependency_options(lockfile_name),
+                                 same_source: lambda do |spec, parent_spec|
+                                   same_source?(spec, parent_spec, lockfile_name, parent_lockfile_name)
+                                 end)
+          stale.to_set & unmatched.values.flatten
+        end
+
+        # the specs of gems that only the parent has, that this lockfile could get (if the Gemfile can use them)
+        importable = lambda do |name|
+          parent_specs[name]&.values&.select do |spec|
+            !gemfile_requirements&.key?(name) || gemfile_requirements[name].satisfied_by?(spec.version)
+          end
+        end
+
+        unneeded = lambda do |following_parent, removed_variants|
+          staying = unmatched.transform_values { |specs| specs.reject { |spec| removed_variants.include?(spec) } }
+          own_specs.keys.to_set - needed_gems(roots, own_specs, importable, following_parent, matched, staying)
+        end
+
+        unlock = Set.new
+        loop do
+          precedences, blockers = converge_precedences(cache,
+                                                       lockfile_name,
+                                                       parent_lockfile_name,
+                                                       variants,
+                                                       conflicts.to_set | differing,
+                                                       differing:,
+                                                       unlock:,
+                                                       removed:,
+                                                       unneeded:,
+                                                       roots:,
+                                                       importable:,
+                                                       retained: unmatched.values.flatten.to_set,
+                                                       gemfile_requirements:)
+
+          return [precedences, unlock] if blockers.subset?(unlock)
+
+          unlock |= blockers
+        end
+      end
+
+      # @!visibility private
+      # (see #spec_precedences)
+      # @param variants [Hash<String, Array<Array(LazySpecification, LazySpecification)>>]
+      #   gem name to each of its specs, and its spec in the parent lockfile
+      # @param out_of_sync [Set<String>] the gems assumed to follow the parent to start with
+      # @param differing [Array<String>] the gems that follow the parent, if they can
+      # @param unlock [Set<String>] gems that are already going to be unlocked
+      # @param removed [#call] given the gems that follow the parent, the variants that stay as they are, but
+      #   that are going to be removed
+      # @param unneeded [#call] given the gems that follow the parent, and the variants that are going to be
+      #   removed, the gems that nothing needs any more
+      # @param roots [Enumerable<String>] the names of the gems that are in the Gemfile
+      # @param importable [#call] given the name of a gem that only the parent has, the specs of it that could be used
+      # @param retained [Set<LazySpecification>] variants of gems that stay as they are, even if the gem follows
+      #   the parent
+      # @return [Array(Hash<String, Symbol>, Set<String>)] the precedences, and the gems that are in the way
+      def converge_precedences(cache,
+                               lockfile_name,
+                               parent_lockfile_name,
+                               variants,
+                               out_of_sync,
+                               differing:,
+                               unlock:,
+                               removed:,
+                               unneeded:,
+                               roots:,
+                               importable:,
+                               retained:,
+                               gemfile_requirements:)
+        seen = Set.new
+        own_specs = cache.specs(lockfile_name)
+        # what gems are replaced with, which is all of the variants of gems that this lockfile gets
+        matched = variants.transform_values { |gem_variants| gem_variants.map(&:last).uniq }
+        effective_specs = ->(name) { matched[name] || importable.call(name) }
+
+        loop do
+          removed_now = removed.call(out_of_sync)
+          unneeded_now = unneeded.call(out_of_sync, removed_now)
+          ignored = out_of_sync | unneeded_now | unlock
+          # (a variant that stays doesn't require anything, if nothing needs the gem any more, or it's updated,
+          # or it's going to be removed)
+          kept = retained.reject do |spec|
+            unneeded_now.include?(spec.name) || unlock.include?(spec.name) || removed_now.include?(spec)
+          end
+
+          # gems that only the parent has, that gems following the parent bring along, require things too
+          # (but not gems that won't be needed any more, and only for the variants that are used)
+          following = out_of_sync - unneeded_now
+          following |= imported_gems(effective_specs, own_specs, following, roots)
+
+          blockers = Set.new
+          precedences = variants.to_h do |name, gem_variants|
+            follow_parent = true
+            blocking_gems = Set.new
+
+            gem_variants.each do |spec, parent_spec|
+              next if spec.version == parent_spec.version
+
+              blocking = cache.blocking_dependents(lockfile_name,
+                                                   name,
+                                                   parent_spec.version,
+                                                   ignored,
+                                                   retained: kept,
+                                                   gemfile_requirements:)
+
+              # something that's still needed, and not out of sync, requires this version. if that's the
+              # Gemfile, it can't be changed. if the parent lockfile is also unable to use this version, it's
+              # different on purpose, unless a gem following the parent requires it to change. otherwise it
+              # still follows the parent, and what's in the way has to be updated, to be able to
+              if blocking.include?(nil) ||
+                 (blocking.any? &&
+                  !cache.requirements_satisfied?(parent_lockfile_name, name, spec.version) &&
+                  !required_to_change?(cache.reverse_dependencies(parent_lockfile_name)[name] & following,
+                                       effective_specs,
+                                       name,
+                                       spec.version))
+                follow_parent = false
+              else
+                blocking_gems.merge(blocking)
+              end
+            end
+
+            blockers.merge(blocking_gems) if follow_parent
+            [name, follow_parent ? :parent : :self]
+          end
+
+          replaced = differing.select { |name| precedences[name] == :parent }.to_set
+          # (what a gem depends on can change which gems are needed in either direction, so it's possible,
+          # but unlikely, to go in circles. Bundler will sort out what's left over, in that case)
+          return [precedences, blockers] if replaced == out_of_sync || !seen.add?(replaced)
+
+          out_of_sync = replaced
+        end
+      end
+
+      # @!visibility private
+      # @param dependents [Enumerable<String>] gems that are following the parent, that depend on the gem in the
+      #   parent lockfile
+      # @param effective_specs [#call] given a gem's name, the specs in the parent lockfile that it's replaced with
+      # @return [true, false] if what any of the gems require from the parent lockfile excludes +version+ of +name+
+      def required_to_change?(dependents, effective_specs, name, version)
+        dependents.any? do |dependent|
+          effective_specs.call(dependent)&.any? do |spec|
+            spec.dependencies.any? do |dependency|
+              dependency.name == name && !dependency.requirement.satisfied_by?(version)
+            end
+          end
+        end
+      end
+
+      # @!visibility private
+      # @return [true, false] if syncing +spec+ to +parent_spec+ changes what it is, or what it depends on
+      def spec_changed?(spec, parent_spec)
+        return true unless spec.version == parent_spec.version
+
+        dependencies = lambda do |other|
+          other.dependencies.map { |dependency| [dependency.name, dependency.requirement.as_list.sort] }.sort
+        end
+        dependencies.call(spec) != dependencies.call(parent_spec)
+      end
+
+      # @!visibility private
+      # @param roots [Enumerable<String>] the names of the gems that are in the Gemfile
+      # @param specs [Hash<String, Hash<Object, LazySpecification>>] a lockfile's specs
+      # @param importable [#call] given the name of a gem that only the parent has, the specs of it that could be used
+      # @param following_parent [Set<String>] gems that will have their dependencies from the parent lockfile
+      # @param matched [Hash<String, Array<LazySpecification>>]
+      #   the specs in the parent lockfile that the variants of gems are replaced with
+      # @param unmatched [Hash<String, Array<LazySpecification>>]
+      #   variants of gems that stay as they are, even for gems that are following the parent
+      # @return [Set<String>] the names of the gems that are needed by the Gemfile, once the gems that are
+      #   following the parent do
+      def needed_gems(roots, specs, importable, following_parent, matched, unmatched)
+        needed = Set.new
+        pending = roots.to_a.dup
+        until pending.empty?
+          name = pending.shift
+          next unless needed.add?(name)
+
+          variants = if following_parent.include?(name) && matched.key?(name)
+                       matched[name] + unmatched.fetch(name, [])
+                     elsif specs[name]
+                       specs[name].values
+                     else
+                       # (a gem that the parent has, that this lockfile will get)
+                       importable.call(name)
+                     end
+          variants&.each { |spec| pending.concat(spec.dependencies.map(&:name)) }
+        end
+        needed
+      end
+
+      # @!visibility private
+      # @param effective_specs [#call] given a gem's name, the specs in the parent lockfile that it's replaced with
+      # @param specs [Hash<String, Hash<Object, LazySpecification>>] the lockfile's specs
+      # @param following_parent [Set<String>] gems that will have their dependencies from the parent lockfile
+      # @param roots [Enumerable<String>] the names of the gems that are in the Gemfile
+      # @return [Set<String>] the names of the gems that the parent lockfile has, that the lockfile doesn't, but
+      #   will get, because the Gemfile or the gems following the parent need them
+      def imported_gems(effective_specs, specs, following_parent, roots)
+        imported = Set.new
+        pending = following_parent.to_a
+        # (a gem that was just added to the Gemfile)
+        roots.each do |name|
+          pending << name if !specs.key?(name) && effective_specs.call(name) && imported.add?(name)
+        end
+        until pending.empty?
+          effective_specs.call(pending.shift)&.each do |spec|
+            spec.dependencies.each do |dependency|
+              next if specs.key?(dependency.name) || !imported.add?(dependency.name)
+
+              pending << dependency.name
+            end
+          end
+        end
+        imported
+      end
+
+      # @!visibility private
+      # Finds variants of gems (a gem version for a particular platform) that are in only one of two lockfiles,
+      # even though both of them have that version of the gem (or this one has a version left behind next to
+      # one the parent has), and the platform is one that only one of them is for. The source variant of a
+      # gem is never stale for a version of it that the parent lockfile has.
+      #
+      # The lockfiles can't be compared by their platforms alone, since gems can have variants for platforms
+      # (like ruby) that aren't listed, and what gems this lockfile needs on each platform depends on what its
+      # Gemfile declares (see {#gems_needed_on}). A variant is only missing if this lockfile needs the gem for
+      # the platform, and would use that variant.
+      #
+      # Gems that this lockfile has `platforms:` or `force_ruby_platform` for, and gems that it gets from a
+      # different source than the parent lockfile does, aren't expected to have the same variants.
+      #
+      # @param specs [Array<LazySpecification>]
+      # @param parent_specs [Array<LazySpecification>]
+      # @param platforms [Array<Gem::Platform, String>] the platforms listed in the lockfile for +specs+
+      # @param parent_platforms [Array<Gem::Platform, String>] the platforms listed in the parent lockfile
+      # @param dependency_names [Array<String>, nil]
+      #   the gems that are dependencies in the Gemfile for +specs+ (nil if it's not known, so any gem is needed)
+      # @param dependency_options [Hash<String, Array<Hash>>] see {Cache#record_dependency_options}
+      # @param same_source [#call] given a spec and a parent lockfile spec, if they're from the same source
+      # @return [Array(Array<LazySpecification>, Array<LazySpecification>)]
+      #   the variants only in +specs+ (that the parent lockfile's platforms don't include), and the ones only in
+      #   +parent_specs+ (that +platforms+ do include, and +specs+ need)
+      def variant_drift(specs,
+                        parent_specs,
+                        platforms,
+                        parent_platforms,
+                        dependency_names: nil,
+                        dependency_options: {},
+                        same_source: ->(spec, parent_spec) { spec.source == parent_spec.source })
+        ours = specs.group_by { |spec| [spec.name, spec.version] }
+        theirs = parent_specs.group_by { |spec| [spec.name, spec.version] }
+        ours_by_name = specs.group_by(&:name)
+
+        # a version of a gem that the parent doesn't have is left behind (instead of intentionally different)
+        # if this lockfile also has a version of that gem that the parent lockfile does have
+        left_behind = lambda do |spec|
+          ours_by_name[spec.name].any? do |other|
+            other.version != spec.version &&
+              theirs[[other.name, other.version]]&.any? { |parent| same_platform?(parent.platform, other.platform) }
+          end
+        end
+
+        # (other variants of the gem from a different source are expected to be different)
+        # (and the source of this lockfile's spec is always the first one to compare)
+        from_same_source = ->(spec, parents) { parents.any? { |parent| same_source.call(spec, parent) } }
+
+        stale = specs.select do |spec|
+          next false if matching_platforms(parent_platforms, spec.platform).any?
+          # Bundler keeps (or adds) the source variant of a gem next to the platform specific ones, whether
+          # or not the ruby platform is listed, so it's not stale for a version of the gem that the parent has
+          next false if spec.platform == Gem::Platform::RUBY && theirs.key?([spec.name, spec.version])
+
+          if (parent_variants = theirs[[spec.name, spec.version]])
+            from_same_source.call(spec, parent_variants) &&
+              parent_variants.none? { |parent| same_platform?(parent.platform, spec.platform) }
+          else
+            left_behind.call(spec)
+          end
+        end
+
+        # the variants of the parent lockfile that this lockfile would use, for the platforms they both have,
+        # when it doesn't have a variant it can use instead on that platform
+        missing = Set.new
+        platforms.each do |platform|
+          next if parent_platforms.none? { |other| same_platform?(other, platform) }
+
+          gems_needed_on(platform, ours_by_name, dependency_names, dependency_options).each do |name, force_ruby|
+            # (a gem that's forced to the ruby platform only uses its source variant)
+            target = force_ruby ? Gem::Platform::RUBY : platform
+
+            # (not every gem that's needed is in the lockfile, like bundler itself)
+            ours_by_name.fetch(name, []).map(&:version).uniq.each do |version|
+              next unless (parent_variants = theirs[[name, version]])
+
+              variants = ours[[name, version]]
+              MatchPlatform.select_best_platform_match(parent_variants, target).each do |expected|
+                # (both lockfiles have to list the platform. if the parent doesn't, its variant is just a
+                # source variant that Bundler kept, and this lockfile having removed the platform is what
+                # needs to sync)
+                next unless matching_platforms(platforms, expected.platform).any? &&
+                            matching_platforms(parent_platforms, expected.platform).any?
+                next unless variants.any? { |variant| same_source.call(variant, expected) }
+
+                missing << expected unless usable_instead?(variants, expected, target)
+              end
+            end
+          end
+        end
+        missing = missing.to_a
+
+        [stale, missing]
+      end
+
+      # @!visibility private
+      # If a variant of a gem (that the lockfile has) could be used on a platform in place of a variant of the
+      # same gem from the parent lockfile, because it's at least as specific to the platform.
+      #
+      # @param variants [Array<LazySpecification>] the variants of the gem that the lockfile has
+      # @param expected [LazySpecification] the variant of the gem from the parent lockfile
+      # @param platform [Gem::Platform, String] the platform the variants would be used for
+      def usable_instead?(variants, expected, platform)
+        specificity = ->(spec) { Gem::Platform.platform_specificity_match(spec.platform, platform) }
+
+        MatchPlatform.select_best_platform_match(variants, platform).any? do |variant|
+          specificity.call(variant) <= specificity.call(expected)
+        end
+      end
+
+      # @!visibility private
+      # The gems that a Gemfile needs on a platform, the same way Bundler works them out for a lockfile
+      # (see Bundler::Materialization): starting with the dependencies in the Gemfile that are for the
+      # platform, and then what the variant of each gem that would be used for the platform depends on.
+      # (A variant of a gem for a different platform may depend on different gems.)
+      #
+      # A gem can be declared in the Gemfile more than once, such as for different platforms, and only the
+      # declarations for the platform are considered.
+      #
+      # @param platform [Gem::Platform, String] one of the platforms listed in the lockfile
+      # @param specs_by_name [Hash<String, Array<LazySpecification>>] the specs of the lockfile
+      # @param dependency_names [Array<String>, nil] the gems that are dependencies in the Gemfile
+      #   (nil if it's not known, so any gem is needed)
+      # @param dependency_options [Hash<String, Array<Hash>>] see {Cache#record_dependency_options}
+      # @return [Hash<String, true or false>] the gems that are needed, and if only the source variant is used
+      def gems_needed_on(platform, specs_by_name, dependency_names, dependency_options)
+        declarations_for = lambda do |name|
+          dependency_options.fetch(name, []).select do |declaration|
+            declaration[:platforms].nil? || declaration[:platforms].any? { |other| same_platform?(other, platform) }
+          end
+        end
+
+        pending = if dependency_names
+                    dependency_names.select do |name|
+                      !dependency_options.key?(name) || declarations_for.call(name).any?
+                    end
+                  else
+                    specs_by_name.keys
+                  end
+
+        needed = {}
+        until pending.empty?
+          name = pending.shift
+          next if needed.key?(name)
+
+          declarations = declarations_for.call(name)
+          force_ruby = declarations.any? && declarations.all? { |declaration| declaration[:force_ruby] }
+          needed[name] = force_ruby
+          next unless (variants = specs_by_name[name])
+
+          # (not `force_ruby:`, since that changes the specs)
+          selected = MatchPlatform.select_best_platform_match(variants, force_ruby ? Gem::Platform::RUBY : platform)
+          selected.each { |spec| pending.concat(spec.dependencies.map(&:name)) }
+        end
+        needed
+      end
+
+      # @!visibility private
+      # @return [true, false] if two specs, from different lockfiles, are from the same source
+      def same_source?(spec, parent_spec, lockfile_name, parent_lockfile_name)
+        # have to ensure Path sources are relative to their lockfile before comparing
+        if [parent_spec.source, spec.source].grep(Source::Path).length == 2
+          lockfile_name
+            .dirname
+            .join(spec.source.path)
+            .ascend
+            .any?(parent_lockfile_name.dirname.join(parent_spec.source.path))
+        else
+          parent_spec.source == spec.source
+        end
+      end
+
+      # @!visibility private
+      # @return [true, false] if gems for each platform could be used for the other (since a gem
+      #   for Linux can be used for musl, but a musl gem can't be used for Linux), and both are for the same
+      #   CPU (since a gem for a universal CPU can be used for any, but isn't the same as one for a specific one)
+      def same_platform?(platform, other)
+        return platform == other unless platform.is_a?(Gem::Platform) && other.is_a?(Gem::Platform)
+
+        platform.cpu == other.cpu &&
+          platform === other && other === platform # rubocop:disable Style/CaseEquality -- Gem::Platform's match
+      end
+
+      # @!visibility private
+      # @param platforms [Array<Gem::Platform, String>] platforms listed in a lockfile
+      # @param platform [Gem::Platform, String] the platform of a gem variant
+      # @return [Array<Gem::Platform, String>] the listed platforms that the variant could be used for
+      def matching_platforms(platforms, platform)
+        # (a gem for Linux can be used on musl, but not the other way around, and only the ruby platform
+        # uses source variants)
+        platforms.select do |other|
+          if platform.is_a?(Gem::Platform) && other.is_a?(Gem::Platform)
+            platform === other # rubocop:disable Style/CaseEquality -- Gem::Platform's match
+          else
+            platform == other
+          end
+        end
       end
 
       # @!visibility private
@@ -411,6 +933,8 @@ module Bundler
       def reset!
         @lockfile_definitions = {}
         @loaded = false
+        @primary_gemfile = nil
+        @primary_lockfile = nil
       end
 
       # @!visibility private
@@ -418,6 +942,40 @@ module Bundler
         lockfile_definitions[Bundler.default_lockfile(force_original: true)]
       end
 
+      # @!visibility private
+      # The definitions of the other lockfiles, when working with all of them (so not with
+      # BUNDLE_LOCKFILE), for packaging gems from all of them. Their gems need to have been
+      # installed already, by a regular `bundle install`.
+      #
+      # @return [Array<Definition>]
+      def alternate_definitions
+        return [] if lockfile_definitions.empty? || env_lockfile
+
+        # the primary lockfile doesn't have to be declared
+        candidates = lockfile_definitions.values
+        if @primary_lockfile && !lockfile_definitions.key?(@primary_lockfile)
+          candidates += [{ gemfile: @primary_gemfile, lockfile: @primary_lockfile, prepare: nil }]
+        end
+
+        default_root = Bundler.root
+        candidates.filter_map do |lockfile_definition|
+          lockfile = lockfile_definition[:lockfile]
+          # the one Bundler is already working with, which may be an alternate lockfile flagged as active
+          next if lockfile == Bundler.default_lockfile
+          next unless lockfile.exist?
+
+          Bundler.root = lockfile_definition[:gemfile].dirname
+          builder = Dsl.new
+          prepare_block = lockfile_definition[:prepare]
+          builder.eval_gemfile(lockfile_definition[:gemfile], &prepare_block) if prepare_block
+          builder.eval_gemfile(lockfile_definition[:gemfile])
+          # (as the default lockfile, so that it isn't swapped for the active one)
+          Bundler.with_default_lockfile(lockfile) { builder.to_definition(lockfile, {}) }
+        end
+      ensure
+        Bundler.root = default_root if default_root
+      end
+
       private
 
       # @return [Array(String, true or false), nil]
@@ -445,9 +1003,6 @@ module Bundler
       end
 
       def expand_lockfile(lockfile)
-        if lockfile.is_a?(String) && !(lockfile.include?("/") || lockfile.end_with?(".lock"))
-          lockfile = "Gemfile.#{lockfile}.lock"
-        end
         # use absolute paths
         lockfile = Bundler.root.join(lockfile).expand_path if lockfile
         # use the default lockfile (Gemfile.lock) if none was given
@@ -504,7 +1059,10 @@ module Bundler
                          cache,
                          install:,
                          dependency_changes: false,
-                         unlocking_bundler: false)
+                         unlocking_bundler: false,
+                         added_platforms: [],
+                         removed_platforms: [],
+                         unlock_gems: Set.new)
         prepare_block = lockfile_definition[:prepare]
 
         gemfile = lockfile_definition[:gemfile]
@@ -520,8 +1078,16 @@ module Bundler
           builder.instance_variable_set(:@ruby_version, parent_ruby_version_requirement)
         end
 
-        definition = builder.to_definition(lockfile, { bundler: unlocking_bundler })
+        unlock = { bundler: unlocking_bundler }
+        # only the gems that are in the way of syncing with the parent
+        unless unlock_gems.empty?
+          unlock[:gems] = unlock_gems.to_a
+          unlock[:conservative] = true
+        end
+        definition = builder.to_definition(lockfile, unlock)
         definition.instance_variable_set(:@dependency_changes, dependency_changes) if dependency_changes
+        added_platforms.each { |platform| definition.add_platform(platform) }
+        removed_platforms.each { |platform| definition.remove_platform(platform) }
 
         # match the parent lockfile in whether there are checksums
         unless Bundler.frozen_bundle?
@@ -537,6 +1103,10 @@ module Bundler
         definition.instance_variable_set(:@lockfile_contents, current_lockfile.read) if current_lockfile.exist?
 
         orig_definition = definition.dup # we might need it twice
+        # `dup` shares the platforms array, and resolving locally changes it (like dropping the ruby platform,
+        # and adding the local platform) before it might fail, which would leave a remote resolution
+        # starting from the wrong platforms
+        orig_definition.instance_variable_set(:@platforms, definition.instance_variable_get(:@platforms).dup)
 
         # install gems for the exact current version of the lockfile
         # this ensures it doesn't re-resolve with only (different)
@@ -572,8 +1142,10 @@ module Bundler
           previous_ui_level = Bundler.ui.level
           Bundler.ui.level = "warn"
           begin
-            # force a remote resolution if intermediate gems are missing
-            if definition.instance_variable_get(:@locked_spec_with_missing_deps) ||
+            # force a remote resolution if intermediate gems are missing, or if platforms were added
+            # (a gem's source variant would satisfy them locally, without its platform specific variants)
+            if (added_platforms.any? && !local_only?) ||
+               definition.instance_variable_get(:@locked_spec_with_missing_deps) ||
                definition.instance_variable_get(:@locked_spec_with_invalid_deps) ||
                definition.instance_variable_get(:@missing_lockfile_dep) ||
                definition.instance_variable_get(:@invalid_lockfile_dep)
@@ -593,6 +1165,11 @@ module Bundler
               spec.source.specs << spec
             end
             resolve_locally(definition)
+            # a local resolution can only see the gems that are installed, so it can drop platforms
+            # (like ruby) that remote gem variants would keep. the platforms should match the parent's
+            parent_platforms = cache.parser(lockfile_definition[:parent]).platforms.map(&:to_s).sort
+            raise SolveFailure unless local_only? || definition.platforms.map(&:to_s).sort == parent_platforms
+
             missing_checksums = fill_checksums(definition, lockfile_definition[:parent], cache)
             # fetch checksums that aren't available locally
             raise SolveFailure unless missing_checksums.empty? || local_only?
@@ -612,6 +1189,11 @@ module Bundler
                   "Run without `--local` to fetch them."
           end
           SharedHelpers.capture_filesystem_access do
+            # a frozen bundle can't change its lockfile, and trying to just fails with a misleading
+            # error from Bundler (like about updating Bundler itself). install what it locks, and
+            # let the check afterwards report what's actually wrong with it
+            next if Bundler.frozen_bundle?
+
             definition.instance_variable_set(:@resolved_bundler_version, unlocking_bundler) if unlocking_bundler
 
             # need to force it to _not_ preserve unknown sections, so that it

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler-multilock
 version: !ruby/object:Gem::Version
-  version: 2.0.0.beta4
+  version: 2.0.0.beta6
 platform: ruby
 authors:
 - Instructure
@@ -18,7 +18,7 @@ dependencies:
         version: 4.1.0.beta2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '4.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: 4.1.0.beta2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '4.2'
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -41,6 +41,7 @@ files:
 - lib/bundler/multilock/ext/definition.rb
 - lib/bundler/multilock/ext/dsl.rb
 - lib/bundler/multilock/ext/plugin/dsl.rb
+- lib/bundler/multilock/ext/runtime.rb
 - lib/bundler/multilock/ext/shared_helpers.rb
 - lib/bundler/multilock/ext/source.rb
 - lib/bundler/multilock/ext/source_list.rb