bundler 2.5.11 → 2.5.17

data/lib/bundler/runtime.rb

@@ -10,7 +10,7 @@ module Bundler
     end
 
     def setup(*groups)
-      @definition.ensure_equivalent_gemfile_and_lockfile if Bundler.frozen_bundle?
+      @definition.ensure_equivalent_gemfile_and_lockfile
 
       # Has to happen first
       clean_load_path
@@ -128,11 +128,6 @@ module Bundler
         spec.source.cache(spec, custom_path) if spec.source.respond_to?(:cache)
       end
 
-      Dir[cache_path.join("*/.git")].each do |git_dir|
-        FileUtils.rm_rf(git_dir)
-        FileUtils.touch(File.expand_path("../.bundlecache", git_dir))
-      end
-
       prune_cache(cache_path) unless Bundler.settings[:no_prune]
     end
 

data/lib/bundler/self_manager.rb

@@ -70,8 +70,23 @@ module Bundler
       configured_gem_home = ENV["GEM_HOME"]
       configured_gem_path = ENV["GEM_PATH"]
 
-      cmd = [$PROGRAM_NAME, *ARGV]
-      cmd.unshift(Gem.ruby) unless File.executable?($PROGRAM_NAME)
+      # Bundler specs need some stuff to be required before Bundler starts
+      # running, for example, for faking the compact index API. However, these
+      # flags are lost when we reexec to a different version of Bundler. In the
+      # future, we may be able to properly reconstruct the original Ruby
+      # invocation (see https://bugs.ruby-lang.org/issues/6648), but for now
+      # there's no way to do it, so we need to be explicit about how to re-exec.
+      # This may be a feature end users request at some point, but maybe by that
+      # time, we have builtin tools to do. So for now, we use an undocumented
+      # ENV variable only for our specs.
+      bundler_spec_original_cmd = ENV["BUNDLER_SPEC_ORIGINAL_CMD"]
+      if bundler_spec_original_cmd
+        require "shellwords"
+        cmd = [*Shellwords.shellsplit(bundler_spec_original_cmd), *ARGV]
+      else
+        cmd = [$PROGRAM_NAME, *ARGV]
+        cmd.unshift(Gem.ruby) unless File.executable?($PROGRAM_NAME)
+      end
 
       Bundler.with_original_env do
         Kernel.exec(
@@ -92,6 +107,7 @@ module Bundler
     def autoswitching_applies?
       ENV["BUNDLER_VERSION"].nil? &&
         Bundler.rubygems.supports_bundler_trampolining? &&
+        ruby_can_restart_with_same_arguments? &&
         SharedHelpers.in_bundle? &&
         lockfile_version
     end
@@ -151,6 +167,10 @@ module Bundler
       !version.to_s.end_with?(".dev")
     end
 
+    def ruby_can_restart_with_same_arguments?
+      $PROGRAM_NAME != "-e"
+    end
+
     def updating?
       "update".start_with?(ARGV.first || " ") && ARGV[1..-1].any? {|a| a.start_with?("--bundler") }
     end

data/lib/bundler/settings.rb

@@ -103,6 +103,7 @@ module Bundler
     def initialize(root = nil)
       @root            = root
       @local_config    = load_config(local_config_file)
+      @local_root      = root || Pathname.new(".bundle").expand_path
 
       @env_config      = ENV.to_h
       @env_config.select! {|key, _value| key.start_with?("BUNDLE_") }
@@ -142,7 +143,7 @@ module Bundler
     end
 
     def set_local(key, value)
-      local_config_file || raise(GemfileNotFound, "Could not locate Gemfile")
+      local_config_file = @local_root.join("config")
 
       set_key(key, value, @local_config, local_config_file)
     end
@@ -491,6 +492,10 @@ module Bundler
         valid_file = file.exist? && !file.size.zero?
         return {} unless valid_file
         serializer_class.load(file.read).inject({}) do |config, (k, v)|
+          k = k.dup
+          k << "/" if /https?:/i.match?(k) && !k.end_with?("/", "__#{FALLBACK_TIMEOUT_URI_OPTION.upcase}")
+          k.gsub!(".", "__")
+
           unless k.start_with?("#")
             if k.include?("-")
               Bundler.ui.warn "Your #{file} config includes `#{k}`, which contains the dash character (`-`).\n" \
@@ -518,26 +523,25 @@ module Bundler
       YAMLSerializer
     end
 
-    PER_URI_OPTIONS = %w[
-      fallback_timeout
-    ].freeze
+    FALLBACK_TIMEOUT_URI_OPTION = "fallback_timeout"
 
     NORMALIZE_URI_OPTIONS_PATTERN =
       /
         \A
         (\w+\.)? # optional prefix key
         (https?.*?) # URI
-        (\.#{Regexp.union(PER_URI_OPTIONS)})? # optional suffix key
+        (\.#{FALLBACK_TIMEOUT_URI_OPTION})? # optional suffix key
         \z
       /ix
 
     def self.key_for(key)
-      key = normalize_uri(key).to_s if key.is_a?(String) && key.start_with?("http", "mirror.http")
-      key = key_to_s(key).gsub(".", "__")
+      key = key_to_s(key)
+      key = normalize_uri(key) if key.start_with?("http", "mirror.http")
+      key = key.gsub(".", "__")
       key.gsub!("-", "___")
       key.upcase!
 
-      key.prepend("BUNDLE_")
+      key.gsub(/\A([ #]*)/, '\1BUNDLE_')
     end
 
     # TODO: duplicates Rubygems#normalize_uri

data/lib/bundler/setup.rb

@@ -5,6 +5,9 @@ require_relative "shared_helpers"
 if Bundler::SharedHelpers.in_bundle?
   require_relative "../bundler"
 
+  # autoswitch to locked Bundler version if available
+  Bundler.auto_switch
+
   # try to auto_install first before we get to the `Bundler.ui.silence`, so user knows what is happening
   Bundler.auto_install
 

data/lib/bundler/shared_helpers.rb

@@ -4,14 +4,14 @@ require_relative "version"
 require_relative "rubygems_integration"
 require_relative "current_ruby"
 
+autoload :Pathname, "pathname"
+
 module Bundler
   autoload :WINDOWS, File.expand_path("constants", __dir__)
   autoload :FREEBSD, File.expand_path("constants", __dir__)
   autoload :NULL, File.expand_path("constants", __dir__)
 
   module SharedHelpers
-    autoload :Pathname, "pathname"
-
     def root
       gemfile = find_gemfile
       raise GemfileNotFound, "Could not locate Gemfile" unless gemfile

data/lib/bundler/source/git.rb

@@ -32,6 +32,20 @@ module Bundler
         @local      = false
       end
 
+      def remote!
+        return if @allow_remote
+
+        @local_specs = nil
+        @allow_remote = true
+      end
+
+      def cached!
+        return if @allow_cached
+
+        @local_specs = nil
+        @allow_cached = true
+      end
+
       def self.from_lock(options)
         new(options.merge("uri" => options.delete("remote")))
       end
@@ -150,7 +164,8 @@ module Bundler
             "does not exist. Run `bundle config unset local.#{override_for(original_path)}` to remove the local override"
         end
 
-        set_local!(path)
+        @local = true
+        set_paths!(path)
 
         # Create a new git proxy without the cached revision
         # so the Gemfile.lock always picks up the new revision.
@@ -173,13 +188,11 @@ module Bundler
       end
 
       def specs(*)
-        set_local!(app_cache_path) if has_app_cache? && !local?
+        set_cache_path!(app_cache_path) if has_app_cache? && !local?
 
         if requires_checkout? && !@copied
           fetch
-          git_proxy.copy_to(install_path, submodules)
-          serialize_gemspecs_in(install_path)
-          @copied = true
+          checkout
         end
 
         local_specs
@@ -192,10 +205,7 @@ module Bundler
         print_using_message "Using #{version_message(spec, options[:previous_spec])} from #{self}"
 
         if (requires_checkout? && !@copied) || force
-          Bundler.ui.debug "  * Checking out revision: #{ref}"
-          git_proxy.copy_to(install_path, submodules)
-          serialize_gemspecs_in(install_path)
-          @copied = true
+          checkout
         end
 
         generate_bin_options = { disable_extensions: !Bundler.rubygems.spec_missing_extensions?(spec), build_args: options[:build_args] }
@@ -207,12 +217,13 @@ module Bundler
       def cache(spec, custom_path = nil)
         app_cache_path = app_cache_path(custom_path)
         return unless Bundler.feature_flag.cache_all?
-        return if path == app_cache_path
+        return if install_path == app_cache_path
+        return if cache_path == app_cache_path
         cached!
         FileUtils.rm_rf(app_cache_path)
         git_proxy.checkout if requires_checkout?
-        git_proxy.copy_to(app_cache_path, @submodules)
-        serialize_gemspecs_in(app_cache_path)
+        FileUtils.cp_r("#{cache_path}/.", app_cache_path)
+        FileUtils.touch(app_cache_path.join(".bundlecache"))
       end
 
       def load_spec_files
@@ -256,6 +267,13 @@ module Bundler
 
       private
 
+      def checkout
+        Bundler.ui.debug "  * Checking out revision: #{ref}"
+        git_proxy.copy_to(install_path, submodules)
+        serialize_gemspecs_in(install_path)
+        @copied = true
+      end
+
       def humanized_ref
         if local?
           path
@@ -284,10 +302,19 @@ module Bundler
         end
       end
 
-      def set_local!(path)
-        @local       = true
-        @local_specs = @git_proxy = nil
-        @cache_path  = @install_path = path
+      def set_paths!(path)
+        set_cache_path!(path)
+        set_install_path!(path)
+      end
+
+      def set_cache_path!(path)
+        @git_proxy = nil
+        @cache_path = path
+      end
+
+      def set_install_path!(path)
+        @local_specs = nil
+        @install_path = path
       end
 
       def has_app_cache?

data/lib/bundler/source/path.rb

@@ -18,9 +18,6 @@ module Bundler
         @options = options.dup
         @glob = options["glob"] || DEFAULT_GLOB
 
-        @allow_cached = false
-        @allow_remote = false
-
         @root_path = options["root_path"] || root
 
         if options["path"]
@@ -41,16 +38,6 @@ module Bundler
         @original_path = @path
       end
 
-      def remote!
-        @local_specs = nil
-        @allow_remote = true
-      end
-
-      def cached!
-        @local_specs = nil
-        @allow_cached = true
-      end
-
       def self.from_lock(options)
         new(options.merge("path" => options.delete("remote")))
       end

data/lib/bundler/source/rubygems.rb

@@ -22,6 +22,8 @@ module Bundler
         @checksum_store = Checksum::Store.new
 
         Array(options["remotes"]).reverse_each {|r| add_remote(r) }
+
+        @lockfile_remotes = @remotes if options["from_lockfile"]
       end
 
       def caches
@@ -91,13 +93,13 @@ module Bundler
 
       def self.from_lock(options)
         options["remotes"] = Array(options.delete("remote")).reverse
-        new(options)
+        new(options.merge("from_lockfile" => true))
       end
 
       def to_lock
         out = String.new("GEM\n")
-        remotes.reverse_each do |remote|
-          out << "  remote: #{remove_auth remote}\n"
+        lockfile_remotes.reverse_each do |remote|
+          out << "  remote: #{remote}\n"
         end
         out << "  specs:\n"
       end
@@ -136,20 +138,17 @@ module Bundler
           index = @allow_remote ? remote_specs.dup : Index.new
           index.merge!(cached_specs) if @allow_cached
           index.merge!(installed_specs) if @allow_local
+
+          # complete with default specs, only if not already available in the
+          # index through remote, cached, or installed specs
+          index.use(default_specs) if @allow_local
+
           index
         end
       end
 
       def install(spec, options = {})
-        force = options[:force]
-        ensure_builtin_gems_cached = options[:ensure_builtin_gems_cached]
-
-        if ensure_builtin_gems_cached && spec.default_gem? && !cached_path(spec)
-          cached_built_in_gem(spec) unless spec.remote
-          force = true
-        end
-
-        if installed?(spec) && !force
+        if (spec.default_gem? && !cached_built_in_gem(spec)) || (installed?(spec) && !options[:force])
           print_using_message "Using #{version_message(spec, options[:previous_spec])}"
           return nil # no post-install message
         end
@@ -207,6 +206,7 @@ module Bundler
 
         spec.full_gem_path = installed_spec.full_gem_path
         spec.loaded_from = installed_spec.loaded_from
+        spec.base_dir = installed_spec.base_dir
 
         spec.post_install_message
       end
@@ -362,7 +362,7 @@ module Bundler
 
       def installed_specs
         @installed_specs ||= Index.build do |idx|
-          Bundler.rubygems.all_specs.reverse_each do |spec|
+          Bundler.rubygems.installed_specs.reverse_each do |spec|
             spec.source = self
             if Bundler.rubygems.spec_missing_extensions?(spec, false)
               Bundler.ui.debug "Source #{self} is ignoring #{spec} because it is missing extensions"
@@ -373,6 +373,15 @@ module Bundler
         end
       end
 
+      def default_specs
+        @default_specs ||= Index.build do |idx|
+          Bundler.rubygems.default_specs.each do |spec|
+            spec.source = self
+            idx << spec
+          end
+        end
+      end
+
       def cached_specs
         @cached_specs ||= begin
           idx = Index.new
@@ -457,6 +466,10 @@ module Bundler
 
       private
 
+      def lockfile_remotes
+        @lockfile_remotes || credless_remotes
+      end
+
       # Checks if the requested spec exists in the global cache. If it does,
       # we copy it to the download path, and if it does not, we download it.
       #

data/lib/bundler/spec_set.rb

@@ -71,12 +71,6 @@ module Bundler
       platforms
     end
 
-    def complete_platforms!(platforms)
-      platforms.each do |platform|
-        complete_platform(platform)
-      end
-    end
-
     def validate_deps(s)
       s.runtime_dependencies.each do |dep|
         next if dep.name == "bundler"
@@ -100,7 +94,7 @@ module Bundler
     end
 
     def delete(specs)
-      specs.each {|spec| @specs.delete(spec) }
+      Array(specs).each {|spec| @specs.delete(spec) }
 
       reset!
     end
@@ -158,6 +152,12 @@ module Bundler
       @specs.detect {|spec| spec.name == name && spec.match_platform(platform) }
     end
 
+    def specs_compatible_with(other)
+      select do |spec|
+        other.valid?(spec)
+      end
+    end
+
     def delete_by_name(name)
       @specs.reject! {|spec| spec.name == name }
 
@@ -195,6 +195,10 @@ module Bundler
       lookup.keys
     end
 
+    def valid?(s)
+      s.matches_current_metadata? && valid_dependencies?(s)
+    end
+
     private
 
     def reset!
@@ -209,7 +213,7 @@ module Bundler
         spec = specs.first
         matching_specs = spec.source.specs.search([spec.name, spec.version])
         platform_spec = GemHelpers.select_best_platform_match(matching_specs, platform).find do |s|
-          s.matches_current_metadata? && valid_dependencies?(s)
+          valid?(s)
         end
 
         if platform_spec
@@ -273,13 +277,11 @@ module Bundler
       specs_for_name = lookup[dep.name]
       return [] unless specs_for_name
 
-      matching_specs = if dep.force_ruby_platform
-        GemHelpers.force_ruby_platform(specs_for_name)
+      if platform
+        GemHelpers.select_best_platform_match(specs_for_name, platform, force_ruby: dep.force_ruby_platform)
       else
-        GemHelpers.select_best_platform_match(specs_for_name, platform || Bundler.local_platform)
+        GemHelpers.select_best_local_platform_match(specs_for_name, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform)
       end
-      matching_specs.map!(&:materialize_for_installation).compact! if platform.nil?
-      matching_specs
     end
 
     def tsort_each_child(s)

data/lib/bundler/stub_specification.rb

@@ -77,6 +77,14 @@ module Bundler
       stub.full_require_paths
     end
 
+    def require_paths
+      stub.require_paths
+    end
+
+    def base_dir=(path)
+      stub.base_dir = path
+    end
+
     def load_paths
       full_require_paths
     end

data/lib/bundler/vendored_net_http.rb

@@ -1,12 +1,23 @@
 # frozen_string_literal: true
 
-begin
-  require "rubygems/vendored_net_http"
-rescue LoadError
+# This defined? guard can be removed once RubyGems 3.4 support is dropped.
+#
+# Bundler specs load this code from `spec/support/vendored_net_http.rb` to avoid
+# activating the Bundler gem too early. Without this guard, we get redefinition
+# warnings once Bundler is actually activated and
+# `lib/bundler/vendored_net_http.rb` is required. This is not an issue in
+# RubyGems versions including `rubygems/vendored_net_http` since `require` takes
+# care of avoiding the double load.
+#
+unless defined?(Gem::Net)
   begin
-    require "rubygems/net/http"
+    require "rubygems/vendored_net_http"
   rescue LoadError
-    require "net/http"
-    Gem::Net = Net
+    begin
+      require "rubygems/net/http"
+    rescue LoadError
+      require "net/http"
+      Gem::Net = Net
+    end
   end
 end

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "2.5.11".freeze
+  VERSION = "2.5.17".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= VERSION.split(".").first.to_i

data/lib/bundler/yaml_serializer.rb

@@ -41,7 +41,7 @@ module Bundler
     HASH_REGEX = /
       ^
       ([ ]*) # indentations
-      (.+) # key
+      ([^#]+) # key excludes comment char '#'
       (?::(?=(?:\s|$))) # :  (without the lookahead the #key includes this when : is present in value)
       [ ]?
       (['"]?) # optional opening quote
@@ -60,7 +60,6 @@ module Bundler
           indent, key, quote, val = match.captures
           val = strip_comment(val)
 
-          convert_to_backward_compatible_key!(key)
           depth = indent.size / 2
           if quote.empty? && val.empty?
             new_hash = {}
@@ -92,14 +91,8 @@ module Bundler
       end
     end
 
-    # for settings' keys
-    def convert_to_backward_compatible_key!(key)
-      key << "/" if /https?:/i.match?(key) && !%r{/\Z}.match?(key)
-      key.gsub!(".", "__")
-    end
-
     class << self
-      private :dump_hash, :convert_to_backward_compatible_key!
+      private :dump_hash
     end
   end
 end

data/lib/bundler.rb

@@ -42,6 +42,7 @@ module Bundler
   autoload :Checksum,               File.expand_path("bundler/checksum", __dir__)
   autoload :CLI,                    File.expand_path("bundler/cli", __dir__)
   autoload :CIDetector,             File.expand_path("bundler/ci_detector", __dir__)
+  autoload :CompactIndexClient,     File.expand_path("bundler/compact_index_client", __dir__)
   autoload :Definition,             File.expand_path("bundler/definition", __dir__)
   autoload :Dependency,             File.expand_path("bundler/dependency", __dir__)
   autoload :Deprecate,              File.expand_path("bundler/deprecate", __dir__)
@@ -166,6 +167,10 @@ module Bundler
       end
     end
 
+    def auto_switch
+      self_manager.restart_with_locked_bundler_if_needed
+    end
+
     # Automatically install dependencies if Bundler.settings[:auto_install] exists.
     # This is set through config cmd `bundle config set --global auto_install 1`.
     #
@@ -356,7 +361,7 @@ module Bundler
     def settings
       @settings ||= Settings.new(app_config_path)
     rescue GemfileNotFound
-      @settings = Settings.new(Pathname.new(".bundle").expand_path)
+      @settings = Settings.new
     end
 
     # @return [Hash] Environment present before Bundler was activated

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 2.5.11
+  version: 2.5.17
 platform: ruby
 authors:
 - André Arko
@@ -22,7 +22,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-05-28 00:00:00.000000000 Z
+date: 2024-08-01 00:00:00.000000000 Z
 dependencies: []
 description: Bundler manages an application's dependencies through its entire life,
   across many machines, systematically and repeatably
@@ -79,6 +79,7 @@ files:
 - lib/bundler/compact_index_client/cache.rb
 - lib/bundler/compact_index_client/cache_file.rb
 - lib/bundler/compact_index_client/gem_parser.rb
+- lib/bundler/compact_index_client/parser.rb
 - lib/bundler/compact_index_client/updater.rb
 - lib/bundler/constants.rb
 - lib/bundler/current_ruby.rb
@@ -399,7 +400,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.2.3
 requirements: []
-rubygems_version: 3.5.11
+rubygems_version: 3.5.17
 signing_key:
 specification_version: 4
 summary: The best way to manage your application's dependencies