bundler 2.7.0 → 2.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47c879a30420e218f704088e1a9c5eb3dd164e0ee5f942fea415b19ec616661f
-  data.tar.gz: f3d9d4c7034ec23b40a94c0e279b420b72abc4745e86ab6af0ff1eecf68a63c8
+  metadata.gz: f1982c5c69b6f594a4722d67fe1dbdf4e172d4d5bb2f668dcf2d761b5b586073
+  data.tar.gz: 4ba353e26a9532c811867f2d5fd670ada1399800e9eef227777273cd18f7cfe4
 SHA512:
-  metadata.gz: 982d36bf916dffff2abd6698481a358dfb5505af7d8c2f23d60334df412854f086d76eacb0dfdf624d84e05a8695d2631675252433ce101a3287b520a6b2336f
-  data.tar.gz: 20864a8da985d5d98d5dd1fc1c29b17a20bea8e0e4d57949e656ef5a9a3101fb2b96bc04247764e5174bfb088147655625d22d83febaa068cf32b89d9cd4d79e
+  metadata.gz: a3e5ca074599e8ef171e40134035e3f676ea99bcb9dda2aa1b4fea8d36cc31fac0b57e2751799ece3232b7cdf8df0c8dd85ccf4c95b1306552fd80915847e8c8
+  data.tar.gz: 2700a932263a8da12c748917da79cd8e058085a7b6db00bbbec6c60cffb671bb939d5ebc47f842083b9f0bbd5c139dd40d7ada3fb13b7a91abca2f97320b7b11

data/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 2.7.2 (2025-09-09)
+
+### Enhancements:
+
+  - Improve error message when the same source is specified through `gemspec` and `path` [#8460](https://github.com/rubygems/rubygems/pull/8460)
+  - Raise an error in frozen mode if some registry gems have empty checksums [#8888](https://github.com/rubygems/rubygems/pull/8888)
+  - Bump vendored thor to 1.4.0 [#8883](https://github.com/rubygems/rubygems/pull/8883)
+  - Delay default path and global cache changes to Bundler 5 [#8867](https://github.com/rubygems/rubygems/pull/8867)
+  - Fix spacing in bundle gem newgem.gemspec.tt [#8865](https://github.com/rubygems/rubygems/pull/8865)
+
+### Bug fixes:
+
+  - Fix `bundle cache --frozen` and `bundle cache --no-prune` not printing a deprecation message [#8926](https://github.com/rubygems/rubygems/pull/8926)
+  - Fix local installation incorrectly forced if there's a `vendor/cache` directory and frozen mode is set [#8925](https://github.com/rubygems/rubygems/pull/8925)
+  - Fix `bundle lock --update <gem>` with `--lockfile` flag updating all gems [#8922](https://github.com/rubygems/rubygems/pull/8922)
+  - Fix `bundle show --verbose` and recommend it as an alternative to `bundle show --outdated` [#8915](https://github.com/rubygems/rubygems/pull/8915)
+  - Fix `bundle cache --no-all` not printing a deprecation warning [#8912](https://github.com/rubygems/rubygems/pull/8912)
+  - Fix `bundle update foo` unable to update foo in an edge case [#8897](https://github.com/rubygems/rubygems/pull/8897)
+  - Fix Bundler printing more flags than actually passed in verbose mode [#8914](https://github.com/rubygems/rubygems/pull/8914)
+  - Fix bundler failing to install sorbet-static in truffleruby when there's no lockfile [#8872](https://github.com/rubygems/rubygems/pull/8872)
+
+### Documentation:
+
+  - Improve documentation of `bundle doctor`, `bundle plugin`, and `bundle config` [#8919](https://github.com/rubygems/rubygems/pull/8919)
+  - Make sure all CLI flags and subcommands are documented [#8861](https://github.com/rubygems/rubygems/pull/8861)
+
+## 2.7.1 (2025-07-21)
+
+### Enhancements:
+
+  - Add some missing deprecation messages [#8844](https://github.com/rubygems/rubygems/pull/8844)
+
+### Bug fixes:
+
+  - Cancel deprecation of `--force` flag to `bundle install` and `bundle update` [#8843](https://github.com/rubygems/rubygems/pull/8843)
+
+### Documentation:
+
+  - Clarify documentation about new default gem installation directory in Bundler 4 [#8857](https://github.com/rubygems/rubygems/pull/8857)
+  - Use mailto link in Code of Conduct [#8849](https://github.com/rubygems/rubygems/pull/8849)
+  - Update Code of Conduct email to conduct@rubygems.org [#8848](https://github.com/rubygems/rubygems/pull/8848)
+  - Add missing link to `irb` repo in DEBUGGING.md [#8842](https://github.com/rubygems/rubygems/pull/8842)
+
 ## 2.7.0 (2025-07-16)
 
 ### Breaking changes:

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2025-07-16".freeze
-    @git_commit_sha = "24a46f4f3d6".freeze
+    @built_at = "2025-09-09".freeze
+    @git_commit_sha = "b463ced1459".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/checksum.rb

@@ -205,6 +205,12 @@ module Bundler
         @store[spec.lock_name].nil?
       end
 
+      def empty?(spec)
+        return false unless spec.source.is_a?(Bundler::Source::Rubygems)
+
+        @store[spec.lock_name].empty?
+      end
+
       def register(spec, checksum)
         register_checksum(spec.lock_name, checksum)
       end

data/lib/bundler/cli/cache.rb

@@ -16,7 +16,6 @@ module Bundler
       setup_cache_all
       install
 
-      # TODO: move cache contents here now that all bundles are locked
       custom_path = Bundler.settings[:path] if options[:path]
 
       Bundler.settings.temporary(cache_all_platforms: options["all-platforms"]) do

data/lib/bundler/cli/common.rb

@@ -130,7 +130,7 @@ module Bundler
     def self.clean_after_install?
       clean = Bundler.settings[:clean]
       return clean unless clean.nil?
-      clean ||= Bundler.feature_flag.bundler_4_mode? && Bundler.settings[:path].nil?
+      clean ||= Bundler.feature_flag.bundler_5_mode? && Bundler.settings[:path].nil?
       clean &&= !Bundler.use_system_gems?
       clean
     end

data/lib/bundler/cli/install.rb

@@ -42,8 +42,6 @@ module Bundler
                                  "before deploying."
         end
 
-        options[:local] = true if Bundler.app_cache.exist?
-
         Bundler.settings.set_command_option :deployment, true if options[:deployment]
         Bundler.settings.set_command_option :frozen, true if options[:frozen]
       end
@@ -179,7 +177,7 @@ module Bundler
 
       normalize_groups if options[:without] || options[:with]
 
-      options[:force] = options[:redownload]
+      options[:force] = options[:redownload] if options[:redownload]
     end
 
     def warn_ambiguous_gems

data/lib/bundler/cli/lock.rb

@@ -35,11 +35,8 @@ module Bundler
         update = { bundler: bundler }
       end
 
-      file = options[:lockfile]
-      file = file ? Pathname.new(file).expand_path : Bundler.default_lockfile
-
       Bundler.settings.temporary(frozen: false) do
-        definition = Bundler.definition(update, file)
+        definition = Bundler.definition(update, Bundler.default_lockfile)
         definition.add_checksums if options["add-checksums"]
 
         Bundler::CLI::Common.configure_gem_version_promoter(definition, options) if options[:update]
@@ -71,8 +68,11 @@ module Bundler
         if print
           puts definition.to_lock
         else
+          file = options[:lockfile]
+          file = file ? Pathname.new(file).expand_path : Bundler.default_lockfile
+
           puts "Writing lockfile to #{file}"
-          definition.lock
+          definition.write_lock(file, false)
         end
       end
 

data/lib/bundler/cli/show.rb

@@ -57,12 +57,8 @@ module Bundler
 
     def fetch_latest_specs
       definition = Bundler.definition(true)
-      if options[:outdated]
-        Bundler.ui.info "Fetching remote specs for outdated check...\n\n"
-        Bundler.ui.silence { definition.remotely! }
-      else
-        definition.with_cache!
-      end
+      Bundler.ui.info "Fetching remote specs for outdated check...\n\n"
+      Bundler.ui.silence { definition.remotely! }
       Bundler.reset!
       definition.specs
     end

data/lib/bundler/cli/update.rb

@@ -63,7 +63,7 @@ module Bundler
       opts = options.dup
       opts["update"] = true
       opts["local"] = options[:local]
-      opts["force"] = options[:redownload]
+      opts["force"] = options[:redownload] if options[:redownload]
 
       Bundler.settings.set_command_option_if_given :jobs, opts["jobs"]
 

data/lib/bundler/cli.rb

@@ -220,7 +220,7 @@ module Bundler
     method_option "local", type: :boolean, banner: "Do not attempt to fetch gems remotely and use the gem cache instead"
     method_option "prefer-local", type: :boolean, banner: "Only attempt to fetch gems remotely if not present locally, even if newer versions are available remotely"
     method_option "no-cache", type: :boolean, banner: "Don't update the existing gem cache."
-    method_option "redownload", type: :boolean, aliases: "--force", banner: "Force downloading every gem."
+    method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "no-prune", type: :boolean, banner: "Don't remove stale gems from the cache."
     method_option "path", type: :string, banner: "Specify a different path than the system default ($BUNDLE_PATH or $GEM_HOME).#{" Bundler will remember this value for future installs on this machine" unless Bundler.feature_flag.forget_cli_options?}"
     method_option "quiet", type: :boolean, banner: "Only output warnings and errors."
@@ -232,15 +232,13 @@ module Bundler
     method_option "without", type: :array, banner: "Exclude gems that are part of the specified named group."
     method_option "with", type: :array, banner: "Include gems that are part of the specified named group."
     def install
-      SharedHelpers.major_deprecation(2, "The `--force` option has been renamed to `--redownload`") if ARGV.include?("--force")
-
       %w[clean deployment frozen no-prune path shebang without with].each do |option|
         remembered_flag_deprecation(option)
       end
 
       print_remembered_flag_deprecation("--system", "path.system", "true") if ARGV.include?("--system")
 
-      remembered_negative_flag_deprecation("no-deployment")
+      remembered_flag_deprecation("deployment", negative: true)
 
       require_relative "cli/install"
       Bundler.settings.temporary(no_install: false) do
@@ -263,7 +261,7 @@ module Bundler
     method_option "local", type: :boolean, banner: "Do not attempt to fetch gems remotely and use the gem cache instead"
     method_option "quiet", type: :boolean, banner: "Only output warnings and errors."
     method_option "source", type: :array, banner: "Update a specific source (and all gems associated with it)"
-    method_option "redownload", type: :boolean, aliases: "--force", banner: "Force downloading every gem."
+    method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "ruby", type: :boolean, banner: "Update ruby specified in Gemfile.lock"
     method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
@@ -274,7 +272,6 @@ module Bundler
     method_option "conservative", type: :boolean, banner: "Use bundle install conservative update behavior and do not allow shared dependencies to be updated."
     method_option "all", type: :boolean, banner: "Update everything."
     def update(*gems)
-      SharedHelpers.major_deprecation(2, "The `--force` option has been renamed to `--redownload`") if ARGV.include?("--force")
       require_relative "cli/update"
       Bundler.settings.temporary(no_install: false) do
         Update.new(options, gems).run
@@ -290,8 +287,8 @@ module Bundler
     method_option "outdated", type: :boolean, banner: "Show verbose output including whether gems are outdated."
     def show(gem_name = nil)
       if ARGV.include?("--outdated")
-        message = "the `--outdated` flag to `bundle show` was undocumented and will be removed without replacement"
-        removed_message = "the `--outdated` flag to `bundle show` was undocumented and has been removed without replacement"
+        message = "the `--outdated` flag to `bundle show` will be removed in favor of `bundle show --verbose`"
+        removed_message = "the `--outdated` flag to `bundle show` has been removed in favor of `bundle show --verbose`"
         SharedHelpers.major_deprecation(2, message, removed_message: removed_message)
       end
       require_relative "cli/show"
@@ -331,6 +328,8 @@ module Bundler
     method_option "all", type: :boolean, banner: "Install binstubs for all gems"
     method_option "all-platforms", type: :boolean, default: false, banner: "Install binstubs for all platforms"
     def binstubs(*gems)
+      remembered_flag_deprecation("path", option_name: "bin")
+
       require_relative "cli/binstubs"
       Binstubs.new(options, gems).run
     end
@@ -413,8 +412,13 @@ module Bundler
     D
     def cache
       print_remembered_flag_deprecation("--all", "cache_all", "true") if ARGV.include?("--all")
+      print_remembered_flag_deprecation("--no-all", "cache_all", "false") if ARGV.include?("--no-all")
 
-      if ARGV.include?("--path")
+      %w[frozen no-prune].each do |option|
+        remembered_flag_deprecation(option)
+      end
+
+      if flag_passed?("--path")
         message =
           "The `--path` flag is deprecated because its semantics are unclear. " \
           "Use `bundle config cache_path` to configure the path of your cache of gems, " \
@@ -519,11 +523,11 @@ module Bundler
         Viz requires the ruby-graphviz gem (and its dependencies).
         The associated gems must also be installed via 'bundle install'.
       D
-      method_option :file, type: :string, default: "gem_graph", aliases: "-f", desc: "The name to use for the generated file. see format option"
-      method_option :format, type: :string, default: "png", aliases: "-F", desc: "This is output format option. Supported format is png, jpg, svg, dot ..."
-      method_option :requirements, type: :boolean, default: false, aliases: "-R", desc: "Set to show the version of each required dependency."
-      method_option :version, type: :boolean, default: false, aliases: "-v", desc: "Set to show each gem version."
-      method_option :without, type: :array, default: [], aliases: "-W", banner: "GROUP[ GROUP...]", desc: "Exclude gems that are part of the specified named group."
+      method_option :file, type: :string, default: "gem_graph", aliases: "-f", banner: "The name to use for the generated file. see format option"
+      method_option :format, type: :string, default: "png", aliases: "-F", banner: "This is output format option. Supported format is png, jpg, svg, dot ..."
+      method_option :requirements, type: :boolean, default: false, aliases: "-R", banner: "Set to show the version of each required dependency."
+      method_option :version, type: :boolean, default: false, aliases: "-v", banner: "Set to show each gem version."
+      method_option :without, type: :array, default: [], aliases: "-W", banner: "Exclude gems that are part of the specified named group."
       def viz
         SharedHelpers.major_deprecation 2, "The `viz` command has been renamed to `graph` and moved to a plugin. See https://github.com/rubygems/bundler-graph"
         require_relative "cli/viz"
@@ -532,19 +536,19 @@ module Bundler
     end
 
     desc "gem NAME [OPTIONS]", "Creates a skeleton for creating a rubygem"
-    method_option :exe, type: :boolean, default: false, aliases: ["--bin", "-b"], desc: "Generate a binary executable for your library."
-    method_option :coc, type: :boolean, desc: "Generate a code of conduct file. Set a default with `bundle config set --global gem.coc true`."
-    method_option :edit, type: :string, aliases: "-e", required: false, banner: "EDITOR", lazy_default: [ENV["BUNDLER_EDITOR"], ENV["VISUAL"], ENV["EDITOR"]].find {|e| !e.nil? && !e.empty? }, desc: "Open generated gemspec in the specified editor (defaults to $EDITOR or $BUNDLER_EDITOR)"
-    method_option :ext, type: :string, desc: "Generate the boilerplate for C extension code.", enum: EXTENSIONS
-    method_option :git, type: :boolean, default: true, desc: "Initialize a git repo inside your library."
-    method_option :mit, type: :boolean, desc: "Generate an MIT license file. Set a default with `bundle config set --global gem.mit true`."
-    method_option :rubocop, type: :boolean, desc: "Add rubocop to the generated Rakefile and gemspec. Set a default with `bundle config set --global gem.rubocop true`."
-    method_option :changelog, type: :boolean, desc: "Generate changelog file. Set a default with `bundle config set --global gem.changelog true`."
+    method_option :exe, type: :boolean, default: false, aliases: ["--bin", "-b"], banner: "Generate a binary executable for your library."
+    method_option :coc, type: :boolean, banner: "Generate a code of conduct file. Set a default with `bundle config set --global gem.coc true`."
+    method_option :edit, type: :string, aliases: "-e", required: false, lazy_default: [ENV["BUNDLER_EDITOR"], ENV["VISUAL"], ENV["EDITOR"]].find {|e| !e.nil? && !e.empty? }, banner: "Open generated gemspec in the specified editor (defaults to $EDITOR or $BUNDLER_EDITOR)"
+    method_option :ext, type: :string, banner: "Generate the boilerplate for C extension code.", enum: EXTENSIONS
+    method_option :git, type: :boolean, default: true, banner: "Initialize a git repo inside your library."
+    method_option :mit, type: :boolean, banner: "Generate an MIT license file. Set a default with `bundle config set --global gem.mit true`."
+    method_option :rubocop, type: :boolean, banner: "Add rubocop to the generated Rakefile and gemspec. Set a default with `bundle config set --global gem.rubocop true`."
+    method_option :changelog, type: :boolean, banner: "Generate changelog file. Set a default with `bundle config set --global gem.changelog true`."
     method_option :test, type: :string, lazy_default: Bundler.settings["gem.test"] || "", aliases: "-t", banner: "Use the specified test framework for your library", enum: %w[rspec minitest test-unit], desc: "Generate a test directory for your library, either rspec, minitest or test-unit. Set a default with `bundle config set --global gem.test (rspec|minitest|test-unit)`."
-    method_option :ci, type: :string, lazy_default: Bundler.settings["gem.ci"] || "", enum: %w[github gitlab circle], desc: "Generate CI configuration, either GitHub Actions, GitLab CI or CircleCI. Set a default with `bundle config set --global gem.ci (github|gitlab|circle)`"
-    method_option :linter, type: :string, lazy_default: Bundler.settings["gem.linter"] || "", enum: %w[rubocop standard], desc: "Add a linter and code formatter, either RuboCop or Standard. Set a default with `bundle config set --global gem.linter (rubocop|standard)`"
+    method_option :ci, type: :string, lazy_default: Bundler.settings["gem.ci"] || "", enum: %w[github gitlab circle], banner: "Generate CI configuration, either GitHub Actions, GitLab CI or CircleCI. Set a default with `bundle config set --global gem.ci (github|gitlab|circle)`"
+    method_option :linter, type: :string, lazy_default: Bundler.settings["gem.linter"] || "", enum: %w[rubocop standard], banner: "Add a linter and code formatter, either RuboCop or Standard. Set a default with `bundle config set --global gem.linter (rubocop|standard)`"
     method_option :github_username, type: :string, default: Bundler.settings["gem.github_username"], banner: "Set your username on GitHub", desc: "Fill in GitHub username on README so that you don't have to do it manually. Set a default with `bundle config set --global gem.github_username <your_username>`."
-    method_option :bundle, type: :boolean, default: Bundler.settings["gem.bundle"], desc: "Automatically run `bundle install` after creation. Set a default with `bundle config set --global gem.bundle true`"
+    method_option :bundle, type: :boolean, default: Bundler.settings["gem.bundle"], banner: "Automatically run `bundle install` after creation. Set a default with `bundle config set --global gem.bundle true`"
 
     def gem(name)
       require_relative "cli/gem"
@@ -714,7 +718,12 @@ module Bundler
       command_name = cmd.name
       return if PARSEABLE_COMMANDS.include?(command_name)
       command = ["bundle", command_name] + args
-      command << Thor::Options.to_switches(options.sort_by(&:first)).strip
+      options_to_print = options.dup
+      options_to_print.delete_if do |k, v|
+        next unless o = cmd.options[k]
+        o.default == v
+      end
+      command << Thor::Options.to_switches(options_to_print.sort_by(&:first)).strip
       command.reject!(&:empty?)
       Bundler.ui.info "Running `#{command * " "}` with bundler #{Bundler.verbose_version}"
     end
@@ -743,30 +752,17 @@ module Bundler
       nil
     end
 
-    def remembered_negative_flag_deprecation(name)
-      positive_name = name.gsub(/\Ano-/, "")
-      option = current_command.options[positive_name]
-      flag_name = "--no-" + option.switch_name.gsub(/\A--/, "")
-
-      flag_deprecation(positive_name, flag_name, option)
-    end
-
-    def remembered_flag_deprecation(name)
+    def remembered_flag_deprecation(name, negative: false, option_name: nil)
       option = current_command.options[name]
       flag_name = option.switch_name
-
-      flag_deprecation(name, flag_name, option)
-    end
-
-    def flag_deprecation(name, flag_name, option)
-      name_index = ARGV.find {|arg| flag_name == arg.split("=")[0] }
-      return unless name_index
+      flag_name = "--no-" + flag_name.gsub(/\A--/, "") if negative
+      return unless flag_passed?(flag_name)
 
       value = options[name]
       value = value.join(" ").to_s if option.type == :array
       value = "'#{value}'" unless option.type == :boolean
 
-      print_remembered_flag_deprecation(flag_name, name.tr("-", "_"), value)
+      print_remembered_flag_deprecation(flag_name, option_name || name.tr("-", "_"), value)
     end
 
     def print_remembered_flag_deprecation(flag_name, option_name, option_value)
@@ -782,5 +778,9 @@ module Bundler
         "#{option_value}`, and stop using this flag"
       Bundler::SharedHelpers.major_deprecation 2, message, removed_message: removed_message
     end
+
+    def flag_passed?(name)
+      ARGV.any? {|arg| name == arg.split("=")[0] }
+    end
   end
 end

data/lib/bundler/definition.rb

@@ -189,12 +189,14 @@ module Bundler
     def setup_domain!(options = {})
       prefer_local! if options[:"prefer-local"]
 
+      sources.cached!
+
       if options[:add_checksums] || (!options[:local] && install_needed?)
-        remotely!
+        sources.remote!
         true
       else
         Bundler.settings.set_command_option(:jobs, 1) unless install_needed? # to avoid the overhead of Bundler::Worker
-        with_cache!
+        sources.local!
         false
       end
     end
@@ -373,6 +375,44 @@ module Bundler
       write_lock(target_lockfile, preserve_unknown_sections)
     end
 
+    def write_lock(file, preserve_unknown_sections)
+      return if Definition.no_lock || file.nil?
+
+      contents = to_lock
+
+      # Convert to \r\n if the existing lock has them
+      # i.e., Windows with `git config core.autocrlf=true`
+      contents.gsub!(/\n/, "\r\n") if @lockfile_contents.match?("\r\n")
+
+      if @locked_bundler_version
+        locked_major = @locked_bundler_version.segments.first
+        current_major = bundler_version_to_lock.segments.first
+
+        updating_major = locked_major < current_major
+      end
+
+      preserve_unknown_sections ||= !updating_major && (Bundler.frozen_bundle? || !(unlocking? || @unlocking_bundler))
+
+      if File.exist?(file) && lockfiles_equal?(@lockfile_contents, contents, preserve_unknown_sections)
+        return if Bundler.frozen_bundle?
+        SharedHelpers.filesystem_access(file) { FileUtils.touch(file) }
+        return
+      end
+
+      if Bundler.frozen_bundle?
+        Bundler.ui.error "Cannot write a changed lockfile while frozen."
+        return
+      end
+
+      begin
+        SharedHelpers.filesystem_access(file) do |p|
+          File.open(p, "wb") {|f| f.puts(contents) }
+        end
+      rescue ReadOnlyFileSystemError
+        raise ProductionError, lockfile_changes_summary("file system is read-only")
+      end
+    end
+
     def locked_ruby_version
       return unless ruby_version
       if @unlocking_ruby || !@locked_ruby_version
@@ -492,8 +532,6 @@ module Bundler
       @unlocking
     end
 
-    attr_writer :source_requirements
-
     def add_checksums
       @locked_checksums = true
 
@@ -533,7 +571,7 @@ module Bundler
 
       return unless added.any? || deleted.any? || changed.any? || resolve_needed?
 
-      msg = String.new("#{change_reason.capitalize.strip}, but ")
+      msg = String.new("#{change_reason[0].upcase}#{change_reason[1..-1].strip}, but ")
       msg << "the lockfile " unless msg.start_with?("Your lockfile")
       msg << "can't be updated because #{update_refused_reason}"
       msg << "\n\nYou have added to the Gemfile:\n" << added.join("\n") if added.any?
@@ -559,6 +597,7 @@ module Bundler
         @missing_lockfile_dep ||
         @unlocking_bundler ||
         @locked_spec_with_missing_checksums ||
+        @locked_spec_with_empty_checksums ||
         @locked_spec_with_missing_deps ||
         @locked_spec_with_invalid_deps
     end
@@ -575,46 +614,8 @@ module Bundler
       lockfile && File.exist?(lockfile)
     end
 
-    def write_lock(file, preserve_unknown_sections)
-      return if Definition.no_lock || file.nil?
-
-      contents = to_lock
-
-      # Convert to \r\n if the existing lock has them
-      # i.e., Windows with `git config core.autocrlf=true`
-      contents.gsub!(/\n/, "\r\n") if @lockfile_contents.match?("\r\n")
-
-      if @locked_bundler_version
-        locked_major = @locked_bundler_version.segments.first
-        current_major = bundler_version_to_lock.segments.first
-
-        updating_major = locked_major < current_major
-      end
-
-      preserve_unknown_sections ||= !updating_major && (Bundler.frozen_bundle? || !(unlocking? || @unlocking_bundler))
-
-      if File.exist?(file) && lockfiles_equal?(@lockfile_contents, contents, preserve_unknown_sections)
-        return if Bundler.frozen_bundle?
-        SharedHelpers.filesystem_access(file) { FileUtils.touch(file) }
-        return
-      end
-
-      if Bundler.frozen_bundle?
-        Bundler.ui.error "Cannot write a changed lockfile while frozen."
-        return
-      end
-
-      begin
-        SharedHelpers.filesystem_access(file) do |p|
-          File.open(p, "wb") {|f| f.puts(contents) }
-        end
-      rescue ReadOnlyFileSystemError
-        raise ProductionError, lockfile_changes_summary("file system is read-only")
-      end
-    end
-
     def resolver
-      @resolver ||= Resolver.new(resolution_base, gem_version_promoter, @most_specific_locked_platform)
+      @resolver ||= new_resolver(resolution_base)
     end
 
     def expanded_dependencies
@@ -632,8 +633,7 @@ module Bundler
       @resolution_base ||= begin
         last_resolve = converge_locked_specs
         remove_invalid_platforms!
-        new_resolution_platforms = @current_platform_missing ? @new_platforms + [Bundler.local_platform] : @new_platforms
-        base = Resolver::Base.new(source_requirements, expanded_dependencies, last_resolve, @platforms, locked_specs: @originally_locked_specs, unlock: @unlocking_all || @gems_to_unlock, prerelease: gem_version_promoter.pre?, prefer_local: @prefer_local, new_platforms: new_resolution_platforms)
+        base = new_resolution_base(last_resolve: last_resolve, unlock: @unlocking_all || @gems_to_unlock)
         base = additional_base_requirements_to_prevent_downgrades(base)
         base = additional_base_requirements_to_force_updates(base)
         base
@@ -740,7 +740,6 @@ module Bundler
     def start_resolution
       local_platform_needed_for_resolvability = @most_specific_non_local_locked_platform && !@platforms.include?(Bundler.local_platform)
       @platforms << Bundler.local_platform if local_platform_needed_for_resolvability
-      add_platform(Gem::Platform::RUBY) if RUBY_ENGINE == "truffleruby"
 
       result = SpecSet.new(resolver.start)
 
@@ -848,6 +847,7 @@ module Bundler
         [@missing_lockfile_dep, "your lockfile is missing \"#{@missing_lockfile_dep}\""],
         [@unlocking_bundler, "an update to the version of Bundler itself was requested"],
         [@locked_spec_with_missing_checksums, "your lockfile is missing a CHECKSUMS entry for \"#{@locked_spec_with_missing_checksums}\""],
+        [@locked_spec_with_empty_checksums, "your lockfile has an empty CHECKSUMS entry for \"#{@locked_spec_with_empty_checksums}\""],
         [@locked_spec_with_missing_deps, "your lockfile includes \"#{@locked_spec_with_missing_deps}\" but not some of its dependencies"],
         [@locked_spec_with_invalid_deps, "your lockfile does not satisfy dependencies of \"#{@locked_spec_with_invalid_deps}\""],
       ].select(&:first).map(&:last).join(", ")
@@ -907,13 +907,23 @@ module Bundler
       @locked_spec_with_invalid_deps = nil
       @locked_spec_with_missing_deps = nil
       @locked_spec_with_missing_checksums = nil
+      @locked_spec_with_empty_checksums = nil
 
       missing_deps = []
       missing_checksums = []
+      empty_checksums = []
       invalid = []
 
       @locked_specs.each do |s|
-        missing_checksums << s if @locked_checksums && s.source.checksum_store.missing?(s)
+        if @locked_checksums
+          checksum_store = s.source.checksum_store
+
+          if checksum_store.missing?(s)
+            missing_checksums << s
+          elsif checksum_store.empty?(s)
+            empty_checksums << s
+          end
+        end
 
         validation = @locked_specs.validate_deps(s)
 
@@ -922,6 +932,7 @@ module Bundler
       end
 
       @locked_spec_with_missing_checksums = missing_checksums.first.name if missing_checksums.any?
+      @locked_spec_with_empty_checksums = empty_checksums.first.name if empty_checksums.any?
 
       if missing_deps.any?
         @locked_specs.delete(missing_deps)
@@ -1145,7 +1156,7 @@ module Bundler
 
     def additional_base_requirements_to_force_updates(resolution_base)
       return resolution_base if @explicit_unlocks.empty?
-      full_update = dup_for_full_unlock.resolve
+      full_update = SpecSet.new(new_resolver_for_full_update.start)
       @explicit_unlocks.each do |name|
         version = full_update.version_for(name)
         resolution_base.base_requirements[name] = Gem::Requirement.new("= #{version}") if version
@@ -1153,17 +1164,6 @@ module Bundler
       resolution_base
     end
 
-    def dup_for_full_unlock
-      unlocked_definition = self.class.new(@lockfile, @dependencies, @sources, true, @ruby_version, @optional_groups, @gemfiles)
-      unlocked_definition.source_requirements = source_requirements
-      unlocked_definition.gem_version_promoter.tap do |gvp|
-        gvp.level = gem_version_promoter.level
-        gvp.strict = gem_version_promoter.strict
-        gvp.pre = gem_version_promoter.pre
-      end
-      unlocked_definition
-    end
-
     def remove_invalid_platforms!
       return if Bundler.frozen_bundle?
 
@@ -1182,5 +1182,22 @@ module Bundler
     def source_map
       @source_map ||= SourceMap.new(sources, dependencies, @locked_specs)
     end
+
+    def new_resolver_for_full_update
+      new_resolver(unlocked_resolution_base)
+    end
+
+    def unlocked_resolution_base
+      new_resolution_base(last_resolve: SpecSet.new([]), unlock: true)
+    end
+
+    def new_resolution_base(last_resolve:, unlock:)
+      new_resolution_platforms = @current_platform_missing ? @new_platforms + [Bundler.local_platform] : @new_platforms
+      Resolver::Base.new(source_requirements, expanded_dependencies, last_resolve, @platforms, locked_specs: @originally_locked_specs, unlock: unlock, prerelease: gem_version_promoter.pre?, prefer_local: @prefer_local, new_platforms: new_resolution_platforms)
+    end
+
+    def new_resolver(base)
+      Resolver.new(base, gem_version_promoter, @most_specific_locked_platform)
+    end
   end
 end

data/lib/bundler/dsl.rb

@@ -290,7 +290,7 @@ module Bundler
             @dependencies.delete(current)
           elsif dep.gemspec_dev_dep?
             return
-          elsif current.source != dep.source
+          elsif current.source.to_s != dep.source.to_s
             raise GemfileError, "You cannot specify the same gem twice coming from different sources.\n" \
                             "You specified that #{name} (#{dep.requirement}) should come from " \
                             "#{current.source || "an unspecified source"} and #{dep.source}\n"

data/lib/bundler/feature_flag.rb

@@ -30,7 +30,7 @@ module Bundler
     settings_flag(:allow_offline_install) { bundler_4_mode? }
     settings_flag(:cache_all) { bundler_4_mode? }
     settings_flag(:forget_cli_options) { bundler_4_mode? }
-    settings_flag(:global_gem_cache) { bundler_4_mode? }
+    settings_flag(:global_gem_cache) { bundler_5_mode? }
     settings_flag(:lockfile_checksums) { bundler_4_mode? }
     settings_flag(:plugins) { @bundler_version >= Gem::Version.new("1.14") }
     settings_flag(:update_requires_all_flag) { bundler_5_mode? }

data/lib/bundler/man/bundle-add.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-ADD" "1" "July 2025" ""
+.TH "BUNDLE\-ADD" "1" "August 2025" ""
 .SH "NAME"
 \fBbundle\-add\fR \- Add gem to the Gemfile and run bundle install
 .SH "SYNOPSIS"

data/lib/bundler/man/bundle-binstubs.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-BINSTUBS" "1" "July 2025" ""
+.TH "BUNDLE\-BINSTUBS" "1" "August 2025" ""
 .SH "NAME"
 \fBbundle\-binstubs\fR \- Install the binstubs of the listed gems
 .SH "SYNOPSIS"