bundler 4.0.10 → 4.0.20

data/lib/bundler/self_manager.rb

@@ -75,7 +75,12 @@ module Bundler
 
       argv0 = File.exist?($PROGRAM_NAME) ? $PROGRAM_NAME : Process.argv0
       cmd = [argv0, *ARGV]
-      cmd.unshift(Gem.ruby) unless File.executable?(argv0)
+      unless File.executable?(argv0)
+        # Gem.ruby is quoted if it contains whitespace, so split it into argv
+        # elements to keep the quotes out of the exec'd command.
+        require "shellwords"
+        cmd.unshift(*Shellwords.split(Gem.ruby))
+      end
 
       Bundler.with_original_env do
         Kernel.exec(

data/lib/bundler/settings.rb

@@ -42,6 +42,7 @@ module Bundler
     ].freeze
 
     NUMBER_KEYS = %w[
+      cooldown
       jobs
       redirect
       retry

data/lib/bundler/shared_helpers.rb

@@ -231,6 +231,21 @@ module Bundler
       destination
     end
 
+    # Globs for entries matching +glob+ inside of +base_path+, returning
+    # absolute paths. Glob metacharacters in +base_path+ are not treated as
+    # part of the pattern, and matched entries are joined literally, so an
+    # entry starting with `~` is not expanded into the home directory.
+    #
+    # Bundler runs against whatever RubyGems the host provides, so this cannot
+    # delegate to Gem::Util.glob_files_in_dir, which only gained the literal
+    # join in RubyGems 4.1.
+    def glob_files_in_dir(glob, base_path)
+      expanded_path = nil
+      Dir.glob(glob, base: base_path).map! do |f|
+        File.join(expanded_path ||= File.expand_path(base_path), f)
+      end
+    end
+
     private
 
     def validate_bundle_path
@@ -346,7 +361,12 @@ module Bundler
 
     def set_rubyopt
       rubyopt = [ENV["RUBYOPT"]].compact
-      setup_require = "-r#{File.expand_path("setup", __dir__)}"
+      setup_path = File.expand_path("setup", __dir__)
+      # RUBYOPT is split on whitespace with no quoting mechanism, so an
+      # absolute path containing spaces would be torn apart. Fall back to
+      # requiring by feature name; set_rubylib puts our lib directory first
+      # on the child's load path.
+      setup_require = /\s/.match?(setup_path) ? "-rbundler/setup" : "-r#{setup_path}"
       return if !rubyopt.empty? && rubyopt.first.include?(setup_require)
       rubyopt.unshift setup_require
       Bundler::SharedHelpers.set_env "RUBYOPT", rubyopt.join(" ")

data/lib/bundler/source/git/git_proxy.rb

@@ -144,6 +144,12 @@ module Bundler
                 FileUtils.rm_rf(p)
               end
               git "clone", "--no-checkout", "--quiet", path.to_s, destination.to_s
+              # The copy is cloned from the local bare cache, which holds no Git LFS
+              # objects, so point origin back at the real remote and let git-lfs derive
+              # its endpoint from there when checking out. Use the credential-filtered
+              # URI to avoid persisting secrets in the copy's .git/config; auth is left
+              # to git's credential helper.
+              git "remote", "set-url", "origin", credential_filtered_uri, dir: destination
               File.chmod((File.stat(destination).mode | 0o777) & ~File.umask, destination)
             rescue Errno::EEXIST => e
               file_path = e.message[%r{.*?((?:[a-zA-Z]:)?/.*)}, 1]
@@ -187,7 +193,13 @@ module Bundler
             return out if status.success?
 
             if err.include?("couldn't find remote ref") || err.include?("not our ref")
-              raise MissingGitRevisionError.new(command_with_no_credentials, path, commit || explicit_ref, credential_filtered_uri)
+              default_branch = renamed_remote_default_branch if tracking_remote_default_branch?
+              if default_branch
+                out = follow_remote_default_branch(args, default_branch)
+                return out if out
+              end
+
+              raise MissingGitRevisionError.new(command_with_no_credentials, path, commit || explicit_ref || current_branch, credential_filtered_uri)
             else
               if shallow?
                 args -= depth_args
@@ -292,6 +304,61 @@ module Bundler
           branch_option || ref.nil?
         end
 
+        def tracking_remote_default_branch?
+          explicit_ref.nil? && commit.nil?
+        end
+
+        # Returns nil on any failure, leaving HEAD untouched so the caller reports
+        # the original fetch failure. Runs inside the retry block, so it must not
+        # touch the caller's command locals.
+        def follow_remote_default_branch(args, default_branch)
+          reference = "refs/heads/#{default_branch}"
+          command = fetch_command(args, "#{reference}:#{reference}")
+          check_allowed(command)
+
+          out, err, status = capture(command, path)
+          unless status.success?
+            Bundler.ui.debug "Could not fetch #{reference} from #{credential_filtered_uri}: #{err}"
+            return
+          end
+
+          previous_branch = current_branch
+          begin
+            git "symbolic-ref", "HEAD", reference, dir: path
+          rescue GitError => e
+            Bundler.ui.debug "Could not repoint the cached clone at #{reference}: #{e.message}"
+            return
+          end
+          @current_branch = nil
+          Bundler.ui.warn "#{credential_filtered_uri} no longer has #{previous_branch}, " \
+            "now following its default branch #{default_branch}"
+          out
+        end
+
+        # The cached clone's HEAD branch is gone from the remote, so the remote's
+        # own idea of its default branch is the only thing left to follow.
+        def renamed_remote_default_branch
+          default_branch = remote_default_branch
+          return if default_branch.nil? || default_branch == current_branch
+
+          default_branch
+        end
+
+        def remote_default_branch
+          command = ["ls-remote", "--symref", "--", configured_uri, "HEAD"]
+          check_allowed(command)
+
+          out, err, status = capture(command, path)
+          unless status.success?
+            Bundler.ui.debug "Could not ask #{credential_filtered_uri} for its default branch: #{err}"
+            return
+          end
+
+          # A remote is free to advertise a ref name that is not valid UTF-8, and
+          # matching that as text raises out of the GitError family.
+          out.b[%r{^ref:\s+refs/heads/(.+?)\s+HEAD}, 1]
+        end
+
         def pinned_to_full_sha?
           full_sha_revision?(ref)
         end
@@ -358,9 +425,10 @@ module Bundler
           git("rev-parse", "--verify", reference, dir: path).strip
         end
 
-        # Adds credentials to the URI
+        # Adds credentials to the URI. This is the URI given to git, so it's
+        # also the one command output must be filtered against.
         def configured_uri
-          if /https?:/.match?(uri)
+          @configured_uri ||= if /https?:/.match?(uri)
             remote = Gem::URI(uri)
             config_auth = Bundler.settings[remote.to_s] || Bundler.settings[remote.host]
             remote.userinfo ||= config_auth
@@ -403,7 +471,7 @@ module Bundler
           raise GitNotInstalledError.new unless Bundler.git_present?
 
           require "shellwords"
-          URICredentialsFilter.credential_filtered_string("git #{command.shelljoin}", uri)
+          URICredentialsFilter.credential_filtered_string("git #{command.shelljoin}", configured_uri)
         end
 
         def run_command(*command, dir: nil)
@@ -423,18 +491,23 @@ module Bundler
             require "open3"
             out, err, status = Open3.capture3(*capture3_args_for(cmd, dir))
 
-            filtered_out = URICredentialsFilter.credential_filtered_string(out, uri)
+            filtered_out = URICredentialsFilter.credential_filtered_string(out, configured_uri)
             return [filtered_out, status] if ignore_err
 
-            filtered_err = URICredentialsFilter.credential_filtered_string(err, uri)
+            filtered_err = URICredentialsFilter.credential_filtered_string(err, configured_uri)
             [filtered_out, filtered_err, status]
           end
         end
 
         def capture3_args_for(cmd, dir)
-          return ["git", *cmd] unless dir
+          # Disable automatic maintenance so a background commit-graph write in
+          # the source repo can't race the hardlinking local clone and fail with
+          # "hardlink different from source".
+          opts = ["-c", "gc.auto=0", "-c", "maintenance.auto=false"]
+
+          return ["git", *opts, *cmd] unless dir
 
-          ["git", "-C", dir.to_s, *cmd]
+          ["git", "-C", dir.to_s, *opts, *cmd]
         end
 
         def extra_clone_args
@@ -453,8 +526,8 @@ module Bundler
           args
         end
 
-        def fetch_command(args)
-          ["fetch", "--force", "--quiet", "--no-tags", *args, "--", configured_uri, refspec].compact
+        def fetch_command(args, spec = refspec)
+          ["fetch", "--force", "--quiet", "--no-tags", *args, "--", configured_uri, spec].compact
         end
 
         def clone_command(args)

data/lib/bundler/source/git.rb

@@ -91,9 +91,9 @@ module Bundler
 
       def to_s
         begin
-          at = humanized_ref || current_branch
-
-          rev = "at #{at}@#{shortref_for_display(revision)}"
+          at = humanized_ref
+          at = "#{at}@" if at
+          rev = "at #{at}#{shortref_for_display(revision)}"
         rescue GitError
           ""
         end
@@ -320,7 +320,7 @@ module Bundler
 
       def serialize_gemspecs_in(destination)
         destination = destination.expand_path(Bundler.root) if destination.relative?
-        Dir["#{destination}/#{@glob}"].each do |spec_path|
+        SharedHelpers.glob_files_in_dir(@glob, destination.to_s).each do |spec_path|
           # Evaluate gemspecs and cache the result. Gemspecs
           # in git might require git or other dependencies.
           # The gemspecs we cache should already be evaluated.

data/lib/bundler/source/metadata.rb

@@ -58,6 +58,10 @@ module Bundler
       def version_message(spec)
         "#{spec.name} #{spec.version}"
       end
+
+      def checksum_store
+        @checksum_store ||= Checksum::Store.new
+      end
     end
   end
 end

data/lib/bundler/source/path.rb

@@ -161,7 +161,7 @@ module Bundler
 
         if File.directory?(expanded_path)
           # We sort depth-first since `<<` will override the earlier-found specs
-          Gem::Util.glob_files_in_dir(@glob, expanded_path).sort_by {|p| -p.split(File::SEPARATOR).size }.each do |file|
+          SharedHelpers.glob_files_in_dir(@glob, expanded_path).sort_by {|p| -p.split(File::SEPARATOR).size }.each do |file|
             next unless spec = load_gemspec(file)
             spec.source = self
 
@@ -220,10 +220,11 @@ module Bundler
         # Some gem authors put absolute paths in their gemspec
         # and we have to save them from themselves
         spec.files = spec.files.filter_map do |path|
-          next path unless /\A#{Pathname::SEPARATOR_PAT}/o.match?(path)
+          pathname = Pathname.new(path)
+          next path unless pathname.absolute?
           next if File.directory?(path)
           begin
-            Pathname.new(path).relative_path_from(gem_dir).to_s
+            pathname.relative_path_from(gem_dir).to_s
           rescue ArgumentError
             path
           end

data/lib/bundler/source/rubygems/remote.rb

@@ -4,9 +4,9 @@ module Bundler
   class Source
     class Rubygems
       class Remote
-        attr_reader :uri, :anonymized_uri, :original_uri
+        attr_reader :uri, :anonymized_uri, :original_uri, :cooldown
 
-        def initialize(uri)
+        def initialize(uri, cooldown: nil)
           orig_uri = uri
           uri = Bundler.settings.mirror_for(uri)
           @original_uri = orig_uri if orig_uri != uri
@@ -14,6 +14,16 @@ module Bundler
 
           @uri = apply_auth(uri, fallback_auth).freeze
           @anonymized_uri = remove_auth(@uri).freeze
+          @cooldown = cooldown
+        end
+
+        # Returns the cooldown days that apply to this remote, resolving the
+        # precedence CLI > config > Gemfile per-source. Returns nil if no
+        # cooldown applies.
+        def effective_cooldown
+          override = Bundler.settings[:cooldown]
+          return override if override
+          @cooldown
         end
 
         MAX_CACHE_SLUG_HOST_SIZE = 255 - 1 - 32 # 255 minus dot minus MD5 length

data/lib/bundler/source/rubygems.rb

@@ -11,11 +11,12 @@ module Bundler
       API_REQUEST_SIZE = 100
       REQUIRE_MUTEX = Mutex.new
 
-      attr_accessor :remotes
+      attr_accessor :remotes, :remote_cooldowns
 
       def initialize(options = {})
         @options = options
         @remotes = []
+        @remote_cooldowns = {}
         @dependency_names = []
         @allow_remote = false
         @allow_cached = false
@@ -24,8 +25,10 @@ module Bundler
         @checksum_store = Checksum::Store.new
         @gem_installers = {}
         @gem_installers_mutex = Mutex.new
+        @remote_specs_mutex = Mutex.new
 
-        Array(options["remotes"]).reverse_each {|r| add_remote(r) }
+        cooldown = options["cooldown"]
+        Array(options["remotes"]).reverse_each {|r| add_remote(r, cooldown: cooldown) }
 
         @lockfile_remotes = @remotes if options["from_lockfile"]
       end
@@ -148,6 +151,13 @@ module Bundler
           # sources, and large_idx.merge! small_idx is way faster than
           # small_idx.merge! large_idx.
           index = @allow_remote ? remote_specs.dup : Index.new
+
+          # Snapshot per-version `created_at` from the remote info before installed
+          # / cached specs overwrite the EndpointSpecification objects that carry
+          # it. The cooldown filter consults `created_at` on every candidate, so
+          # local stubs need the published date back-filled to participate.
+          remote_created_at = collect_remote_created_at(index)
+
           index.merge!(cached_specs) if @allow_cached
           index.merge!(installed_specs) if @allow_local
 
@@ -161,6 +171,8 @@ module Bundler
             end
           end
 
+          backfill_created_at(index, remote_created_at) unless remote_created_at.empty?
+
           index
         end
       end
@@ -232,7 +244,7 @@ module Bundler
       def cached_built_in_gem(spec, local: false)
         cached_path = cached_gem(spec)
         if cached_path.nil? && !local
-          remote_spec = remote_specs.search(spec).first
+          remote_spec = remote_spec_for(spec)
           if remote_spec
             cached_path = fetch_gem(remote_spec)
             spec.remote = remote_spec.remote
@@ -243,9 +255,14 @@ module Bundler
         cached_path
       end
 
-      def add_remote(source)
+      def add_remote(source, cooldown: nil)
         uri = normalize_uri(source)
         @remotes.unshift(uri) unless @remotes.include?(uri)
+        @remote_cooldowns[uri] = cooldown if cooldown
+      end
+
+      def cooldown_for(uri)
+        @remote_cooldowns[uri]
       end
 
       def spec_names
@@ -266,7 +283,7 @@ module Bundler
 
       def remote_fetchers
         @remote_fetchers ||= remotes.to_h do |uri|
-          remote = Source::Rubygems::Remote.new(uri)
+          remote = Source::Rubygems::Remote.new(uri, cooldown: cooldown_for(uri))
           [remote, Bundler::Fetcher.new(remote)]
         end.freeze
       end
@@ -314,6 +331,19 @@ module Bundler
         @allow_remote && api_fetchers.any?
       end
 
+      def clear_cache
+        @specs = nil
+        @installed_specs = nil
+        @default_specs = nil
+        @cached_specs = nil
+      end
+
+      def release_resolution_memory!
+        @specs = nil
+        @remote_specs_mutex.synchronize { @remote_specs = nil }
+        @fetchers&.each(&:release_resolution_memory!)
+      end
+
       protected
 
       def remote_names
@@ -376,7 +406,7 @@ module Bundler
         @cached_specs ||= begin
           idx = Index.new
 
-          Dir["#{cache_path}/*.gem"].each do |gemfile|
+          SharedHelpers.glob_files_in_dir("*.gem", cache_path.to_s).each do |gemfile|
             s ||= Bundler.rubygems.spec_from_gem(gemfile)
             s.source = self
             idx << s
@@ -391,17 +421,30 @@ module Bundler
       end
 
       def remote_specs
-        @remote_specs ||= Index.build do |idx|
-          index_fetchers = fetchers - api_fetchers
+        @remote_specs ||= @remote_specs_mutex.synchronize do
+          @remote_specs ||= Index.build do |idx|
+            index_fetchers = fetchers - api_fetchers
 
-          if index_fetchers.empty?
-            fetch_names(api_fetchers, dependency_names, idx)
-          else
-            fetch_names(fetchers, nil, idx)
+            if index_fetchers.empty?
+              fetch_names(api_fetchers, dependency_names, idx)
+            else
+              fetch_names(fetchers, nil, idx)
+            end
           end
         end
       end
 
+      # Looks up a single spec in the remote sources, fetching only its own
+      # name when the full remote index is not already materialized.
+      def remote_spec_for(spec)
+        return remote_specs.search(spec).first if @remote_specs || api_fetchers.empty?
+
+        index = Index.build do |idx|
+          fetch_names(api_fetchers, [spec.name], idx)
+        end
+        index.search(spec).first
+      end
+
       def fetch_names(fetchers, dependency_names, index)
         fetchers.each do |f|
           if dependency_names
@@ -456,6 +499,31 @@ module Bundler
 
       private
 
+      def collect_remote_created_at(index)
+        return {} unless @allow_remote
+
+        snapshot = {}
+        index.each do |spec|
+          next unless spec.respond_to?(:created_at) && spec.created_at
+          # Remember the remote that supplied the date too: when a source has
+          # several remotes with different per-URI cooldown settings we must
+          # restore the same one during backfill so `effective_cooldown` agrees.
+          snapshot[[spec.name, spec.version]] = [spec.created_at, spec.remote]
+        end
+        snapshot
+      end
+
+      def backfill_created_at(index, snapshot)
+        index.each do |spec|
+          next unless spec.respond_to?(:created_at=)
+          next if spec.created_at
+          remote_created_at, remote = snapshot[[spec.name, spec.version]]
+          next unless remote_created_at
+          spec.created_at = remote_created_at
+          spec.remote ||= remote if remote && spec.respond_to?(:remote=)
+        end
+      end
+
       def lockfile_remotes
         @lockfile_remotes || credless_remotes
       end
@@ -508,7 +576,7 @@ module Bundler
 
       # We are using a mutex to reaed and write from/to the hash.
       # The reason this double synchronization was added is for performance
-      # and lock the mutex for the shortest possible amount of time. Otherwise,
+      # and to lock the mutex for the shortest possible amount of time. Otherwise,
       # all threads are fighting over this mutex and when it gets acquired it gets locked
       # until a threads finishes downloading a gem, leaving the other threads waiting
       # doing nothing.

data/lib/bundler/source_list.rb

@@ -50,7 +50,13 @@ module Bundler
 
     def add_rubygems_source(options = {})
       new_source = Source::Rubygems.new(options)
-      return @global_rubygems_source if @global_rubygems_source == new_source
+      if @global_rubygems_source == new_source
+        warn_on_cooldown_conflict(new_source, @global_rubygems_source)
+        return @global_rubygems_source
+      end
+
+      existing_source = @rubygems_sources.find {|s| s == new_source }
+      warn_on_cooldown_conflict(new_source, existing_source) if existing_source
 
       add_source_to_list new_source, @rubygems_sources
     end
@@ -59,8 +65,15 @@ module Bundler
       add_source_to_list Plugin.source(source).new(options), @plugin_sources
     end
 
-    def add_global_rubygems_remote(uri)
-      global_rubygems_source.add_remote(uri)
+    def add_global_rubygems_remote(uri, cooldown: nil)
+      unless cooldown.nil?
+        new_source = source_class.new("remotes" => uri, "cooldown" => cooldown)
+        [global_rubygems_source, *@rubygems_sources].find do |existing_source|
+          warn_on_cooldown_conflict(new_source, existing_source)
+        end
+      end
+
+      global_rubygems_source.add_remote(uri, cooldown: cooldown)
       global_rubygems_source
     end
 
@@ -136,6 +149,14 @@ module Bundler
       all_sources.each(&:remote!)
     end
 
+    def clear_cache
+      rubygems_sources.each(&:clear_cache)
+    end
+
+    def release_resolution_memory!
+      rubygems_sources.each(&:release_resolution_memory!)
+    end
+
     private
 
     def map_sources(replacement_sources)
@@ -165,6 +186,10 @@ module Bundler
         # locked sources never include credentials so always prefer remotes from the gemfile
         replacement_source.remotes = gemfile_source.remotes
 
+        # cooldowns are only ever declared in the Gemfile, so carry them over
+        # along with the remotes they apply to
+        replacement_source.remote_cooldowns = gemfile_source.remote_cooldowns
+
         yield replacement_source if block_given?
 
         replacement_source
@@ -210,6 +235,22 @@ module Bundler
       end
     end
 
+    def warn_on_cooldown_conflict(new_source, existing_source)
+      new_source.remote_cooldowns.any? do |uri, cooldown|
+        next false unless existing_source.remotes.include?(uri)
+
+        existing_cooldown = existing_source.cooldown_for(uri)
+        next false if existing_cooldown == cooldown
+
+        previous = existing_cooldown ? "`cooldown: #{existing_cooldown}`" : "no cooldown"
+        Bundler.ui.warn "The source #{uri} is declared more than once with different cooldown " \
+          "values (`cooldown: #{cooldown}` here, #{previous} previously). All declarations of " \
+          "the same source URL share a single cooldown, so only one of these values will apply " \
+          "to all gems from this source."
+        true
+      end
+    end
+
     def warn_on_git_protocol(source)
       return if Bundler.settings["git.allow_insecure"]
 

data/lib/bundler/spec_set.rb

@@ -5,7 +5,7 @@ require_relative "vendored_tsort"
 module Bundler
   class SpecSet
     include Enumerable
-    include TSort
+    include Gem::TSort
 
     def initialize(specs)
       @specs = specs
@@ -315,7 +315,7 @@ module Bundler
 
     def sorted
       @sorted ||= ([@specs.find {|s| s.name == "rake" }] + tsort).compact.uniq
-    rescue TSort::Cyclic => error
+    rescue Gem::TSort::Cyclic => error
       cgems = extract_circular_gems(error)
       raise CyclicDependencyError, "Your bundle requires gems that depend" \
         " on each other, creating an infinite loop. Please remove either" \

data/lib/bundler/stub_specification.rb

@@ -126,7 +126,9 @@ module Bundler
     def _remote_specification
       @_remote_specification ||= begin
         rs = stub.to_spec
-        if rs.equal?(self) # happens when to_spec gets the spec from Gem.loaded_specs
+        # Gem::StubSpecification#to_spec may return an activated specification
+        # with the same name and version from a different gem installation.
+        if rs.equal?(self) || rs.loaded_from != loaded_from
           rs = Gem::Specification.load(loaded_from)
           Bundler.rubygems.stub_set_spec(stub, rs)
         end

data/lib/bundler/templates/newgem/newgem.gemspec.tt

@@ -22,6 +22,12 @@ Gem::Specification.new do |spec|
   spec.metadata["changelog_uri"] = "<%= config[:changelog_uri] %>"
 <%- end -%>
 
+  # Uncomment the line below to require MFA for gem pushes.
+  # This helps protect your gem from supply chain attacks by ensuring
+  # no one can publish a new version without multi-factor authentication.
+  # See: https://guides.rubygems.org/mfa-requirement-opt-in/
+  # spec.metadata["rubygems_mfa_required"] = "true"
+
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
   gemspec = File.basename(__FILE__)
@@ -41,12 +47,12 @@ Gem::Specification.new do |spec|
   # Uncomment to register a new dependency of your gem
   # spec.add_dependency "example-gem", "~> 1.0"
 <%- if config[:ext] == 'rust' -%>
-  spec.add_dependency "rb_sys", "~> 0.9.91"
+  spec.add_dependency "rb_sys", "~> 0.9.128"
 <%- end -%>
 <%- if config[:ext] == 'go' -%>
   spec.add_dependency "go_gem", "~> 0.2"
 <%- end -%>
 
   # For more information and examples about making a new gem, check out our
-  # guide at: https://bundler.io/guides/creating_gem.html
+  # guide at: https://guides.rubygems.org/make-your-own-gem/
 end

data/lib/bundler/vendored_tsort.rb

@@ -1,4 +1,21 @@
 # frozen_string_literal: true
 
-module Bundler; end
-require_relative "vendor/tsort/lib/tsort"
+# The defined? guard avoids reopening Gem::TSort when an old RubyGems has
+# already loaded its own copy, e.g. through rubygems/request_set from
+# Gem.activate_bin_path in binstubs.
+#
+unless defined?(Gem::TSort)
+  begin
+    require "rubygems/vendored_tsort"
+  rescue LoadError
+    begin
+      # RubyGems 3.4 and 3.5 ship the same file under its pre-3.6 name.
+      # Requiring the real tsort here instead would activate the tsort
+      # default gem, and `bundler/setup` must not activate any gems.
+      require "rubygems/tsort"
+    rescue LoadError
+      require "tsort"
+      Gem::TSort = TSort
+    end
+  end
+end

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.10".freeze
+  VERSION = "4.0.20".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first