bundler 4.0.14 → 4.0.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c7cfeed01a046a9b186ddcdb1039e59c4605673529e12fb08b3fb32f424650f
-  data.tar.gz: 375e9b2540c5493fb90cb4e2004372c4fdbac9ed67d09a680bc23fdb71e04c58
+  metadata.gz: d4ec7b35f89e61eb8c603099869df9c107accc057741b52f03b849d31ae0e734
+  data.tar.gz: 13f346287c2ee66bb2baa3ddfaff121fce05c0f428ae73aa199b148559a80525
 SHA512:
-  metadata.gz: 55a5604bfb508d0c3b509702ce84a42bd4811f3f42222176133942fed42ff0f224ed64fcf68873e163cfe63d8cc183f11b67f4ec915814d3e121bb70f575296d
-  data.tar.gz: 4178ca638dd4f4ede2977526c4edba39cb6ae21f9d7d0ba6cab55d47235556d9ea41bfc4353b2349a1085746af76825c84e5597deba5130d874150f8ae1f91ef
+  metadata.gz: 6e70a1fb438a201e9864383eba6a47727102581979a7e15902d219cca5939e623e933b728a812308b0cf7e2210237bfcee2be2d99e36eabb24296360be296607
+  data.tar.gz: 105f3457b4a7f4e69a252ee7857fcbeb7c4c91406c1ad76a693f09e2a3cf2a741bf407a91053fbe57d29afe8c88ded24553b6de33deb76ce11c9abff20d117ec

data/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 4.0.16 / 2026-07-10
+
+### Enhancements:
+
+* Bundler: Fix Bundler::Fetcher for PQC support, adding integration connection tests. Pull request [#9637](https://github.com/ruby/rubygems/pull/9637) by junaruga
+* Reuse RubyGems' vendored tsort in Bundler. Pull request [#9647](https://github.com/ruby/rubygems/pull/9647) by hsbt
+
+### Bug fixes:
+
+* Initialize the new gem's git repo without a subshell. Pull request [#9670](https://github.com/ruby/rubygems/pull/9670) by hsbt
+* Preserve CRLF lockfile line endings on Windows. Pull request [#9669](https://github.com/ruby/rubygems/pull/9669) by hsbt
+* Fix the gemspec error snippet on Windows drive-letter paths. Pull request [#9668](https://github.com/ruby/rubygems/pull/9668) by hsbt
+
+### Documentation:
+
+* Point Bundler gemspec metadata at the moved docs. Pull request [#9648](https://github.com/ruby/rubygems/pull/9648) by hsbt
+
+## 4.0.15 / 2026-06-24
+
+### Enhancements:
+
+* Resolve Git LFS files in git sources from the real remote. Pull request [#9632](https://github.com/ruby/rubygems/pull/9632) by hsbt
+* Suggest access issues, not only yanking, for missing locked gems. Pull request [#9631](https://github.com/ruby/rubygems/pull/9631) by hsbt
+* Implement a make jobserver (continuation of #9210). Pull request [#9625](https://github.com/ruby/rubygems/pull/9625) by hsbt
+* Reduce peak memory usage of full index loading and bundle install. Pull request [#9618](https://github.com/ruby/rubygems/pull/9618) by hsbt
+* Bump up to rb-sys 0.9.128. Pull request [#9569](https://github.com/ruby/rubygems/pull/9569) by hsbt
+
+### Bug fixes:
+
+* Skip the make jobserver on Windows. Pull request [#9630](https://github.com/ruby/rubygems/pull/9630) by hsbt
+* Don't require source plugins to be installed to parse a lockfile: 4.0.x. Pull request [#9621](https://github.com/ruby/rubygems/pull/9621) by hsbt
+* Exempt lockfile versions from cooldown on every resolution path. Pull request [#9619](https://github.com/ruby/rubygems/pull/9619) by hsbt
+* Set `Bundler.settings[:ssl_ca_cert]` to download gems. Pull request [#9610](https://github.com/ruby/rubygems/pull/9610) by junaruga
+
 ## 4.0.14 / 2026-06-10
 
 ### Bug fixes:

data/bundler.gemspec

@@ -24,9 +24,9 @@ Gem::Specification.new do |s|
 
   s.metadata = {
     "bug_tracker_uri" => "https://github.com/ruby/rubygems/issues?q=is%3Aopen+is%3Aissue+label%3ABundler",
-    "changelog_uri" => "https://github.com/ruby/rubygems/blob/master/bundler/CHANGELOG.md",
+    "changelog_uri" => "https://github.com/ruby/rubygems/blob/master/CHANGELOG-bundler.md",
     "homepage_uri" => "https://bundler.io/",
-    "source_code_uri" => "https://github.com/ruby/rubygems/tree/master/bundler",
+    "source_code_uri" => "https://github.com/ruby/rubygems",
   }
 
   s.required_ruby_version     = ">= 3.2.0"

data/lib/bundler/build_metadata.rb

@@ -5,7 +5,7 @@ module Bundler
   module BuildMetadata
     # begin ivars
     @built_at = nil
-    @git_commit_sha = "265babb801".freeze
+    @git_commit_sha = "fc18079dba".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/gem.rb

@@ -256,8 +256,7 @@ module Bundler
 
       if use_git
         Bundler.ui.info "\nInitializing git repo in #{target}"
-        require "shellwords"
-        `git init #{target.to_s.shellescape}`
+        IO.popen(["git", "init", target.to_s], &:read)
 
         config[:git_default_branch] = File.read("#{target}/.git/HEAD").split("/").last.chomp
       end

data/lib/bundler/definition.rb

@@ -230,6 +230,16 @@ module Bundler
       sources.prefer_local!
     end
 
+    # Releases memory only needed during resolution, such as remote spec
+    # indexes and resolver state. Only safe to call once resolution is
+    # complete and the result has been materialized, since any further
+    # resolution will need to refetch remote specs.
+    def release_resolution_memory!
+      @resolver = nil
+      @resolution_base = nil
+      sources.release_resolution_memory!
+    end
+
     # For given dependency list returns a SpecSet with Gemspec of all the required
     # dependencies.
     #  1. The method first resolves the dependencies specified in Gemfile
@@ -387,10 +397,6 @@ module Bundler
 
       contents = to_lock
 
-      # Convert to \r\n if the existing lock has them
-      # i.e., Windows with `git config core.autocrlf=true`
-      contents.gsub!(/\n/, "\r\n") if @lockfile_contents.match?("\r\n")
-
       if @locked_bundler_version
         locked_major = @locked_bundler_version.segments.first
         current_major = bundler_version_to_lock.segments.first
@@ -411,6 +417,14 @@ module Bundler
         return
       end
 
+      # Convert to \r\n if the existing lock has them, i.e., Windows with
+      # `git config core.autocrlf=true`. Detect from the bytes on disk because
+      # reading in text mode strips carriage returns on Windows, which would
+      # otherwise defeat this check and rewrite a `\r\n` lockfile with `\n`.
+      if File.exist?(file) && SharedHelpers.filesystem_access(file, :read) {|p| File.binread(p).include?("\r\n") }
+        contents.gsub!(/\n/, "\r\n")
+      end
+
       begin
         SharedHelpers.filesystem_access(file) do |p|
           File.open(p, "wb") {|f| f.puts(contents) }
@@ -688,9 +702,10 @@ module Bundler
             "available locally before rerunning Bundler."
           else
             "Your bundle is locked to #{locked_gem} from #{locked_gem.source}, but that version can " \
-            "no longer be found in that source. That means the author of #{locked_gem} has removed it. " \
-            "You'll need to update your bundle to a version other than #{locked_gem} that hasn't been " \
-            "removed in order to install."
+            "no longer be found in that source. That means either the author of #{locked_gem} has removed it, " \
+            "or you no longer have access to that source. You'll need to update your bundle to a version other " \
+            "than #{locked_gem} that hasn't been removed, or check your credentials and access rights for " \
+            "#{locked_gem.source}, in order to install."
           end
 
           raise GemNotFound, message
@@ -1283,7 +1298,7 @@ module Bundler
 
     def new_resolution_base(last_resolve:, unlock:)
       new_resolution_platforms = @current_platform_missing ? @new_platforms + [Bundler.local_platform] : @new_platforms
-      Resolver::Base.new(source_requirements, expanded_dependencies, last_resolve, @platforms, locked_specs: @originally_locked_specs, unlock: unlock, prerelease: gem_version_promoter.pre?, prefer_local: @prefer_local, new_platforms: new_resolution_platforms)
+      Resolver::Base.new(source_requirements, expanded_dependencies, last_resolve, @platforms, locked_specs: @originally_locked_specs, unlock: unlock, prerelease: gem_version_promoter.pre?, prefer_local: @prefer_local, new_platforms: new_resolution_platforms, explicit_unlocks: @explicit_unlocks)
     end
 
     def new_resolver(base)

data/lib/bundler/dsl.rb

@@ -602,8 +602,11 @@ module Bundler
 
           trace_line = backtrace.find {|l| l.include?(dsl_path) } || trace_line
           return m unless trace_line
-          line_number = trace_line.split(":")[1].to_i - 1
+          # Match the line number right before `:in` or the end of the line so a
+          # Windows drive letter like `C:` does not get mistaken for the number.
+          line_number = trace_line[/:(\d+)(?::in\b|\z)/, 1]
           return m unless line_number
+          line_number = line_number.to_i - 1
 
           lines      = contents.lines.to_a
           indent     = " #  "

data/lib/bundler/fetcher/base.rb

@@ -38,6 +38,9 @@ module Bundler
         false
       end
 
+      def release_resolution_memory!
+      end
+
       private
 
       def log_specs(&block)

data/lib/bundler/fetcher/compact_index.rb

@@ -63,6 +63,13 @@ module Bundler
         true
       end
 
+      # The client holds the parsed checksums of all info files in the
+      # index. Dropping it is always safe because it is rebuilt from the
+      # local cache on demand.
+      def release_resolution_memory!
+        @compact_index_client = nil
+      end
+
       private
 
       def compact_index_client
@@ -73,6 +80,12 @@ module Bundler
       end
 
       def fetch_gem_infos(names)
+        # Create the client and update the versions file on this thread.
+        # Otherwise the workers race to lazily create the client and update
+        # the versions file concurrently, e.g. when the client was released
+        # after resolution and is being rebuilt for `bundle cache`.
+        compact_index_client.available?
+
         in_parallel(names) {|name| compact_index_client.info(name) }
       rescue TooManyRequestsError # rubygems.org is rate limiting us, slow down.
         @bundle_worker&.stop

data/lib/bundler/fetcher/gem_remote_fetcher.rb

@@ -9,6 +9,8 @@ module Bundler
         super
 
         @pool_size = Bundler.settings.installation_parallelization
+        ssl_ca_cert = Bundler.settings[:ssl_ca_cert]
+        @cert_files << ssl_ca_cert if ssl_ca_cert
       end
 
       def request(*args)

data/lib/bundler/fetcher.rb

@@ -243,6 +243,10 @@ module Bundler
       fetchers.first.api_fetcher?
     end
 
+    def release_resolution_memory!
+      @fetchers&.each(&:release_resolution_memory!)
+    end
+
     def gem_remote_fetcher
       @gem_remote_fetcher ||= begin
         require_relative "fetcher/gem_remote_fetcher"
@@ -314,7 +318,7 @@ module Bundler
         if ssl_client_cert
           pem = File.read(ssl_client_cert)
           con.cert = OpenSSL::X509::Certificate.new(pem)
-          con.key  = OpenSSL::PKey::RSA.new(pem)
+          con.key  = OpenSSL::PKey.read(pem)
         end
 
         con.read_timeout = Fetcher.api_timeout

data/lib/bundler/installer/parallel_installer.rb

@@ -110,10 +110,55 @@ module Bundler
     end
 
     def install_with_worker
-      installed_specs = {}
-      enqueue_specs(installed_specs)
+      with_jobserver do
+        installed_specs = {}
+        enqueue_specs(installed_specs)
 
-      process_specs(installed_specs) until finished_installing?
+        process_specs(installed_specs) until finished_installing?
+      end
+    end
+
+    def with_jobserver
+      # The jobserver hands tokens to child `make` processes through MAKEFLAGS
+      # using the GNU make `--jobserver-auth` protocol. nmake, the default make
+      # on mswin, instead reads MAKEFLAGS as bare option letters and aborts
+      # every native extension build with `fatal error U1065: invalid option
+      # '-'`. Skip the jobserver when nmake is in use. Other Windows toolchains
+      # such as mingw use GNU make and keep working through the inherited pipe.
+      return yield if nmake? || bsd_make?
+
+      begin
+        r, w = IO.pipe
+        r.close_on_exec = false
+        w.close_on_exec = false
+        w.write("*" * @size)
+
+        old_makeflags = ENV["MAKEFLAGS"]
+        ENV["MAKEFLAGS"] = [old_makeflags, "--jobserver-auth=#{r.fileno},#{w.fileno}"].compact.join(" ")
+
+        yield
+      ensure
+        # Restore MAKEFLAGS before closing the pipe so a close failure can't
+        # leave the process with descriptors that point at a closed pipe.
+        old_makeflags ? ENV["MAKEFLAGS"] = old_makeflags : ENV.delete("MAKEFLAGS")
+
+        r&.close
+        w&.close
+      end
+    end
+
+    # Mirror how RubyGems' extension builder picks the make program so the
+    # jobserver is only set up when a GNU-compatible make will consume it.
+    def nmake?
+      make = ENV["MAKE"] || ENV["make"]
+      make ||= "nmake" if RUBY_PLATFORM.include?("mswin")
+      /\bnmake/i.match?(make.to_s)
+    end
+
+    def bsd_make?
+      return false unless Gem.freebsd_platform?
+      make = ENV["MAKE"] || ENV["make"] || "make"
+      !/\bgmake/i.match?(make)
     end
 
     def install_serially

data/lib/bundler/installer.rb

@@ -195,7 +195,13 @@ module Bundler
       force = options[:force]
       local = options[:local] || options[:"prefer-local"]
       jobs = Bundler.settings.installation_parallelization
-      spec_installations = ParallelInstaller.call(self, @definition.specs, jobs, standalone, force, local: local)
+      specs = @definition.specs
+      # Installing default gems may need the remote index again to cache
+      # their .gem files, so keep resolution memory around in that case.
+      # The bundler spec itself is excluded because it comes from the
+      # metadata source and never goes through that path.
+      @definition.release_resolution_memory! if specs.none? {|s| s.default_gem? && s.source.is_a?(Source::Rubygems) }
+      spec_installations = ParallelInstaller.call(self, specs, jobs, standalone, force, local: local)
       spec_installations.each do |installation|
         post_install_messages[installation.name] = installation.post_install_message if installation.has_post_install_message?
       end

data/lib/bundler/mirror.rb

@@ -160,18 +160,18 @@ module Bundler
 
       def wait_for_writtable_socket(socket, address, timeout)
         if IO.select(nil, [socket], nil, timeout)
-          probe_writtable_socket(socket, address)
+          probe_writtable_socket(socket)
         else # TCP Handshake timed out, or there is something dropping packets
           false
         end
       end
 
-      def probe_writtable_socket(socket, address)
-        socket.connect_nonblock(address)
-      rescue Errno::EISCONN
-        true
-      rescue StandardError # Connection failed
-        false
+      def probe_writtable_socket(socket)
+        # Check the pending error on the socket rather than calling
+        # +connect_nonblock+ a second time. On BSD-based systems such as macOS a
+        # second connect returns +EISCONN+ even when the asynchronous connect
+        # failed, which would make a down mirror look reachable.
+        socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_ERROR).int == 0
       end
     end
   end

data/lib/bundler/plugin/unloaded_source.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Bundler
+  module Plugin
+    # Stands in for a source handled by a plugin that is not loaded yet, so
+    # that the lockfile can still be parsed during the plugin install pass,
+    # and by external tools reading a lockfile without the plugin installed.
+    class UnloadedSource
+      include API::Source
+
+      # Unlike real plugin sources, where the handling class encodes the
+      # source type, all unloaded sources share this class, so the type must
+      # be compared explicitly.
+      def ==(other)
+        super && options["type"] == other.options["type"]
+      end
+
+      alias_method :eql?, :==
+
+      def hash
+        [super, options["type"]].hash
+      end
+    end
+  end
+end

data/lib/bundler/plugin.rb

@@ -4,11 +4,12 @@ require_relative "plugin/api"
 
 module Bundler
   module Plugin
-    autoload :DSL,        File.expand_path("plugin/dsl", __dir__)
-    autoload :Events,     File.expand_path("plugin/events", __dir__)
-    autoload :Index,      File.expand_path("plugin/index", __dir__)
-    autoload :Installer,  File.expand_path("plugin/installer", __dir__)
-    autoload :SourceList, File.expand_path("plugin/source_list", __dir__)
+    autoload :DSL,            File.expand_path("plugin/dsl", __dir__)
+    autoload :Events,         File.expand_path("plugin/events", __dir__)
+    autoload :Index,          File.expand_path("plugin/index", __dir__)
+    autoload :Installer,      File.expand_path("plugin/installer", __dir__)
+    autoload :SourceList,     File.expand_path("plugin/source_list", __dir__)
+    autoload :UnloadedSource, File.expand_path("plugin/unloaded_source", __dir__)
 
     class MalformattedPlugin < PluginError; end
     class UndefinedCommandError < PluginError; end
@@ -199,9 +200,14 @@ module Bundler
     # @return [API::Source] the instance of the class that handles the source
     #                       type passed in locked_opts
     def from_lock(locked_opts)
+      opts = locked_opts.merge("uri" => locked_opts["remote"])
+      # use an inert placeholder when the plugin handling this source is not
+      # installed, so that the lockfile can still be parsed
+      return UnloadedSource.new(opts) unless source?(locked_opts["type"])
+
       src = source(locked_opts["type"])
 
-      src.new(locked_opts.merge("uri" => locked_opts["remote"]))
+      src.new(opts)
     end
 
     # To be called via the API to register a hooks and corresponding block that

data/lib/bundler/resolver/base.rb

@@ -8,6 +8,7 @@ module Bundler
       attr_reader :packages, :requirements, :source_requirements, :locked_specs
 
       def initialize(source_requirements, dependencies, base, platforms, options)
+        @explicit_unlocks = options.delete(:explicit_unlocks) || []
         @source_requirements = source_requirements
         @locked_specs = options[:locked_specs]
 
@@ -43,6 +44,14 @@ module Bundler
         @packages[name]
       end
 
+      # Gems the user named on a `bundle update GEM` / `bundle lock --update GEM`
+      # command line. These are the only ones meant to move off their locked
+      # version, so cooldown keeps applying to them while every other locked gem
+      # stays exempt.
+      def explicitly_unlocked?(name)
+        @explicit_unlocks.include?(name)
+      end
+
       def base_requirements
         @base_requirements ||= build_base_requirements
       end

data/lib/bundler/resolver.rb

@@ -437,25 +437,29 @@ module Bundler
     def cooldown_excluded?(spec)
       return false unless spec.respond_to?(:created_at) && spec.created_at
       return false unless spec.respond_to?(:remote) && spec.remote
-      return false if pinned_by_lockfile_floor?(spec)
+      return false if locked_by_lockfile?(spec)
       days = spec.remote.effective_cooldown
       return false if days.nil? || days <= 0
       (cooldown_now - spec.created_at) < (days * 86_400)
     end
 
-    # A spec sitting exactly at a `>= locked_version` prevent-downgrade floor is
-    # the version the lockfile currently pins. `bundle update` and `bundle
-    # outdated` install that floor so resolution never moves a gem backwards.
-    # Filtering it out for cooldown would then make resolution impossible
-    # whenever the locked version is itself inside the cooldown window, which is
-    # exactly what happens to a lockfile written before cooldown was enabled.
-    # Keep it eligible; gems being explicitly updated carry an exact `=`
-    # requirement instead and stay subject to the cooldown filter.
-    def pinned_by_lockfile_floor?(spec)
+    # A version already written to the lockfile has been adopted, and cooldown
+    # only governs the adoption of *new* versions, so it must never retract one
+    # the lockfile already pins. Keying this off the locked specs rather than the
+    # prevent-downgrade floor matters because that floor is absent on resolutions
+    # that re-pick a gem from scratch: the auxiliary full update run to compute
+    # `--update` targets, and the from-scratch retries after a conflict unlocks a
+    # gem. In those passes the locked version is the only candidate, so filtering
+    # it out makes an unrelated operation impossible whenever every published
+    # version matching the requirement sits inside the cooldown window.
+    #
+    # Gems named on a `bundle update GEM` command are the exception: the user
+    # asked to move them, so they stay subject to cooldown and a locked-but-fresh
+    # release is pushed back to an older one (or fails loudly when none exists).
+    def locked_by_lockfile?(spec)
       return false unless defined?(@base) && @base
-      requirement = base_requirements[spec.name]
-      return false unless requirement && !requirement.exact?
-      requirement.requirements.any? {|op, version| op == ">=" && version == spec.version }
+      return false if @base.explicitly_unlocked?(spec.name)
+      @base.locked_specs[spec.name].any? {|locked| locked.version == spec.version }
     end
 
     def cooldown_now

data/lib/bundler/rubygems_gem_installer.rb

@@ -4,6 +4,11 @@ require "rubygems/installer"
 
 module Bundler
   class RubyGemsGemInstaller < Gem::Installer
+    # Cap how many jobserver slots a single gem's `make` may grab so that one
+    # gem with many recipes doesn't starve the others sharing the pool. Beyond
+    # a handful of jobs the extra parallelism rarely pays off in practice.
+    MAX_JOBS_PER_GEM = 3
+
     def check_executable_overwrite(filename)
       # Bundler needs to install gems regardless of binstub overwriting
     end
@@ -101,10 +106,18 @@ module Bundler
     end
 
     def build_jobs
-      Bundler.settings[:jobs] || super
+      @jobserver_read_io&.read_nonblock(MAX_JOBS_PER_GEM, @jobserver_tokens)
+      acquired_jobs = @jobserver_tokens.empty? ? nil : @jobserver_tokens.size
+
+      acquired_jobs || Bundler.settings[:jobs] || super
+    rescue IO::WaitReadable, EOFError
+      1
     end
 
     def build_extensions
+      @jobserver_tokens = +""
+      @jobserver_read_io, @jobserver_write_io = connect_to_jobserver
+
       extension_cache_path = options[:bundler_extension_cache_path]
       extension_dir = spec.extension_dir
       unless extension_cache_path && extension_dir
@@ -128,6 +141,11 @@ module Bundler
           FileUtils.cp_r extension_dir, extension_cache_path
         end
       end
+    ensure
+      unless @jobserver_tokens.empty?
+        @jobserver_write_io.write(@jobserver_tokens)
+        @jobserver_write_io.flush
+      end
     end
 
     def spec
@@ -144,6 +162,21 @@ module Bundler
 
     private
 
+    def connect_to_jobserver
+      return unless ENV["MAKEFLAGS"]
+      # We append our own --jobserver-auth, so read the last one. Otherwise a
+      # parent jobserver's descriptors (e.g. `bundle install` run under
+      # `make -j`) would be picked up instead of the pool ParallelInstaller created.
+      read_fd, write_fd = ENV["MAKEFLAGS"].scan(/--jobserver-auth=(\d+),(\d+)/).last
+
+      return unless read_fd && write_fd
+
+      # Pass explicit modes. On POSIX, IO.new detects the descriptor's access
+      # mode, but on Windows it can't, so the write end would default to read
+      # mode and raise "IOError: not opened for writing" when releasing slots.
+      [IO.new(read_fd.to_i, "r", autoclose: false), IO.new(write_fd.to_i, "w", autoclose: false)]
+    end
+
     def prepare_extension_build(extension_dir)
       SharedHelpers.filesystem_access(extension_dir, :create) do
         FileUtils.mkdir_p extension_dir

data/lib/bundler/source/git/git_proxy.rb

@@ -144,6 +144,12 @@ module Bundler
                 FileUtils.rm_rf(p)
               end
               git "clone", "--no-checkout", "--quiet", path.to_s, destination.to_s
+              # The copy is cloned from the local bare cache, which holds no Git LFS
+              # objects, so point origin back at the real remote and let git-lfs derive
+              # its endpoint from there when checking out. Use the credential-filtered
+              # URI to avoid persisting secrets in the copy's .git/config; auth is left
+              # to git's credential helper.
+              git "remote", "set-url", "origin", credential_filtered_uri, dir: destination
               File.chmod((File.stat(destination).mode | 0o777) & ~File.umask, destination)
             rescue Errno::EEXIST => e
               file_path = e.message[%r{.*?((?:[a-zA-Z]:)?/.*)}, 1]

data/lib/bundler/source/rubygems.rb

@@ -25,6 +25,7 @@ module Bundler
         @checksum_store = Checksum::Store.new
         @gem_installers = {}
         @gem_installers_mutex = Mutex.new
+        @remote_specs_mutex = Mutex.new
 
         cooldown = options["cooldown"]
         Array(options["remotes"]).reverse_each {|r| add_remote(r, cooldown: cooldown) }
@@ -243,7 +244,7 @@ module Bundler
       def cached_built_in_gem(spec, local: false)
         cached_path = cached_gem(spec)
         if cached_path.nil? && !local
-          remote_spec = remote_specs.search(spec).first
+          remote_spec = remote_spec_for(spec)
           if remote_spec
             cached_path = fetch_gem(remote_spec)
             spec.remote = remote_spec.remote
@@ -337,6 +338,12 @@ module Bundler
         @cached_specs = nil
       end
 
+      def release_resolution_memory!
+        @specs = nil
+        @remote_specs_mutex.synchronize { @remote_specs = nil }
+        @fetchers&.each(&:release_resolution_memory!)
+      end
+
       protected
 
       def remote_names
@@ -414,17 +421,30 @@ module Bundler
       end
 
       def remote_specs
-        @remote_specs ||= Index.build do |idx|
-          index_fetchers = fetchers - api_fetchers
+        @remote_specs ||= @remote_specs_mutex.synchronize do
+          @remote_specs ||= Index.build do |idx|
+            index_fetchers = fetchers - api_fetchers
 
-          if index_fetchers.empty?
-            fetch_names(api_fetchers, dependency_names, idx)
-          else
-            fetch_names(fetchers, nil, idx)
+            if index_fetchers.empty?
+              fetch_names(api_fetchers, dependency_names, idx)
+            else
+              fetch_names(fetchers, nil, idx)
+            end
           end
         end
       end
 
+      # Looks up a single spec in the remote sources, fetching only its own
+      # name when the full remote index is not already materialized.
+      def remote_spec_for(spec)
+        return remote_specs.search(spec).first if @remote_specs || api_fetchers.empty?
+
+        index = Index.build do |idx|
+          fetch_names(api_fetchers, [spec.name], idx)
+        end
+        index.search(spec).first
+      end
+
       def fetch_names(fetchers, dependency_names, index)
         fetchers.each do |f|
           if dependency_names

data/lib/bundler/source_list.rb

@@ -140,6 +140,10 @@ module Bundler
       rubygems_sources.each(&:clear_cache)
     end
 
+    def release_resolution_memory!
+      rubygems_sources.each(&:release_resolution_memory!)
+    end
+
     private
 
     def map_sources(replacement_sources)

data/lib/bundler/spec_set.rb

@@ -5,7 +5,7 @@ require_relative "vendored_tsort"
 module Bundler
   class SpecSet
     include Enumerable
-    include TSort
+    include Gem::TSort
 
     def initialize(specs)
       @specs = specs
@@ -315,7 +315,7 @@ module Bundler
 
     def sorted
       @sorted ||= ([@specs.find {|s| s.name == "rake" }] + tsort).compact.uniq
-    rescue TSort::Cyclic => error
+    rescue Gem::TSort::Cyclic => error
       cgems = extract_circular_gems(error)
       raise CyclicDependencyError, "Your bundle requires gems that depend" \
         " on each other, creating an infinite loop. Please remove either" \

data/lib/bundler/templates/newgem/newgem.gemspec.tt

@@ -47,7 +47,7 @@ Gem::Specification.new do |spec|
   # Uncomment to register a new dependency of your gem
   # spec.add_dependency "example-gem", "~> 1.0"
 <%- if config[:ext] == 'rust' -%>
-  spec.add_dependency "rb_sys", "~> 0.9.91"
+  spec.add_dependency "rb_sys", "~> 0.9.128"
 <%- end -%>
 <%- if config[:ext] == 'go' -%>
   spec.add_dependency "go_gem", "~> 0.2"

data/lib/bundler/vendored_tsort.rb

@@ -1,4 +1,21 @@
 # frozen_string_literal: true
 
-module Bundler; end
-require_relative "vendor/tsort/lib/tsort"
+# The defined? guard avoids reopening Gem::TSort when an old RubyGems has
+# already loaded its own copy, e.g. through rubygems/request_set from
+# Gem.activate_bin_path in binstubs.
+#
+unless defined?(Gem::TSort)
+  begin
+    require "rubygems/vendored_tsort"
+  rescue LoadError
+    begin
+      # RubyGems 3.4 and 3.5 ship the same file under its pre-3.6 name.
+      # Requiring the real tsort here instead would activate the tsort
+      # default gem, and `bundler/setup` must not activate any gems.
+      require "rubygems/tsort"
+    rescue LoadError
+      require "tsort"
+      Gem::TSort = TSort
+    end
+  end
+end

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.14".freeze
+  VERSION = "4.0.16".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 4.0.14
+  version: 4.0.16
 platform: ruby
 authors:
 - André Arko
@@ -194,6 +194,7 @@ files:
 - lib/bundler/plugin/installer/path.rb
 - lib/bundler/plugin/installer/rubygems.rb
 - lib/bundler/plugin/source_list.rb
+- lib/bundler/plugin/unloaded_source.rb
 - lib/bundler/process_lock.rb
 - lib/bundler/remote_specification.rb
 - lib/bundler/resolver.rb
@@ -349,8 +350,6 @@ files:
 - lib/bundler/vendor/thor/lib/thor/shell/wrapped_printer.rb
 - lib/bundler/vendor/thor/lib/thor/util.rb
 - lib/bundler/vendor/thor/lib/thor/version.rb
-- lib/bundler/vendor/tsort/LICENSE.txt
-- lib/bundler/vendor/tsort/lib/tsort.rb
 - lib/bundler/vendor/uri/COPYING
 - lib/bundler/vendor/uri/lib/uri.rb
 - lib/bundler/vendor/uri/lib/uri/common.rb
@@ -385,9 +384,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/ruby/rubygems/issues?q=is%3Aopen+is%3Aissue+label%3ABundler
-  changelog_uri: https://github.com/ruby/rubygems/blob/master/bundler/CHANGELOG.md
+  changelog_uri: https://github.com/ruby/rubygems/blob/master/CHANGELOG-bundler.md
   homepage_uri: https://bundler.io/
-  source_code_uri: https://github.com/ruby/rubygems/tree/master/bundler
+  source_code_uri: https://github.com/ruby/rubygems
 rdoc_options: []
 require_paths:
 - lib

data/lib/bundler/vendor/tsort/LICENSE.txt

@@ -1,22 +0,0 @@
-Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-notice, this list of conditions and the following disclaimer in the
-documentation and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.

data/lib/bundler/vendor/tsort/lib/tsort.rb

@@ -1,455 +0,0 @@
-# frozen_string_literal: true
-
-#--
-# tsort.rb - provides a module for topological sorting and strongly connected components.
-#++
-#
-
-#
-# Bundler::TSort implements topological sorting using Tarjan's algorithm for
-# strongly connected components.
-#
-# Bundler::TSort is designed to be able to be used with any object which can be
-# interpreted as a directed graph.
-#
-# Bundler::TSort requires two methods to interpret an object as a graph,
-# tsort_each_node and tsort_each_child.
-#
-# * tsort_each_node is used to iterate for all nodes over a graph.
-# * tsort_each_child is used to iterate for child nodes of a given node.
-#
-# The equality of nodes are defined by eql? and hash since
-# Bundler::TSort uses Hash internally.
-#
-# == A Simple Example
-#
-# The following example demonstrates how to mix the Bundler::TSort module into an
-# existing class (in this case, Hash). Here, we're treating each key in
-# the hash as a node in the graph, and so we simply alias the required
-# #tsort_each_node method to Hash's #each_key method. For each key in the
-# hash, the associated value is an array of the node's child nodes. This
-# choice in turn leads to our implementation of the required #tsort_each_child
-# method, which fetches the array of child nodes and then iterates over that
-# array using the user-supplied block.
-#
-#   require 'bundler/vendor/tsort/lib/tsort'
-#
-#   class Hash
-#     include Bundler::TSort
-#     alias tsort_each_node each_key
-#     def tsort_each_child(node, &block)
-#       fetch(node).each(&block)
-#     end
-#   end
-#
-#   {1=>[2, 3], 2=>[3], 3=>[], 4=>[]}.tsort
-#   #=> [3, 2, 1, 4]
-#
-#   {1=>[2], 2=>[3, 4], 3=>[2], 4=>[]}.strongly_connected_components
-#   #=> [[4], [2, 3], [1]]
-#
-# == A More Realistic Example
-#
-# A very simple `make' like tool can be implemented as follows:
-#
-#   require 'bundler/vendor/tsort/lib/tsort'
-#
-#   class Make
-#     def initialize
-#       @dep = {}
-#       @dep.default = []
-#     end
-#
-#     def rule(outputs, inputs=[], &block)
-#       triple = [outputs, inputs, block]
-#       outputs.each {|f| @dep[f] = [triple]}
-#       @dep[triple] = inputs
-#     end
-#
-#     def build(target)
-#       each_strongly_connected_component_from(target) {|ns|
-#         if ns.length != 1
-#           fs = ns.delete_if {|n| Array === n}
-#           raise Bundler::TSort::Cyclic.new("cyclic dependencies: #{fs.join ', '}")
-#         end
-#         n = ns.first
-#         if Array === n
-#           outputs, inputs, block = n
-#           inputs_time = inputs.map {|f| File.mtime f}.max
-#           begin
-#             outputs_time = outputs.map {|f| File.mtime f}.min
-#           rescue Errno::ENOENT
-#             outputs_time = nil
-#           end
-#           if outputs_time == nil ||
-#              inputs_time != nil && outputs_time <= inputs_time
-#             sleep 1 if inputs_time != nil && inputs_time.to_i == Time.now.to_i
-#             block.call
-#           end
-#         end
-#       }
-#     end
-#
-#     def tsort_each_child(node, &block)
-#       @dep[node].each(&block)
-#     end
-#     include Bundler::TSort
-#   end
-#
-#   def command(arg)
-#     print arg, "\n"
-#     system arg
-#   end
-#
-#   m = Make.new
-#   m.rule(%w[t1]) { command 'date > t1' }
-#   m.rule(%w[t2]) { command 'date > t2' }
-#   m.rule(%w[t3]) { command 'date > t3' }
-#   m.rule(%w[t4], %w[t1 t3]) { command 'cat t1 t3 > t4' }
-#   m.rule(%w[t5], %w[t4 t2]) { command 'cat t4 t2 > t5' }
-#   m.build('t5')
-#
-# == Bugs
-#
-# * 'tsort.rb' is wrong name because this library uses
-#   Tarjan's algorithm for strongly connected components.
-#   Although 'strongly_connected_components.rb' is correct but too long.
-#
-# == References
-#
-# R. E. Tarjan, "Depth First Search and Linear Graph Algorithms",
-# <em>SIAM Journal on Computing</em>, Vol. 1, No. 2, pp. 146-160, June 1972.
-#
-
-module Bundler::TSort
-
-  VERSION = "0.2.0"
-
-  class Cyclic < StandardError
-  end
-
-  # Returns a topologically sorted array of nodes.
-  # The array is sorted from children to parents, i.e.
-  # the first element has no child and the last node has no parent.
-  #
-  # If there is a cycle, Bundler::TSort::Cyclic is raised.
-  #
-  #   class G
-  #     include Bundler::TSort
-  #     def initialize(g)
-  #       @g = g
-  #     end
-  #     def tsort_each_child(n, &b) @g[n].each(&b) end
-  #     def tsort_each_node(&b) @g.each_key(&b) end
-  #   end
-  #
-  #   graph = G.new({1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]})
-  #   p graph.tsort #=> [4, 2, 3, 1]
-  #
-  #   graph = G.new({1=>[2], 2=>[3, 4], 3=>[2], 4=>[]})
-  #   p graph.tsort # raises Bundler::TSort::Cyclic
-  #
-  def tsort
-    each_node = method(:tsort_each_node)
-    each_child = method(:tsort_each_child)
-    Bundler::TSort.tsort(each_node, each_child)
-  end
-
-  # Returns a topologically sorted array of nodes.
-  # The array is sorted from children to parents, i.e.
-  # the first element has no child and the last node has no parent.
-  #
-  # The graph is represented by _each_node_ and _each_child_.
-  # _each_node_ should have +call+ method which yields for each node in the graph.
-  # _each_child_ should have +call+ method which takes a node argument and yields for each child node.
-  #
-  # If there is a cycle, Bundler::TSort::Cyclic is raised.
-  #
-  #   g = {1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]}
-  #   each_node = lambda {|&b| g.each_key(&b) }
-  #   each_child = lambda {|n, &b| g[n].each(&b) }
-  #   p Bundler::TSort.tsort(each_node, each_child) #=> [4, 2, 3, 1]
-  #
-  #   g = {1=>[2], 2=>[3, 4], 3=>[2], 4=>[]}
-  #   each_node = lambda {|&b| g.each_key(&b) }
-  #   each_child = lambda {|n, &b| g[n].each(&b) }
-  #   p Bundler::TSort.tsort(each_node, each_child) # raises Bundler::TSort::Cyclic
-  #
-  def self.tsort(each_node, each_child)
-    tsort_each(each_node, each_child).to_a
-  end
-
-  # The iterator version of the #tsort method.
-  # <tt><em>obj</em>.tsort_each</tt> is similar to <tt><em>obj</em>.tsort.each</tt>, but
-  # modification of _obj_ during the iteration may lead to unexpected results.
-  #
-  # #tsort_each returns +nil+.
-  # If there is a cycle, Bundler::TSort::Cyclic is raised.
-  #
-  #   class G
-  #     include Bundler::TSort
-  #     def initialize(g)
-  #       @g = g
-  #     end
-  #     def tsort_each_child(n, &b) @g[n].each(&b) end
-  #     def tsort_each_node(&b) @g.each_key(&b) end
-  #   end
-  #
-  #   graph = G.new({1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]})
-  #   graph.tsort_each {|n| p n }
-  #   #=> 4
-  #   #   2
-  #   #   3
-  #   #   1
-  #
-  def tsort_each(&block) # :yields: node
-    each_node = method(:tsort_each_node)
-    each_child = method(:tsort_each_child)
-    Bundler::TSort.tsort_each(each_node, each_child, &block)
-  end
-
-  # The iterator version of the Bundler::TSort.tsort method.
-  #
-  # The graph is represented by _each_node_ and _each_child_.
-  # _each_node_ should have +call+ method which yields for each node in the graph.
-  # _each_child_ should have +call+ method which takes a node argument and yields for each child node.
-  #
-  #   g = {1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]}
-  #   each_node = lambda {|&b| g.each_key(&b) }
-  #   each_child = lambda {|n, &b| g[n].each(&b) }
-  #   Bundler::TSort.tsort_each(each_node, each_child) {|n| p n }
-  #   #=> 4
-  #   #   2
-  #   #   3
-  #   #   1
-  #
-  def self.tsort_each(each_node, each_child) # :yields: node
-    return to_enum(__method__, each_node, each_child) unless block_given?
-
-    each_strongly_connected_component(each_node, each_child) {|component|
-      if component.size == 1
-        yield component.first
-      else
-        raise Cyclic.new("topological sort failed: #{component.inspect}")
-      end
-    }
-  end
-
-  # Returns strongly connected components as an array of arrays of nodes.
-  # The array is sorted from children to parents.
-  # Each elements of the array represents a strongly connected component.
-  #
-  #   class G
-  #     include Bundler::TSort
-  #     def initialize(g)
-  #       @g = g
-  #     end
-  #     def tsort_each_child(n, &b) @g[n].each(&b) end
-  #     def tsort_each_node(&b) @g.each_key(&b) end
-  #   end
-  #
-  #   graph = G.new({1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]})
-  #   p graph.strongly_connected_components #=> [[4], [2], [3], [1]]
-  #
-  #   graph = G.new({1=>[2], 2=>[3, 4], 3=>[2], 4=>[]})
-  #   p graph.strongly_connected_components #=> [[4], [2, 3], [1]]
-  #
-  def strongly_connected_components
-    each_node = method(:tsort_each_node)
-    each_child = method(:tsort_each_child)
-    Bundler::TSort.strongly_connected_components(each_node, each_child)
-  end
-
-  # Returns strongly connected components as an array of arrays of nodes.
-  # The array is sorted from children to parents.
-  # Each elements of the array represents a strongly connected component.
-  #
-  # The graph is represented by _each_node_ and _each_child_.
-  # _each_node_ should have +call+ method which yields for each node in the graph.
-  # _each_child_ should have +call+ method which takes a node argument and yields for each child node.
-  #
-  #   g = {1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]}
-  #   each_node = lambda {|&b| g.each_key(&b) }
-  #   each_child = lambda {|n, &b| g[n].each(&b) }
-  #   p Bundler::TSort.strongly_connected_components(each_node, each_child)
-  #   #=> [[4], [2], [3], [1]]
-  #
-  #   g = {1=>[2], 2=>[3, 4], 3=>[2], 4=>[]}
-  #   each_node = lambda {|&b| g.each_key(&b) }
-  #   each_child = lambda {|n, &b| g[n].each(&b) }
-  #   p Bundler::TSort.strongly_connected_components(each_node, each_child)
-  #   #=> [[4], [2, 3], [1]]
-  #
-  def self.strongly_connected_components(each_node, each_child)
-    each_strongly_connected_component(each_node, each_child).to_a
-  end
-
-  # The iterator version of the #strongly_connected_components method.
-  # <tt><em>obj</em>.each_strongly_connected_component</tt> is similar to
-  # <tt><em>obj</em>.strongly_connected_components.each</tt>, but
-  # modification of _obj_ during the iteration may lead to unexpected results.
-  #
-  # #each_strongly_connected_component returns +nil+.
-  #
-  #   class G
-  #     include Bundler::TSort
-  #     def initialize(g)
-  #       @g = g
-  #     end
-  #     def tsort_each_child(n, &b) @g[n].each(&b) end
-  #     def tsort_each_node(&b) @g.each_key(&b) end
-  #   end
-  #
-  #   graph = G.new({1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]})
-  #   graph.each_strongly_connected_component {|scc| p scc }
-  #   #=> [4]
-  #   #   [2]
-  #   #   [3]
-  #   #   [1]
-  #
-  #   graph = G.new({1=>[2], 2=>[3, 4], 3=>[2], 4=>[]})
-  #   graph.each_strongly_connected_component {|scc| p scc }
-  #   #=> [4]
-  #   #   [2, 3]
-  #   #   [1]
-  #
-  def each_strongly_connected_component(&block) # :yields: nodes
-    each_node = method(:tsort_each_node)
-    each_child = method(:tsort_each_child)
-    Bundler::TSort.each_strongly_connected_component(each_node, each_child, &block)
-  end
-
-  # The iterator version of the Bundler::TSort.strongly_connected_components method.
-  #
-  # The graph is represented by _each_node_ and _each_child_.
-  # _each_node_ should have +call+ method which yields for each node in the graph.
-  # _each_child_ should have +call+ method which takes a node argument and yields for each child node.
-  #
-  #   g = {1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]}
-  #   each_node = lambda {|&b| g.each_key(&b) }
-  #   each_child = lambda {|n, &b| g[n].each(&b) }
-  #   Bundler::TSort.each_strongly_connected_component(each_node, each_child) {|scc| p scc }
-  #   #=> [4]
-  #   #   [2]
-  #   #   [3]
-  #   #   [1]
-  #
-  #   g = {1=>[2], 2=>[3, 4], 3=>[2], 4=>[]}
-  #   each_node = lambda {|&b| g.each_key(&b) }
-  #   each_child = lambda {|n, &b| g[n].each(&b) }
-  #   Bundler::TSort.each_strongly_connected_component(each_node, each_child) {|scc| p scc }
-  #   #=> [4]
-  #   #   [2, 3]
-  #   #   [1]
-  #
-  def self.each_strongly_connected_component(each_node, each_child) # :yields: nodes
-    return to_enum(__method__, each_node, each_child) unless block_given?
-
-    id_map = {}
-    stack = []
-    each_node.call {|node|
-      unless id_map.include? node
-        each_strongly_connected_component_from(node, each_child, id_map, stack) {|c|
-          yield c
-        }
-      end
-    }
-    nil
-  end
-
-  # Iterates over strongly connected component in the subgraph reachable from
-  # _node_.
-  #
-  # Return value is unspecified.
-  #
-  # #each_strongly_connected_component_from doesn't call #tsort_each_node.
-  #
-  #   class G
-  #     include Bundler::TSort
-  #     def initialize(g)
-  #       @g = g
-  #     end
-  #     def tsort_each_child(n, &b) @g[n].each(&b) end
-  #     def tsort_each_node(&b) @g.each_key(&b) end
-  #   end
-  #
-  #   graph = G.new({1=>[2, 3], 2=>[4], 3=>[2, 4], 4=>[]})
-  #   graph.each_strongly_connected_component_from(2) {|scc| p scc }
-  #   #=> [4]
-  #   #   [2]
-  #
-  #   graph = G.new({1=>[2], 2=>[3, 4], 3=>[2], 4=>[]})
-  #   graph.each_strongly_connected_component_from(2) {|scc| p scc }
-  #   #=> [4]
-  #   #   [2, 3]
-  #
-  def each_strongly_connected_component_from(node, id_map={}, stack=[], &block) # :yields: nodes
-    Bundler::TSort.each_strongly_connected_component_from(node, method(:tsort_each_child), id_map, stack, &block)
-  end
-
-  # Iterates over strongly connected components in a graph.
-  # The graph is represented by _node_ and _each_child_.
-  #
-  # _node_ is the first node.
-  # _each_child_ should have +call+ method which takes a node argument
-  # and yields for each child node.
-  #
-  # Return value is unspecified.
-  #
-  # #Bundler::TSort.each_strongly_connected_component_from is a class method and
-  # it doesn't need a class to represent a graph which includes Bundler::TSort.
-  #
-  #   graph = {1=>[2], 2=>[3, 4], 3=>[2], 4=>[]}
-  #   each_child = lambda {|n, &b| graph[n].each(&b) }
-  #   Bundler::TSort.each_strongly_connected_component_from(1, each_child) {|scc|
-  #     p scc
-  #   }
-  #   #=> [4]
-  #   #   [2, 3]
-  #   #   [1]
-  #
-  def self.each_strongly_connected_component_from(node, each_child, id_map={}, stack=[]) # :yields: nodes
-    return to_enum(__method__, node, each_child, id_map, stack) unless block_given?
-
-    minimum_id = node_id = id_map[node] = id_map.size
-    stack_length = stack.length
-    stack << node
-
-    each_child.call(node) {|child|
-      if id_map.include? child
-        child_id = id_map[child]
-        minimum_id = child_id if child_id && child_id < minimum_id
-      else
-        sub_minimum_id =
-          each_strongly_connected_component_from(child, each_child, id_map, stack) {|c|
-            yield c
-          }
-        minimum_id = sub_minimum_id if sub_minimum_id < minimum_id
-      end
-    }
-
-    if node_id == minimum_id
-      component = stack.slice!(stack_length .. -1)
-      component.each {|n| id_map[n] = nil}
-      yield component
-    end
-
-    minimum_id
-  end
-
-  # Should be implemented by a extended class.
-  #
-  # #tsort_each_node is used to iterate for all nodes over a graph.
-  #
-  def tsort_each_node # :yields: node
-    raise NotImplementedError.new
-  end
-
-  # Should be implemented by a extended class.
-  #
-  # #tsort_each_child is used to iterate for child nodes of _node_.
-  #
-  def tsort_each_child(node) # :yields: child
-    raise NotImplementedError.new
-  end
-end