bundler 4.0.16 → 4.0.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4ec7b35f89e61eb8c603099869df9c107accc057741b52f03b849d31ae0e734
-  data.tar.gz: 13f346287c2ee66bb2baa3ddfaff121fce05c0f428ae73aa199b148559a80525
+  metadata.gz: a0e51552827f6a9e6f69879c84b28b5fc102157385d7b5acc8f76ccf23fc1d02
+  data.tar.gz: 580c4732a5106f1ac54652b7399e187a365a6b891e6b1eb5093093b7c0bcbbbd
 SHA512:
-  metadata.gz: 6e70a1fb438a201e9864383eba6a47727102581979a7e15902d219cca5939e623e933b728a812308b0cf7e2210237bfcee2be2d99e36eabb24296360be296607
-  data.tar.gz: 105f3457b4a7f4e69a252ee7857fcbeb7c4c91406c1ad76a693f09e2a3cf2a741bf407a91053fbe57d29afe8c88ded24553b6de33deb76ce11c9abff20d117ec
+  metadata.gz: 03f0b65a2e6655251ddd488cfe43983e7e94d1e72be6166ab5c4627f6075ee9d4aabf38e7e6c4514eb906a0ee524aaa6a3fbf2a598fdb7ecc8f3301b803cdf90
+  data.tar.gz: 36b037826c24cf525249954629c83c3d131a27a3d009d0a9af749e1108dcd043c151fa7f4f5786edc47a75c5526af6917a7da8ed0b222766e97749a4d298bbfd

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 4.0.17 / 2026-07-22
+
+### Enhancements:
+
+* Open compact index cache in binary mode when appending. Pull request [#9679](https://github.com/ruby/rubygems/pull/9679) by hsbt
+
+### Bug fixes:
+
+* Unquote Gem.ruby when spawning it as a separate argv element. Pull request [#9695](https://github.com/ruby/rubygems/pull/9695) by hsbt
+* Escape glob metacharacters in install paths when globbing. Pull request [#9687](https://github.com/ruby/rubygems/pull/9687) by hsbt
+* Avoid space-containing absolute path in RUBYOPT. Pull request [#9696](https://github.com/ruby/rubygems/pull/9696) by hsbt
+* Preserve the locked Bundler checksum when the gem isn't cached. Pull request [#9658](https://github.com/ruby/rubygems/pull/9658) by rwstauner
+
+### Documentation:
+
+* Point Bundler gemspec metadata at the moved docs. Pull request [#9648](https://github.com/ruby/rubygems/pull/9648) by hsbt
+
 ## 4.0.16 / 2026-07-10
 
 ### Enhancements:

data/lib/bundler/build_metadata.rb

@@ -5,7 +5,7 @@ module Bundler
   module BuildMetadata
     # begin ivars
     @built_at = nil
-    @git_commit_sha = "fc18079dba".freeze
+    @git_commit_sha = "f80cbc4c44".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/open.rb

@@ -18,12 +18,22 @@ module Bundler
         Bundler.ui.info "Unable to open #{name} because it's a default gem, so the directory it would normally be installed to does not exist."
       else
         root_path = spec.full_gem_path
-        require "shellwords"
-        command = Shellwords.split(editor) << File.join([root_path, path].compact)
+        command = editor_command(editor) << File.join([root_path, path].compact)
         Bundler.with_original_env do
           system(*command, { chdir: root_path })
         end || Bundler.ui.info("Could not run '#{command.join(" ")}'")
       end
     end
+
+    def editor_command(editor)
+      # On Windows an editor is often configured with a full path such as
+      # C:\Program Files\Microsoft VS Code\Code.exe, which shell splitting
+      # would corrupt. Take a value that names an existing file as a
+      # single word.
+      return [editor] if Gem.win_platform? && File.file?(editor)
+
+      require "shellwords"
+      Shellwords.split(editor)
+    end
   end
 end

data/lib/bundler/compact_index_client/cache_file.rb

@@ -103,7 +103,7 @@ module Bundler
       # Returns false without appending when no digests since appending is too error prone to do without digests.
       def append(data)
         return false unless digests?
-        open("a") {|f| f.write data }
+        open("ab") {|f| f.write data }
         verify && commit
       end
 

data/lib/bundler/lockfile_generator.rb

@@ -103,17 +103,40 @@ module Bundler
     end
 
     def bundler_checksum
+      # `.dev` versions and `SKIP_BUNDLER_CHECKSUM` are deliberate opt-outs (used
+      # by Bundler/RubyGems' own development and release tasks): never record a
+      # checksum for Bundler itself in those cases.
       return [] if Bundler.gem_version.to_s.end_with?(".dev") || ENV["SKIP_BUNDLER_CHECKSUM"]
 
       bundler_spec = definition.sources.metadata_source.specs.search(["bundler", Bundler.gem_version]).last
-      return [] unless File.exist?(bundler_spec.cache_file)
 
-      require "rubygems/package"
+      # Record a fresh checksum from the locally cached gem when it's available.
+      # When it isn't (e.g. a fresh checkout/CI that never downloaded the bundler
+      # gem), fall back to whatever checksum is already locked rather than
+      # dropping it, so the entry stays consistent across environments.
+      if File.exist?(bundler_spec.cache_file)
+        require "rubygems/package"
+
+        package = Gem::Package.new(bundler_spec.cache_file)
+        definition.sources.metadata_source.checksum_store.register(bundler_spec, Checksum.from_gem_package(package))
+      elsif bundled_with_changing?
+        # We can't compute a fresh checksum (the bundler gem isn't cached) and the
+        # BUNDLED WITH version is changing. Keeping the previously locked checksum
+        # would leave a `bundler (<old version>) sha256=...` entry that no longer
+        # matches the new BUNDLED WITH version, so drop it instead.
+        return []
+      end
 
-      package = Gem::Package.new(bundler_spec.cache_file)
-      definition.sources.metadata_source.checksum_store.register(bundler_spec, Checksum.from_gem_package(package))
+      return [] if definition.sources.metadata_source.checksum_store.missing?(bundler_spec)
 
       [definition.sources.metadata_source.checksum_store.to_lock(bundler_spec)]
     end
+
+    def bundled_with_changing?
+      locked_gems = definition.locked_gems
+      return false unless locked_gems
+
+      locked_gems.bundler_version != definition.bundler_version_to_lock
+    end
   end
 end

data/lib/bundler/runtime.rb

@@ -141,7 +141,7 @@ module Bundler
         end
       end
 
-      Dir[cache_path.join("*/.git")].each do |git_dir|
+      Gem::Util.glob_files_in_dir("*/.git", cache_path.to_s).each do |git_dir|
         FileUtils.rm_rf(git_dir)
         FileUtils.touch(File.expand_path("../.bundlecache", git_dir))
       end
@@ -159,13 +159,13 @@ module Bundler
     end
 
     def clean(dry_run = false)
-      gem_bins             = Dir["#{Gem.dir}/bin/*"]
-      git_dirs             = Dir["#{Gem.dir}/bundler/gems/*"]
-      git_cache_dirs       = Dir["#{Gem.dir}/cache/bundler/git/*"]
-      gem_dirs             = Dir["#{Gem.dir}/gems/*"]
-      gem_files            = Dir["#{Gem.dir}/cache/*.gem"]
-      gemspec_files        = Dir["#{Gem.dir}/specifications/*.gemspec"]
-      extension_dirs       = Dir["#{Gem.dir}/extensions/*/*/*"] + Dir["#{Gem.dir}/bundler/gems/extensions/*/*/*"]
+      gem_bins             = Gem::Util.glob_files_in_dir("bin/*", Gem.dir)
+      git_dirs             = Gem::Util.glob_files_in_dir("bundler/gems/*", Gem.dir)
+      git_cache_dirs       = Gem::Util.glob_files_in_dir("cache/bundler/git/*", Gem.dir)
+      gem_dirs             = Gem::Util.glob_files_in_dir("gems/*", Gem.dir)
+      gem_files            = Gem::Util.glob_files_in_dir("cache/*.gem", Gem.dir)
+      gemspec_files        = Gem::Util.glob_files_in_dir("specifications/*.gemspec", Gem.dir)
+      extension_dirs       = Gem::Util.glob_files_in_dir("extensions/*/*/*", Gem.dir) + Gem::Util.glob_files_in_dir("bundler/gems/extensions/*/*/*", Gem.dir)
       spec_gem_paths       = []
       # need to keep git sources around
       spec_git_paths       = @definition.spec_git_paths
@@ -232,7 +232,7 @@ module Bundler
     private
 
     def prune_gem_cache(resolve, cache_path)
-      cached = Dir["#{cache_path}/*.gem"]
+      cached = Gem::Util.glob_files_in_dir("*.gem", cache_path.to_s)
 
       cached = cached.delete_if do |path|
         spec = Bundler.rubygems.spec_from_gem path
@@ -257,7 +257,7 @@ module Bundler
     end
 
     def prune_git_and_path_cache(resolve, cache_path)
-      cached = Dir["#{cache_path}/*/.bundlecache"]
+      cached = Gem::Util.glob_files_in_dir("*/.bundlecache", cache_path.to_s)
 
       cached = cached.delete_if do |path|
         name = File.basename(File.dirname(path))
@@ -283,7 +283,7 @@ module Bundler
       # Add man/ subdirectories from activated bundles to MANPATH for man(1)
       manuals = $LOAD_PATH.filter_map do |path|
         man_subdir = path.sub(/lib$/, "man")
-        man_subdir unless Dir[man_subdir + "/man?/"].empty?
+        man_subdir unless Dir.glob("man?/", base: man_subdir).empty?
       end
 
       return if manuals.empty?

data/lib/bundler/self_manager.rb

@@ -75,7 +75,12 @@ module Bundler
 
       argv0 = File.exist?($PROGRAM_NAME) ? $PROGRAM_NAME : Process.argv0
       cmd = [argv0, *ARGV]
-      cmd.unshift(Gem.ruby) unless File.executable?(argv0)
+      unless File.executable?(argv0)
+        # Gem.ruby is quoted if it contains whitespace, so split it into argv
+        # elements to keep the quotes out of the exec'd command.
+        require "shellwords"
+        cmd.unshift(*Shellwords.split(Gem.ruby))
+      end
 
       Bundler.with_original_env do
         Kernel.exec(

data/lib/bundler/shared_helpers.rb

@@ -346,7 +346,12 @@ module Bundler
 
     def set_rubyopt
       rubyopt = [ENV["RUBYOPT"]].compact
-      setup_require = "-r#{File.expand_path("setup", __dir__)}"
+      setup_path = File.expand_path("setup", __dir__)
+      # RUBYOPT is split on whitespace with no quoting mechanism, so an
+      # absolute path containing spaces would be torn apart. Fall back to
+      # requiring by feature name; set_rubylib puts our lib directory first
+      # on the child's load path.
+      setup_require = /\s/.match?(setup_path) ? "-rbundler/setup" : "-r#{setup_path}"
       return if !rubyopt.empty? && rubyopt.first.include?(setup_require)
       rubyopt.unshift setup_require
       Bundler::SharedHelpers.set_env "RUBYOPT", rubyopt.join(" ")

data/lib/bundler/source/git.rb

@@ -320,7 +320,7 @@ module Bundler
 
       def serialize_gemspecs_in(destination)
         destination = destination.expand_path(Bundler.root) if destination.relative?
-        Dir["#{destination}/#{@glob}"].each do |spec_path|
+        Gem::Util.glob_files_in_dir(@glob, destination.to_s).each do |spec_path|
           # Evaluate gemspecs and cache the result. Gemspecs
           # in git might require git or other dependencies.
           # The gemspecs we cache should already be evaluated.

data/lib/bundler/source/rubygems.rb

@@ -406,7 +406,7 @@ module Bundler
         @cached_specs ||= begin
           idx = Index.new
 
-          Dir["#{cache_path}/*.gem"].each do |gemfile|
+          Gem::Util.glob_files_in_dir("*.gem", cache_path.to_s).each do |gemfile|
             s ||= Bundler.rubygems.spec_from_gem(gemfile)
             s.source = self
             idx << s

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.16".freeze
+  VERSION = "4.0.17".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 4.0.16
+  version: 4.0.17
 platform: ruby
 authors:
 - André Arko
@@ -401,7 +401,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.4.1
 requirements: []
-rubygems_version: 4.0.13
+rubygems_version: 4.0.16
 specification_version: 4
 summary: The best way to manage your application's dependencies
 test_files: []