bundler 4.0.19 → 4.0.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b226f9f760a2d66f3b95d374178f56adb909e5cf3ffd2dc11c7605b2e87dba70
-  data.tar.gz: 86e4c8a419331c322df10fa720ad136270b195de3550bd98760aae42d825f6c2
+  metadata.gz: afa0c2897b3ab6a8ffbfaacf1d1bb51e2a44a994735b2db990b39f988d44d9fe
+  data.tar.gz: 81b0134db390637dffbd6bc61554fec61813c06fb5db8e87a8b3b53fa1f880ca
 SHA512:
-  metadata.gz: 27f08e16ceebc01eb1d884c5307b55d993c5048184c4eb2cc3df91596f384b1f23cf038f3b95119bbf0b89aee8f2cad2b380ddf5f8bd0500470fc1a04f882e70
-  data.tar.gz: 4aaac6eb994de8d3fe9d3305168cea18e2eecd31802681bb548f70cd4ebebcf996d5edb85a61f090cdb05447f57dd074c113872da11831072c07a0c9cc4341e6
+  metadata.gz: b258f8a43e5eb62bb62252a165f83d092185160f719c91781b530a2ba6fbb4d79278273cbd0092776647028b61bbf47254b0ea74b1286de4ffd1fe600350153a
+  data.tar.gz: 63be0fe193880295eceb9fe630eb699f7ad89c401e61fa425137972493b118f7ea1851ac4e1445807c6d8d7bffa751e3d4bd4086aa450fa7ce473207c8557f30

data/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 4.0.21 / 2026-09-16
+
+### Enhancements:
+
+* Don't update bundler to a prerelease unless asked for one. Pull request [#9869](https://github.com/ruby/rubygems/pull/9869) by Hiroshi SHIBATA
+* Reject Bundler redirects that downgrade https to http. Pull request [#9859](https://github.com/ruby/rubygems/pull/9859) by Hiroshi SHIBATA
+
+### Bug fixes:
+
+* Support `safe.bareRepository=explicit` in git sources. Pull request [#9876](https://github.com/ruby/rubygems/pull/9876) by Hiroshi SHIBATA
+* Stop resolving locally for empty CHECKSUMS entries. Pull request [#9862](https://github.com/ruby/rubygems/pull/9862) by Hiroshi SHIBATA
+* Expand the git source gemspec path before the chdir. Pull request [#9845](https://github.com/ruby/rubygems/pull/9845) by Hiroshi SHIBATA
+
+## 4.0.20 / 2026-09-02
+
+### Enhancements:
+
+* Avoid duplicate relative path prefix in bundle exec. Pull request [#9596](https://github.com/ruby/rubygems/pull/9596) by samuel-williams-shopify
+* Follow renamed default branch in git sources. Pull request [#9813](https://github.com/ruby/rubygems/pull/9813) by hsbt
+* Bundler::Source::Git: avoid re-fetching the repo. Pull request [#9806](https://github.com/ruby/rubygems/pull/9806) by byroot
+* Show the newest out-of-cooldown version in bundle outdated. Pull request [#9803](https://github.com/ruby/rubygems/pull/9803) by hsbt
+
+### Bug fixes:
+
+* Error out when `bundle init --gemspec` gets no specification. Pull request [#9818](https://github.com/ruby/rubygems/pull/9818) by hsbt
+* Fix relative gemspec paths being expanded twice. Pull request [#9814](https://github.com/ruby/rubygems/pull/9814) by hsbt
+* Fix gemspec evaluation under Ruby::Box. Pull request [#9809](https://github.com/ruby/rubygems/pull/9809) by hsbt
+* Fix release date extraction for the current changelog header format. Pull request [#9767](https://github.com/ruby/rubygems/pull/9767) by meganemura
+* Resolve globbed entries literally in Gem::Util.glob_files_in_dir. Pull request [#9802](https://github.com/ruby/rubygems/pull/9802) by hsbt
+* Preserve native extensions during implicit clean. Pull request [#9800](https://github.com/ruby/rubygems/pull/9800) by sjh9714
+
+### Documentation:
+
+* Clarify :path expectations and cross-link platform docs in man pages. Pull request [#9724](https://github.com/ruby/rubygems/pull/9724) by hsbt
+
 ## 4.0.19 / 2026-08-20
 
 ### Enhancements:

data/bundler.gemspec

@@ -24,7 +24,7 @@ Gem::Specification.new do |s|
 
   s.metadata = {
     "bug_tracker_uri" => "https://github.com/ruby/rubygems/issues?q=is%3Aopen+is%3Aissue+label%3ABundler",
-    "changelog_uri" => "https://github.com/ruby/rubygems/blob/master/CHANGELOG-bundler.md",
+    "changelog_uri" => "https://github.com/ruby/rubygems/blob/master/CHANGELOG.md",
     "homepage_uri" => "https://bundler.io/",
     "source_code_uri" => "https://github.com/ruby/rubygems",
   }

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = nil
-    @git_commit_sha = "2d0e3df43a".freeze
+    @built_at = "2026-09-16".freeze
+    @git_commit_sha = "a15d54ed692".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/doctor/diagnose.rb

@@ -53,7 +53,7 @@ module Bundler
     end
 
     def bundles_for_gem(spec)
-      Dir.glob("#{spec.full_gem_path}/**/*.bundle")
+      SharedHelpers.glob_files_in_dir("**/*.bundle", spec.full_gem_path)
     end
 
     def lookup_with_fiddle(path)

data/lib/bundler/cli/exec.rb

@@ -23,7 +23,7 @@ module Bundler
           bin_path.delete_suffix!(".bat") if Gem.win_platform?
           kernel_load(bin_path, *args)
         else
-          bin_path = "./" + bin_path unless File.absolute_path?(bin_path)
+          bin_path = explicit_path(bin_path)
           kernel_exec(bin_path, *args)
         end
       else
@@ -71,6 +71,20 @@ module Bundler
       "#{file} #{args.join(" ")}".strip
     end
 
+    def explicit_path(path)
+      if File.absolute_path?(path) || explicit_relative_path?(path)
+        path
+      else
+        ".#{File::SEPARATOR}#{path}"
+      end
+    end
+
+    def explicit_relative_path?(path)
+      [File::SEPARATOR, File::ALT_SEPARATOR].compact.any? do |separator|
+        path.start_with?(".#{separator}", "..#{separator}")
+      end
+    end
+
     def directly_loadable?(file)
       if Gem.win_platform?
         script_wrapper?(file)

data/lib/bundler/cli/init.rb

@@ -26,6 +26,10 @@ module Bundler
         end
 
         spec = Bundler.load_gemspec_uncached(gemspec)
+        unless spec
+          Bundler.ui.error "Gem specification #{gemspec} did not produce a specification"
+          exit 1
+        end
 
         File.open(gemfile, "wb") do |file|
           file << "# Generated from #{gemspec}\n"

data/lib/bundler/cli/outdated.rb

@@ -158,11 +158,29 @@ module Bundler
 
       return active_spec if strict
 
-      active_specs = active_spec.source.specs.search(current_spec.name).select {|spec| spec.installable_on_platform?(current_spec.platform) }.sort_by(&:version)
-      if !current_spec.version.prerelease? && !options[:pre] && active_specs.size > 1
-        active_specs.delete_if {|b| b.respond_to?(:version) && b.version.prerelease? }
+      matching_specs(active_spec, current_spec).last
+    end
+
+    def matching_specs(active_spec, current_spec)
+      @matching_specs ||= {}
+      @matching_specs[[active_spec.source, current_spec.name, current_spec.platform]] ||= begin
+        active_specs = active_spec.source.specs.search(current_spec.name).select {|spec| spec.installable_on_platform?(current_spec.platform) }.sort_by(&:version)
+        if !current_spec.version.prerelease? && !options[:pre] && active_specs.size > 1
+          active_specs.delete_if {|b| b.respond_to?(:version) && b.version.prerelease? }
+        end
+        active_specs
       end
-      active_specs.last
+    end
+
+    # The newest version the cooldown setting would let bundler adopt right
+    # now, when the newest overall version is still inside the window. Only a
+    # version strictly between the installed one and the newest one is an
+    # adoptable update worth showing.
+    def newest_out_of_cooldown(active_spec, current_spec)
+      newest = matching_specs(active_spec, current_spec).reverse_each.find {|spec| cooldown_days_remaining(spec).nil? }
+      return unless newest
+      return if newest.version >= active_spec.version || newest.version <= current_spec.version
+      newest
     end
 
     def print_gems(gems_list)
@@ -208,7 +226,11 @@ module Bundler
       spec_outdated_info += ", released #{release_date}" unless release_date.empty?
 
       remaining = cooldown_days_remaining(active_spec)
-      spec_outdated_info += ", in cooldown for #{remaining} more day#{"s" if remaining > 1}" if remaining
+      if remaining
+        spec_outdated_info += ", in cooldown for #{remaining} more day#{"s" if remaining > 1}"
+        adoptable = newest_out_of_cooldown(active_spec, current_spec)
+        spec_outdated_info += ", newest out of cooldown #{adoptable.version}" if adoptable
+      end
 
       spec_outdated_info += ")"
 
@@ -227,7 +249,11 @@ module Bundler
       current_version = "#{current_spec.version}#{current_spec.git_version}"
       spec_version = "#{active_spec.version}#{active_spec.git_version}"
       remaining = cooldown_days_remaining(active_spec)
-      spec_version += " (cooldown #{remaining}d)" if remaining
+      if remaining
+        adoptable = newest_out_of_cooldown(active_spec, current_spec)
+        adoptable_note = adoptable ? ", #{adoptable.version} out of cooldown" : ""
+        spec_version += " (cooldown #{remaining}d#{adoptable_note})"
+      end
       dependency = dependency.requirement if dependency
 
       ret_val = [active_spec.name, current_version, spec_version, dependency.to_s, groups.to_s]
@@ -236,7 +262,7 @@ module Bundler
       ret_val
     end
 
-    def cooldown_days_remaining(spec, now = Time.now)
+    def cooldown_days_remaining(spec, now = cooldown_now)
       return nil unless spec.respond_to?(:created_at) && spec.created_at
       return nil unless spec.respond_to?(:remote) && spec.remote
       days = spec.remote.effective_cooldown
@@ -245,6 +271,10 @@ module Bundler
       remaining > 0 ? remaining.ceil : nil
     end
 
+    def cooldown_now
+      @cooldown_now ||= Time.now
+    end
+
     def check_for_deployment_mode!
       return unless Bundler.frozen_bundle?
       suggested_command = if Bundler.settings.locations("frozen").keys.&([:global, :local]).any?

data/lib/bundler/cli/update.rb

@@ -13,7 +13,7 @@ module Bundler
 
       update_bundler = options[:bundler]
 
-      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler) if update_bundler
+      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler, pre: options[:pre]) if update_bundler
 
       Plugin.gemfile_install(Bundler.default_gemfile) if Bundler.settings[:plugins]
 

data/lib/bundler/cli.rb

@@ -317,7 +317,7 @@ module Bundler
     method_option "source", type: :array, banner: "Update a specific source (and all gems associated with it)"
     method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "ruby", type: :boolean, banner: "Update ruby specified in Gemfile.lock"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
     method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
@@ -642,7 +642,7 @@ module Bundler
     method_option "pre", type: :boolean, banner: "If updating, always choose the highest allowed version, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"

data/lib/bundler/definition.rb

@@ -192,7 +192,7 @@ module Bundler
 
       sources.cached!
 
-      if options[:add_checksums] || (!options[:local] && install_needed?)
+      if options[:add_checksums] || (!options[:local] && (install_needed? || @locked_spec_with_empty_checksums))
         sources.remote!
         true
       else
@@ -639,7 +639,7 @@ module Bundler
         @missing_lockfile_dep ||
         @unlocking_bundler ||
         @locked_spec_with_missing_checksums ||
-        @locked_spec_with_empty_checksums ||
+        empty_checksums_actionable? ||
         @locked_spec_with_missing_deps ||
         @locked_spec_with_invalid_deps
     end
@@ -648,6 +648,16 @@ module Bundler
       unlocking? || something_changed?
     end
 
+    # Only a remote fetch can fill an empty CHECKSUMS entry, so it justifies a
+    # resolution only when one is coming. Resolving locally for it would repeat
+    # on every `Bundler.setup` without changing the lockfile. Frozen mode still
+    # has to refuse the entry.
+    def empty_checksums_actionable?
+      return false unless @locked_spec_with_empty_checksums
+
+      Bundler.frozen_bundle? || !sources.local_mode?
+    end
+
     def should_add_extra_platforms?
       !lockfile_exists? && Bundler::MatchPlatform.generic_local_platform_is_ruby? && !Bundler.settings[:force_ruby_platform]
     end

data/lib/bundler/dsl.rb

@@ -68,7 +68,7 @@ module Bundler
       development_group = opts[:development_group] || :development
       expanded_path     = gemfile_root.join(path)
 
-      gemspecs = Gem::Util.glob_files_in_dir("{,*}.gemspec", expanded_path).filter_map {|g| Bundler.load_gemspec(g) }
+      gemspecs = SharedHelpers.glob_files_in_dir("{,*}.gemspec", expanded_path).filter_map {|g| Bundler.load_gemspec(g) }
       gemspecs.reject! {|s| s.name != name } if name
       specs_by_name_and_version = gemspecs.group_by {|s| [s.name, s.version] }
 

data/lib/bundler/fetcher/downloader.rb

@@ -46,6 +46,11 @@ module Bundler
           response
         when Gem::Net::HTTPRedirection
           new_uri = Gem::URI.parse(response["location"])
+          # Following a downgrade would put the credentials this request carries
+          # on a plaintext connection, so refuse it like Gem::RemoteFetcher does.
+          if https?(uri) && !https?(new_uri)
+            raise HTTPError, "Redirecting to a non-https URI is not allowed: #{URICredentialsFilter.credential_filtered_uri(new_uri)}"
+          end
           if new_uri.host == uri.host
             new_uri.user = uri.user
             new_uri.password = uri.password
@@ -105,6 +110,10 @@ module Bundler
 
       private
 
+      def https?(uri)
+        uri.scheme&.casecmp("https")&.zero?
+      end
+
       def validate_uri_scheme!(uri)
         return if /\Ahttps?\z/.match?(uri.scheme)
         raise InvalidOption,

data/lib/bundler/gem_helper.rb

@@ -32,7 +32,7 @@ module Bundler
 
     def initialize(base = nil, name = nil)
       @base = File.expand_path(base || SharedHelpers.pwd)
-      gemspecs = name ? [File.join(@base, "#{name}.gemspec")] : Gem::Util.glob_files_in_dir("{,*}.gemspec", @base)
+      gemspecs = name ? [File.join(@base, "#{name}.gemspec")] : SharedHelpers.glob_files_in_dir("{,*}.gemspec", @base)
       raise "Unable to determine name from existing gemspec. Use :name => 'gemname' in #install_tasks to manually set it." unless gemspecs.size == 1
       @spec_path = gemspecs.first
       @gemspec = Bundler.load_gemspec(@spec_path)
@@ -124,7 +124,7 @@ module Bundler
     end
 
     def built_gem_path
-      Gem::Util.glob_files_in_dir("#{name}-*.gem", base).sort_by {|f| File.mtime(f) }.last
+      SharedHelpers.glob_files_in_dir("#{name}-*.gem", base).sort_by {|f| File.mtime(f) }.last
     end
 
     def git_push(remote = nil)

data/lib/bundler/man/bundle-lock.1

@@ -13,7 +13,7 @@ Lock the gems specified in Gemfile\.
 Ignores the existing lockfile\. Resolve then updates lockfile\. Taking a list of gems or updating all gems if no list is given\.
 .TP
 \fB\-\-bundler[=BUNDLER]\fR
-Update the locked version of bundler to the given version or the latest version if no version is given\.
+Update the locked version of bundler\. BUNDLER can be a version such as \fB4\.0\.20\fR, or a requirement such as \fB"> 0\.a"\fR\. With no argument, update to the latest released version, which never selects a prerelease\.
 .TP
 \fB\-\-local\fR
 Do not attempt to connect to \fBrubygems\.org\fR\. Instead, Bundler will use the gems already present in Rubygems' cache or in \fBvendor/cache\fR\. Note that if a appropriate platform\-specific gem exists on \fBrubygems\.org\fR it will not be found\.

data/lib/bundler/man/bundle-lock.1.ronn

@@ -33,8 +33,9 @@ Lock the gems specified in Gemfile.
   of gems or updating all gems if no list is given.
 
 * `--bundler[=BUNDLER]`:
-  Update the locked version of bundler to the given version or the latest
-  version if no version is given.
+  Update the locked version of bundler. BUNDLER can be a version such as
+  `4.0.20`, or a requirement such as `"> 0.a"`. With no argument, update to the
+  latest released version, which never selects a prerelease.
 
 * `--local`:
   Do not attempt to connect to `rubygems.org`. Instead, Bundler will use the

data/lib/bundler/man/bundle-outdated.1

@@ -55,7 +55,7 @@ Only list patch newer versions\.
 Only list gems specified in your Gemfile, not their dependencies\.
 .TP
 \fB\-\-cooldown=<number>\fR
-Annotate (rather than hide) versions that are still inside the cooldown window of \fInumber\fR days\. The prose output appends "in cooldown for Nd more days" and the table form adds "(cooldown Nd)" to the Latest column\. See \fBcooldown\fR in bundle\-config(1)\.
+Annotate (rather than hide) versions that are still inside the cooldown window of \fInumber\fR days\. The prose output appends "in cooldown for Nd more days" and the table form adds "(cooldown Nd)" to the Latest column\. When a version outside the window is newer than the installed one, the prose output also appends "newest out of cooldown X" and the table form becomes "(cooldown Nd, X out of cooldown)"\. With \fB\-\-filter\-strict\fR (or \fB\-\-patch\fR, \fB\-\-minor\fR, \fB\-\-major\fR, which imply it), "newest" is already the cooldown\-filtered resolved version, so none of these annotations appear\. See \fBcooldown\fR in bundle\-config(1)\.
 .SH "PATCH LEVEL OPTIONS"
 See bundle update(1) \fIbundle\-update\.1\.html\fR for details\.
 .SH "FILTERING OUTPUT"

data/lib/bundler/man/bundle-outdated.1.ronn

@@ -76,7 +76,13 @@ are up to date, Bundler will exit with a status of 0. Otherwise, it will exit 1.
   Annotate (rather than hide) versions that are still inside the
   cooldown window of <number> days. The prose output appends "in
   cooldown for Nd more days" and the table form adds "(cooldown Nd)" to
-  the Latest column. See `cooldown` in bundle-config(1).
+  the Latest column. When a version outside the window is newer than the
+  installed one, the prose output also appends "newest out of cooldown
+  X" and the table form becomes "(cooldown Nd, X out of cooldown)".
+  With `--filter-strict` (or `--patch`, `--minor`, `--major`, which
+  imply it), "newest" is already the cooldown-filtered resolved version,
+  so none of these annotations appear. See `cooldown` in
+  bundle-config(1).
 
 ## PATCH LEVEL OPTIONS
 

data/lib/bundler/man/bundle-platform.1

@@ -38,6 +38,8 @@ Your current platform satisfies the Ruby version requirement\.
 .IP "" 0
 .P
 \fBplatform\fR lists all the platforms in your \fBGemfile\.lock\fR as well as the \fBruby\fR directive if applicable from your Gemfile(5)\. It also lets you know if the \fBruby\fR directive requirement has been met\. If \fBruby\fR directive doesn't match the running Ruby VM, it tells you what part does not\.
+.P
+For a detailed explanation of how bundler handles platforms, see the \fBPLATFORMS\fR section in Gemfile(5)\.
 .SH "OPTIONS"
 .TP
 \fB\-\-ruby\fR
@@ -45,5 +47,7 @@ It will display the ruby directive information, so you don't have to parse it fr
 .SH "SEE ALSO"
 .IP "\(bu" 4
 bundle\-lock(1) \fIbundle\-lock\.1\.html\fR
+.IP "\(bu" 4
+Gemfile(5) \fIgemfile\.5\.html\fR
 .IP "" 0
 

data/lib/bundler/man/bundle-platform.1.ronn

@@ -38,6 +38,9 @@ If you run `bundle platform` on Ruby 3.1.2, it displays the following output:
 if the `ruby` directive requirement has been met. If `ruby` directive doesn't
 match the running Ruby VM, it tells you what part does not.
 
+For a detailed explanation of how bundler handles platforms, see the
+`PLATFORMS` section in Gemfile(5).
+
 ## OPTIONS
 
 * `--ruby`:
@@ -47,3 +50,4 @@ match the running Ruby VM, it tells you what part does not.
 ## SEE ALSO
 
 * [bundle-lock(1)](bundle-lock.1.html)
+* [Gemfile(5)](gemfile.5.html)

data/lib/bundler/man/bundle-update.1

@@ -27,7 +27,7 @@ Do not attempt to fetch gems remotely and use the gem cache instead\.
 Update the locked version of Ruby to the current version of Ruby\.
 .TP
 \fB\-\-bundler[=BUNDLER]\fR
-Update the locked version of bundler to the invoked bundler version\.
+Update the locked version of bundler\. BUNDLER can be a version such as \fB4\.0\.20\fR, or a requirement such as \fB"> 0\.a"\fR\. With no argument, update to the latest released version, which never selects a prerelease\.
 .TP
 \fB\-\-force\fR, \fB\-\-redownload\fR
 Force reinstalling every gem, even if already installed\.

data/lib/bundler/man/bundle-update.1.ronn

@@ -53,7 +53,9 @@ gem.
   Update the locked version of Ruby to the current version of Ruby.
 
 * `--bundler[=BUNDLER]`:
-  Update the locked version of bundler to the invoked bundler version.
+  Update the locked version of bundler. BUNDLER can be a version such as
+  `4.0.20`, or a requirement such as `"> 0.a"`. With no argument, update to the
+  latest released version, which never selects a prerelease.
 
 * `--force`, `--redownload`:
   Force reinstalling every gem, even if already installed.

data/lib/bundler/man/gemfile.5

@@ -392,7 +392,7 @@ gem "rails", git: "https://rails@bitbucket\.org/rails/rails\.git"
 .P
 Since the \fBbitbucket\fR method is a specialization of \fBgit_source\fR, it accepts a \fB:branch\fR named argument\.
 .SS "PATH"
-You can specify that a gem is located in a particular location on the file system\. Relative paths are resolved relative to the directory containing the \fBGemfile\fR\.
+You can specify that a gem is located in a particular location on the file system\. Relative paths are resolved relative to the directory containing the \fBGemfile\fR\. The path must point to a directory containing the gem's unpacked source code, not to a packaged \fB\.gem\fR file\.
 .P
 Similar to the semantics of the \fB:git\fR option, the \fB:path\fR option requires that the directory in question either contains a \fB\.gemspec\fR for the gem, or that you specify an explicit version that bundler should use\.
 .P

data/lib/bundler/man/gemfile.5.ronn

@@ -451,7 +451,9 @@ Since the `bitbucket` method is a specialization of `git_source`, it accepts a `
 
 You can specify that a gem is located in a particular location
 on the file system. Relative paths are resolved relative to the
-directory containing the `Gemfile`.
+directory containing the `Gemfile`. The path must point to a
+directory containing the gem's unpacked source code, not to a
+packaged `.gem` file.
 
 Similar to the semantics of the `:git` option, the `:path`
 option requires that the directory in question either contains

data/lib/bundler/runtime.rb

@@ -141,7 +141,7 @@ module Bundler
         end
       end
 
-      Gem::Util.glob_files_in_dir("*/.git", cache_path.to_s).each do |git_dir|
+      SharedHelpers.glob_files_in_dir("*/.git", cache_path.to_s).each do |git_dir|
         FileUtils.rm_rf(git_dir)
         FileUtils.touch(File.expand_path("../.bundlecache", git_dir))
       end
@@ -159,13 +159,13 @@ module Bundler
     end
 
     def clean(dry_run = false)
-      gem_bins             = Gem::Util.glob_files_in_dir("bin/*", Gem.dir)
-      git_dirs             = Gem::Util.glob_files_in_dir("bundler/gems/*", Gem.dir)
-      git_cache_dirs       = Gem::Util.glob_files_in_dir("cache/bundler/git/*", Gem.dir)
-      gem_dirs             = Gem::Util.glob_files_in_dir("gems/*", Gem.dir)
-      gem_files            = Gem::Util.glob_files_in_dir("cache/*.gem", Gem.dir)
-      gemspec_files        = Gem::Util.glob_files_in_dir("specifications/*.gemspec", Gem.dir)
-      extension_dirs       = Gem::Util.glob_files_in_dir("extensions/*/*/*", Gem.dir) + Gem::Util.glob_files_in_dir("bundler/gems/extensions/*/*/*", Gem.dir)
+      gem_bins             = SharedHelpers.glob_files_in_dir("bin/*", Gem.dir)
+      git_dirs             = SharedHelpers.glob_files_in_dir("bundler/gems/*", Gem.dir)
+      git_cache_dirs       = SharedHelpers.glob_files_in_dir("cache/bundler/git/*", Gem.dir)
+      gem_dirs             = SharedHelpers.glob_files_in_dir("gems/*", Gem.dir)
+      gem_files            = SharedHelpers.glob_files_in_dir("cache/*.gem", Gem.dir)
+      gemspec_files        = SharedHelpers.glob_files_in_dir("specifications/*.gemspec", Gem.dir)
+      extension_dirs       = SharedHelpers.glob_files_in_dir("extensions/*/*/*", Gem.dir) + SharedHelpers.glob_files_in_dir("bundler/gems/extensions/*/*/*", Gem.dir)
       spec_gem_paths       = []
       # need to keep git sources around
       spec_git_paths       = @definition.spec_git_paths
@@ -232,7 +232,7 @@ module Bundler
     private
 
     def prune_gem_cache(resolve, cache_path)
-      cached = Gem::Util.glob_files_in_dir("*.gem", cache_path.to_s)
+      cached = SharedHelpers.glob_files_in_dir("*.gem", cache_path.to_s)
 
       cached = cached.delete_if do |path|
         spec = Bundler.rubygems.spec_from_gem path
@@ -257,7 +257,7 @@ module Bundler
     end
 
     def prune_git_and_path_cache(resolve, cache_path)
-      cached = Gem::Util.glob_files_in_dir("*/.bundlecache", cache_path.to_s)
+      cached = SharedHelpers.glob_files_in_dir("*/.bundlecache", cache_path.to_s)
 
       cached = cached.delete_if do |path|
         name = File.basename(File.dirname(path))
@@ -283,7 +283,7 @@ module Bundler
       # Add man/ subdirectories from activated bundles to MANPATH for man(1)
       manuals = $LOAD_PATH.filter_map do |path|
         man_subdir = path.sub(/lib$/, "man")
-        man_subdir unless Dir.glob("man?/", base: man_subdir).empty?
+        man_subdir unless SharedHelpers.glob_files_in_dir("man?/", man_subdir).empty?
       end
 
       return if manuals.empty?

data/lib/bundler/self_manager.rb

@@ -30,8 +30,8 @@ module Bundler
       install_and_restart_with(restart_version)
     end
 
-    def update_bundler_and_restart_with_it_if_needed(target)
-      spec = resolve_update_version_from(target)
+    def update_bundler_and_restart_with_it_if_needed(target, pre: false)
+      spec = resolve_update_version_from(target, pre: pre)
       return unless spec
 
       version = spec.version
@@ -108,9 +108,9 @@ module Bundler
         lockfile_version
     end
 
-    def resolve_update_version_from(target)
+    def resolve_update_version_from(target, pre: false)
       requirement = Gem::Requirement.new(target)
-      update_candidate = find_latest_matching_spec(requirement)
+      update_candidate = find_latest_matching_spec(requirement, pre: pre)
 
       if update_candidate.nil?
         raise InvalidOption, "The `bundle update --bundler` target version (#{target}) does not exist"
@@ -137,18 +137,24 @@ module Bundler
       end
     end
 
-    def find_latest_matching_spec(requirement)
+    def find_latest_matching_spec(requirement, pre: false)
       Bundler.configure
-      local_result = find_latest_matching_spec_from_collection(local_specs, requirement)
+      # A bare `bundle update --bundler` must stay on releases, like `gem update
+      # --system`, so only `--pre` or a prerelease requirement opts into one.
+      allow_prerelease = pre || requirement.prerelease?
+
+      local_result = find_latest_matching_spec_from_collection(local_specs, requirement, allow_prerelease)
       return local_result if local_result && requirement.specific?
 
-      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement)
+      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement, allow_prerelease)
       return remote_result if local_result.nil?
 
-      [local_result, remote_result].max
+      [local_result, remote_result].compact.max
     end
 
-    def find_latest_matching_spec_from_collection(specs, requirement)
+    def find_latest_matching_spec_from_collection(specs, requirement, allow_prerelease)
+      specs = specs.reject {|spec| spec.version.prerelease? } unless allow_prerelease
+
       specs.sort.reverse_each.find {|spec| requirement.satisfied_by?(spec.version) }
     end
 

data/lib/bundler/shared_helpers.rb

@@ -231,6 +231,21 @@ module Bundler
       destination
     end
 
+    # Globs for entries matching +glob+ inside of +base_path+, returning
+    # absolute paths. Glob metacharacters in +base_path+ are not treated as
+    # part of the pattern, and matched entries are joined literally, so an
+    # entry starting with `~` is not expanded into the home directory.
+    #
+    # Bundler runs against whatever RubyGems the host provides, so this cannot
+    # delegate to Gem::Util.glob_files_in_dir, which only gained the literal
+    # join in RubyGems 4.1.
+    def glob_files_in_dir(glob, base_path)
+      expanded_path = nil
+      Dir.glob(glob, base: base_path).map! do |f|
+        File.join(expanded_path ||= File.expand_path(base_path), f)
+      end
+    end
+
     private
 
     def validate_bundle_path

data/lib/bundler/source/git/git_proxy.rb

@@ -193,7 +193,13 @@ module Bundler
             return out if status.success?
 
             if err.include?("couldn't find remote ref") || err.include?("not our ref")
-              raise MissingGitRevisionError.new(command_with_no_credentials, path, commit || explicit_ref, credential_filtered_uri)
+              default_branch = renamed_remote_default_branch if tracking_remote_default_branch?
+              if default_branch
+                out = follow_remote_default_branch(args, default_branch)
+                return out if out
+              end
+
+              raise MissingGitRevisionError.new(command_with_no_credentials, path, commit || explicit_ref || current_branch, credential_filtered_uri)
             else
               if shallow?
                 args -= depth_args
@@ -298,6 +304,61 @@ module Bundler
           branch_option || ref.nil?
         end
 
+        def tracking_remote_default_branch?
+          explicit_ref.nil? && commit.nil?
+        end
+
+        # Returns nil on any failure, leaving HEAD untouched so the caller reports
+        # the original fetch failure. Runs inside the retry block, so it must not
+        # touch the caller's command locals.
+        def follow_remote_default_branch(args, default_branch)
+          reference = "refs/heads/#{default_branch}"
+          command = fetch_command(args, "#{reference}:#{reference}")
+          check_allowed(command)
+
+          out, err, status = capture(command, path)
+          unless status.success?
+            Bundler.ui.debug "Could not fetch #{reference} from #{credential_filtered_uri}: #{err}"
+            return
+          end
+
+          previous_branch = current_branch
+          begin
+            git "symbolic-ref", "HEAD", reference, dir: path
+          rescue GitError => e
+            Bundler.ui.debug "Could not repoint the cached clone at #{reference}: #{e.message}"
+            return
+          end
+          @current_branch = nil
+          Bundler.ui.warn "#{credential_filtered_uri} no longer has #{previous_branch}, " \
+            "now following its default branch #{default_branch}"
+          out
+        end
+
+        # The cached clone's HEAD branch is gone from the remote, so the remote's
+        # own idea of its default branch is the only thing left to follow.
+        def renamed_remote_default_branch
+          default_branch = remote_default_branch
+          return if default_branch.nil? || default_branch == current_branch
+
+          default_branch
+        end
+
+        def remote_default_branch
+          command = ["ls-remote", "--symref", "--", configured_uri, "HEAD"]
+          check_allowed(command)
+
+          out, err, status = capture(command, path)
+          unless status.success?
+            Bundler.ui.debug "Could not ask #{credential_filtered_uri} for its default branch: #{err}"
+            return
+          end
+
+          # A remote is free to advertise a ref name that is not valid UTF-8, and
+          # matching that as text raises out of the GitError family.
+          out.b[%r{^ref:\s+refs/heads/(.+?)\s+HEAD}, 1]
+        end
+
         def pinned_to_full_sha?
           full_sha_revision?(ref)
         end
@@ -446,7 +507,15 @@ module Bundler
 
           return ["git", *opts, *cmd] unless dir
 
-          ["git", "-C", dir.to_s, *opts, *cmd]
+          # With safe.bareRepository=explicit, git refuses to discover a bare
+          # repository from -C, so the cache clone is named with --git-dir.
+          # Working trees, like a local override, still go through -C.
+          location = bare_repo?(dir) ? "--git-dir" : "-C"
+          ["git", location, dir.to_s, *opts, *cmd]
+        end
+
+        def bare_repo?(dir)
+          File.exist?(File.join(dir, "objects")) && File.exist?(File.join(dir, "HEAD"))
         end
 
         def extra_clone_args
@@ -465,8 +534,8 @@ module Bundler
           args
         end
 
-        def fetch_command(args)
-          ["fetch", "--force", "--quiet", "--no-tags", *args, "--", configured_uri, refspec].compact
+        def fetch_command(args, spec = refspec)
+          ["fetch", "--force", "--quiet", "--no-tags", *args, "--", configured_uri, spec].compact
         end
 
         def clone_command(args)

data/lib/bundler/source/git.rb

@@ -91,9 +91,9 @@ module Bundler
 
       def to_s
         begin
-          at = humanized_ref || current_branch
-
-          rev = "at #{at}@#{shortref_for_display(revision)}"
+          at = humanized_ref
+          at = "#{at}@" if at
+          rev = "at #{at}#{shortref_for_display(revision)}"
         rescue GitError
           ""
         end
@@ -320,7 +320,7 @@ module Bundler
 
       def serialize_gemspecs_in(destination)
         destination = destination.expand_path(Bundler.root) if destination.relative?
-        Gem::Util.glob_files_in_dir(@glob, destination.to_s).each do |spec_path|
+        SharedHelpers.glob_files_in_dir(@glob, destination.to_s).each do |spec_path|
           # Evaluate gemspecs and cache the result. Gemspecs
           # in git might require git or other dependencies.
           # The gemspecs we cache should already be evaluated.
@@ -423,10 +423,12 @@ module Bundler
       def validate_spec(_spec); end
 
       def load_gemspec(file)
-        dirname = Pathname.new(file).dirname
-        SharedHelpers.chdir(dirname.to_s) do
-          stub = Gem::StubSpecification.gemspec_stub(file, install_path.parent, install_path.parent)
-          stub.full_gem_path = dirname.expand_path(root).to_s
+        # Expand the path before the chdir below, since resolving it inside the
+        # block would base it on the gemspec directory instead of `root`.
+        gemspec_path = Pathname.new(file).expand_path(root)
+        SharedHelpers.chdir(gemspec_path.dirname.to_s) do
+          stub = Gem::StubSpecification.gemspec_stub(gemspec_path.to_s, install_path.parent, install_path.parent)
+          stub.full_gem_path = gemspec_path.dirname.to_s
           StubSpecification.from_stub(stub)
         end
       end

data/lib/bundler/source/path.rb

@@ -161,7 +161,7 @@ module Bundler
 
         if File.directory?(expanded_path)
           # We sort depth-first since `<<` will override the earlier-found specs
-          Gem::Util.glob_files_in_dir(@glob, expanded_path).sort_by {|p| -p.split(File::SEPARATOR).size }.each do |file|
+          SharedHelpers.glob_files_in_dir(@glob, expanded_path).sort_by {|p| -p.split(File::SEPARATOR).size }.each do |file|
             next unless spec = load_gemspec(file)
             spec.source = self
 

data/lib/bundler/source/rubygems.rb

@@ -406,7 +406,7 @@ module Bundler
         @cached_specs ||= begin
           idx = Index.new
 
-          Gem::Util.glob_files_in_dir("*.gem", cache_path.to_s).each do |gemfile|
+          SharedHelpers.glob_files_in_dir("*.gem", cache_path.to_s).each do |gemfile|
             s ||= Bundler.rubygems.spec_from_gem(gemfile)
             s.source = self
             idx << s

data/lib/bundler/stub_specification.rb

@@ -126,7 +126,9 @@ module Bundler
     def _remote_specification
       @_remote_specification ||= begin
         rs = stub.to_spec
-        if rs.equal?(self) # happens when to_spec gets the spec from Gem.loaded_specs
+        # Gem::StubSpecification#to_spec may return an activated specification
+        # with the same name and version from a different gem installation.
+        if rs.equal?(self) || rs.loaded_from != loaded_from
           rs = Gem::Specification.load(loaded_from)
           Bundler.rubygems.stub_set_spec(stub, rs)
         end

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.19".freeze
+  VERSION = "4.0.21".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

data/lib/bundler.rb

@@ -527,11 +527,11 @@ module Bundler
     end
 
     def load_gemspec_uncached(file, validate = false)
-      path = Pathname.new(file)
-      contents = read_file(file)
+      path = Pathname.new(file).expand_path
+      contents = read_file(path.to_s)
       spec = eval_gemspec(path, contents)
       return unless spec
-      spec.loaded_from = path.expand_path.to_s
+      spec.loaded_from = path.to_s
       Bundler.rubygems.validate(spec) if validate
       spec
     end
@@ -646,9 +646,19 @@ module Bundler
         eval_yaml_gemspec(path, contents)
       else
         # Eval the gemspec from its parent directory, because some gemspecs
-        # depend on "./" relative paths.
+        # depend on "./" relative paths. The caller expands `path` first, since
+        # expanding it here would resolve against the gemspec directory once
+        # the chdir is active.
         SharedHelpers.chdir(path.dirname.to_s) do
-          eval(contents, TOPLEVEL_BINDING.dup, path.expand_path.to_s)
+          # TOPLEVEL_BINDING always belongs to the main box, so inside a
+          # Ruby::Box use a binding from the box Bundler is loaded in, where
+          # Gem::Specification carries Bundler's own monkey patches.
+          eval_binding = if defined?(Ruby::Box) && Ruby::Box.enabled?
+            Ruby::Box.current.eval("binding")
+          else
+            TOPLEVEL_BINDING.dup
+          end
+          eval(contents, eval_binding, path.to_s)
         end
       end
     rescue ScriptError, StandardError => e

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 4.0.19
+  version: 4.0.21
 platform: ruby
 authors:
 - André Arko
@@ -384,7 +384,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/ruby/rubygems/issues?q=is%3Aopen+is%3Aissue+label%3ABundler
-  changelog_uri: https://github.com/ruby/rubygems/blob/master/CHANGELOG-bundler.md
+  changelog_uri: https://github.com/ruby/rubygems/blob/master/CHANGELOG.md
   homepage_uri: https://bundler.io/
   source_code_uri: https://github.com/ruby/rubygems
 rdoc_options: []
@@ -401,7 +401,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.4.1
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: The best way to manage your application's dependencies
 test_files: []