bundler 4.0.2 → 4.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc795eb4fad5cfda77ee10bf7d3dd7ebbd9fbbbfe243f4741d6d927d0dbc1783
-  data.tar.gz: aff16ee9ee860d6907e7861eb457b1fc469ab3d61474a2052dbee902c0109f6b
+  metadata.gz: a7aeb28bb0c73f4b19b37264af4bbf1765cf15c03d8eb511a37f2c3c6d2d0e75
+  data.tar.gz: 6a93c4c78414e37f92bc3cac9f8a35c525fa9e3aa1ffa6eda977c51e5a03c63a
 SHA512:
-  metadata.gz: 9fedd026b308dc0529dba0e6e2363f3162eca30cd4bc45d302348531eae3f10485a5142cdd2bff81b746c3538bebca71b2baf2a6f8beac320589e162fbf21de0
-  data.tar.gz: 48acb62c12160b55a8caee93ffbe77cb59bdf2164a7e3280c44bd74f2246b575d9fc31ec85c753f886d6c64896761dfcd8ad562ca10bdb782e0e81c5e524d857
+  metadata.gz: f8315a073ff7179b32c03f45b99a12bf896b703be06ad0f4c331b5ea68d6adf92b86d66bf11e43ca7a69e37121d1b652a01e3428c6136d1e86c144c16e510ed9
+  data.tar.gz: 27b056ebf450d422990e70ea3ce08aefd5ff0c8bbaf8764f18dece19da24cbe033599a3d3c60067a829fd4080ff43520a3ffe6b6d78149c668244a493c6899ed

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 4.0.4 (2026-01-15)
+
+### Enhancements:
+
+  - Validate more options for add sub-command [#5905](https://github.com/ruby/rubygems/pull/5905)
+  - Support Ruby 4.1 [#9219](https://github.com/ruby/rubygems/pull/9219)
+
+### Bug fixes:
+
+  - Fix dependency source bug in bundler [#9213](https://github.com/ruby/rubygems/pull/9213)
+  - Retain current bundler version on `bundle clean` [#9221](https://github.com/ruby/rubygems/pull/9221)
+
+## 4.0.3 (2025-12-23)
+
+### Enhancements:
+
+  - Fall back to ruby platform gem when precompiled variant is incompatible [#9211](https://github.com/ruby/rubygems/pull/9211)
+
 ## 4.0.2 (2025-12-17)
 
 ### Enhancements:

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2025-12-17".freeze
-    @git_commit_sha = "03359f8b08".freeze
+    @built_at = "2026-01-15".freeze
+    @git_commit_sha = "49e812f884".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/add.rb

@@ -36,6 +36,16 @@ module Bundler
     end
 
     def validate_options!
+      raise InvalidOption, "You cannot specify `--git` and `--github` at the same time." if options["git"] && options["github"]
+
+      unless options["git"] || options["github"]
+        raise InvalidOption, "You cannot specify `--branch` unless `--git` or `--github` is specified." if options["branch"]
+
+        raise InvalidOption, "You cannot specify `--ref` unless `--git` or `--github` is specified." if options["ref"]
+      end
+
+      raise InvalidOption, "You cannot specify `--branch` and `--ref` at the same time." if options["branch"] && options["ref"]
+
       raise InvalidOption, "You cannot specify `--strict` and `--optimistic` at the same time." if options[:strict] && options[:optimistic]
 
       # raise error when no gems are specified

data/lib/bundler/current_ruby.rb

@@ -11,7 +11,7 @@ module Bundler
   end
 
   class CurrentRuby
-    ALL_RUBY_VERSIONS = [*18..27, *30..34, 40].freeze
+    ALL_RUBY_VERSIONS = [*18..27, *30..34, *40..41].freeze
     KNOWN_MINOR_VERSIONS = ALL_RUBY_VERSIONS.map {|v| v.digits.reverse.join(".") }.freeze
     KNOWN_MAJOR_VERSIONS = ALL_RUBY_VERSIONS.map {|v| v.digits.last.to_s }.uniq.freeze
     PLATFORM_MAP = {

data/lib/bundler/definition.rb

@@ -1066,7 +1066,22 @@ module Bundler
 
           deps << dep if !replacement_source || lockfile_source.include?(replacement_source) || new_deps.include?(dep)
         else
-          replacement_source = sources.get(lockfile_source)
+          parent_dep = @dependencies.find do |d|
+            next unless d.source && d.source != lockfile_source
+            next if d.source.is_a?(Source::Gemspec)
+
+            parent_locked_specs = @originally_locked_specs[d.name]
+
+            parent_locked_specs.any? do |parent_spec|
+              parent_spec.runtime_dependencies.any? {|rd| rd.name == s.name }
+            end
+          end
+
+          if parent_dep
+            replacement_source = parent_dep.source
+          else
+            replacement_source = sources.get(lockfile_source)
+          end
         end
 
         # Replace the locked dependency's source with the equivalent source from the Gemfile

data/lib/bundler/lazy_specification.rb

@@ -138,24 +138,16 @@ module Bundler
       source.local!
 
       if use_exact_resolved_specifications?
-        materialize(self) do |matching_specs|
-          choose_compatible(matching_specs)
-        end
-      else
-        materialize([name, version]) do |matching_specs|
-          target_platform = source.is_a?(Source::Path) ? platform : Bundler.local_platform
-
-          installable_candidates = MatchPlatform.select_best_platform_match(matching_specs, target_platform)
-
-          specification = choose_compatible(installable_candidates, fallback_to_non_installable: false)
-          return specification unless specification.nil?
+        spec = materialize(self) {|specs| choose_compatible(specs, fallback_to_non_installable: false) }
+        return spec if spec
 
-          if target_platform != platform
-            installable_candidates = MatchPlatform.select_best_platform_match(matching_specs, platform)
-          end
-
-          choose_compatible(installable_candidates)
+        # Exact spec is incompatible; in frozen mode, try to find a compatible platform variant
+        # In non-frozen mode, return nil to trigger re-resolution and lockfile update
+        if Bundler.frozen_bundle?
+          materialize([name, version]) {|specs| resolve_best_platform(specs) }
         end
+      else
+        materialize([name, version]) {|specs| resolve_best_platform(specs) }
       end
     end
 
@@ -190,6 +182,39 @@ module Bundler
       !source.is_a?(Source::Path) && ruby_platform_materializes_to_ruby_platform?
     end
 
+    # Try platforms in order of preference until finding a compatible spec.
+    # Used for legacy lockfiles and as a fallback when the exact locked spec
+    # is incompatible. Falls back to frozen bundle behavior if none match.
+    def resolve_best_platform(specs)
+      find_compatible_platform_spec(specs) || frozen_bundle_fallback(specs)
+    end
+
+    def find_compatible_platform_spec(specs)
+      candidate_platforms.each do |plat|
+        candidates = MatchPlatform.select_best_platform_match(specs, plat)
+        spec = choose_compatible(candidates, fallback_to_non_installable: false)
+        return spec if spec
+      end
+      nil
+    end
+
+    # Platforms to try in order of preference. Ruby platform is last since it
+    # requires compilation, but works when precompiled gems are incompatible.
+    def candidate_platforms
+      target = source.is_a?(Source::Path) ? platform : Bundler.local_platform
+      [target, platform, Gem::Platform::RUBY].uniq
+    end
+
+    # In frozen mode, accept any candidate. Will error at install time.
+    # When target differs from locked platform, prefer locked platform's candidates
+    # to preserve lockfile integrity.
+    def frozen_bundle_fallback(specs)
+      target = source.is_a?(Source::Path) ? platform : Bundler.local_platform
+      fallback_platform = target == platform ? target : platform
+      candidates = MatchPlatform.select_best_platform_match(specs, fallback_platform)
+      choose_compatible(candidates)
+    end
+
     def ruby_platform_materializes_to_ruby_platform?
       generic_platform = Bundler.generic_local_platform == Gem::Platform::JAVA ? Gem::Platform::JAVA : Gem::Platform::RUBY
 

data/lib/bundler/rubygems_integration.rb

@@ -432,7 +432,7 @@ module Bundler
     end
 
     def find_bundler(version)
-      find_name("bundler").find {|s| s.version.to_s == version }
+      find_name("bundler").find {|s| s.version.to_s == version.to_s }
     end
 
     def find_name(name)

data/lib/bundler/runtime.rb

@@ -174,7 +174,14 @@ module Bundler
       spec_cache_paths     = []
       spec_gemspec_paths   = []
       spec_extension_paths = []
-      Bundler.rubygems.add_default_gems_to(specs).values.each do |spec|
+      specs_to_keep = Bundler.rubygems.add_default_gems_to(specs).values
+
+      current_bundler = Bundler.rubygems.find_bundler(Bundler.gem_version)
+      if current_bundler
+        specs_to_keep << current_bundler
+      end
+
+      specs_to_keep.each do |spec|
         spec_gem_paths << spec.full_gem_path
         # need to check here in case gems are nested like for the rails git repo
         md = %r{(.+bundler/gems/.+-[a-f0-9]{7,12})}.match(spec.full_gem_path)

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.2".freeze
+  VERSION = "4.0.4".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 4.0.2
+  version: 4.0.4
 platform: ruby
 authors:
 - André Arko