bundler 4.0.21 → 4.0.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: afa0c2897b3ab6a8ffbfaacf1d1bb51e2a44a994735b2db990b39f988d44d9fe
-  data.tar.gz: 81b0134db390637dffbd6bc61554fec61813c06fb5db8e87a8b3b53fa1f880ca
+  metadata.gz: ce74f459384799eda3343da15c0d6bf655b5fcf2187e2ddaf1b3147aebfea1de
+  data.tar.gz: 6db3f22f6acb9d79523eb10d02f09e813d38c966e8453b6b8a4ee2ab7cf9fb68
 SHA512:
-  metadata.gz: b258f8a43e5eb62bb62252a165f83d092185160f719c91781b530a2ba6fbb4d79278273cbd0092776647028b61bbf47254b0ea74b1286de4ffd1fe600350153a
-  data.tar.gz: 63be0fe193880295eceb9fe630eb699f7ad89c401e61fa425137972493b118f7ea1851ac4e1445807c6d8d7bffa751e3d4bd4086aa450fa7ce473207c8557f30
+  metadata.gz: d3f31182a84dc873e148b3ea4c8bd2e4fde0abc5bc5a116ea99f76519a55680fc41bf3f801bcd83055d084dd6f766ecd40d02b6afe8f51e68edf553bbbe90f99
+  data.tar.gz: c34dc9b81612b1e6a23947545c089c40e03d2fdd8e5111dd04701c992b90d7cd5fd8f6fd0564ac340d961ab9bb030cdbfa81e44a9d2178ce3316c1d19ea07ffc

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 4.0.22 / 2026-09-30
+
+### Enhancements:
+
+* Report the effective platform in `bundle platform`. Pull request [#9898](https://github.com/ruby/rubygems/pull/9898) by Islam Elsayed
+* Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
+* Update Magnus version in Rust extension gem template. Pull request [#9904](https://github.com/ruby/rubygems/pull/9904) by Mat Sadler and Hiroshi SHIBATA
+
+### Bug fixes:
+
+* Stop `Bundler.bin_path` creating the directory it reports. Pull request [#9887](https://github.com/ruby/rubygems/pull/9887) by Islam Elsayed and Hiroshi SHIBATA
+* Look up `bundler-<command>` executables only in PATH. Pull request [#9874](https://github.com/ruby/rubygems/pull/9874) by Hiroshi SHIBATA
+
+### Documentation:
+
+* Describe `--major` as preferring the latest major version. Pull request [#9891](https://github.com/ruby/rubygems/pull/9891) by Hiroshi SHIBATA
+
 ## 4.0.21 / 2026-09-16
 
 ### Enhancements:

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-09-16".freeze
-    @git_commit_sha = "a15d54ed692".freeze
+    @built_at = "2026-09-30".freeze
+    @git_commit_sha = "ff2bd50".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/platform.rb

@@ -25,7 +25,7 @@ module Bundler
       else
         platforms = Bundler.definition.platforms.map {|p| "* #{p}" }
 
-        output << "Your platform is: #{Gem::Platform.local}"
+        output << platform_info
         output << "Your app has gems that work on these platforms:\n#{platforms.join("\n")}"
 
         if ruby_version
@@ -44,5 +44,19 @@ module Bundler
 
       Bundler.ui.info output.join("\n\n")
     end
+
+    private
+
+    def platform_info
+      info = "Your platform is: #{Gem::Platform.local}"
+      return info if Bundler.local_platform == Gem::Platform.local
+
+      info + "\nHowever, your effective platform is: #{Bundler.local_platform} " \
+        "(because force_ruby_platform is #{force_ruby_platform_origin})"
+    end
+
+    def force_ruby_platform_origin
+      Bundler.settings.pretty_values_for(:force_ruby_platform).first.sub(/\ASet /, "set ")
+    end
   end
 end

data/lib/bundler/cli.rb

@@ -177,7 +177,7 @@ module Bundler
         else
           puts File.read("#{man_path}/#{File.basename(man_page)}.ronn")
         end
-      elsif command_path = Bundler.which("bundler-#{cli}")
+      elsif command_path = self.class.bundler_command_path(cli)
         Kernel.exec(command_path, "--help")
       else
         super
@@ -189,11 +189,23 @@ module Bundler
         return Bundler::Plugin.exec_command(command, ARGV[1..-1])
       end
 
-      return super unless command_path = Bundler.which("bundler-#{command}")
+      return super unless command_path = bundler_command_path(command)
 
       Kernel.exec(command_path, *ARGV[1..-1])
     end
 
+    # Only PATH is searched, unlike Bundler.which, which also finds a file in
+    # the current directory and returns a bare name that Kernel.exec cannot run.
+    def self.bundler_command_path(command)
+      ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |path|
+        path = path[1..-2] if path.start_with?('"') && path.end_with?('"')
+        command_path = Bundler.find_executable(File.expand_path("bundler-#{command}", path))
+        return command_path if command_path
+      end
+
+      nil
+    end
+
     desc "init [OPTIONS]", "Generates a Gemfile into the current working directory"
     long_desc <<-D
       Init generates a default Gemfile in the current working directory. When adding a
@@ -320,7 +332,7 @@ module Bundler
     method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "Always choose the highest allowed version when updating gems, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "Do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "Use bundle install conservative update behavior and do not allow shared dependencies to be updated."
@@ -431,7 +443,7 @@ module Bundler
     method_option "filter-strict", type: :boolean, aliases: "--strict", banner: "Only list newer versions allowed by your Gemfile requirements"
     method_option "update-strict", type: :boolean, banner: "Strict conservative resolution, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "filter-major", type: :boolean, banner: "Only list major newer versions"
     method_option "filter-minor", type: :boolean, banner: "Only list minor newer versions"
@@ -638,7 +650,7 @@ module Bundler
     method_option "normalize-platforms", type: :boolean, default: false, banner: "Normalize lockfile platforms"
     method_option "patch", type: :boolean, banner: "If updating, prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "If updating, prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "If updating, prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "If updating, prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "If updating, always choose the highest allowed version, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"

data/lib/bundler/fetcher/downloader.rb

@@ -51,7 +51,7 @@ module Bundler
           if https?(uri) && !https?(new_uri)
             raise HTTPError, "Redirecting to a non-https URI is not allowed: #{URICredentialsFilter.credential_filtered_uri(new_uri)}"
           end
-          if new_uri.host == uri.host
+          if [new_uri.scheme, new_uri.host, new_uri.port] == [uri.scheme, uri.host, uri.port]
             new_uri.user = uri.user
             new_uri.password = uri.password
           end

data/lib/bundler/installer.rb

@@ -127,6 +127,8 @@ module Bundler
       template_path = File.expand_path("templates/Executable", __dir__)
       template = File.read(template_path)
 
+      Bundler.mkdir_p(bin_path)
+
       exists = []
       spec.executables.each do |executable|
         binstub_path = "#{bin_path}/#{executable}"
@@ -173,6 +175,8 @@ module Bundler
       ruby_command = Thor::Util.ruby_command
       ruby_command = ruby_command
 
+      Bundler.mkdir_p(bin_path)
+
       spec.executables.each do |executable|
         next if executable == "bundle"
         executable_path = Pathname(spec.full_gem_path).join(spec.bindir, executable).relative_path_from(bin_path)

data/lib/bundler/man/bundle-lock.1

@@ -49,7 +49,7 @@ If updating, prefer updating only to next patch version\.
 If updating, prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-If updating, prefer updating to next major version (default)\.
+If updating, prefer updating to latest major version (default)\.
 .TP
 \fB\-\-pre\fR
 If updating, always choose the highest allowed version, regardless of prerelease status\.

data/lib/bundler/man/bundle-lock.1.ronn

@@ -75,7 +75,7 @@ Lock the gems specified in Gemfile.
   If updating, prefer updating only to next minor version.
 
 * `--major`:
-  If updating, prefer updating to next major version (default).
+  If updating, prefer updating to latest major version (default).
 
 * `--pre`:
   If updating, always choose the highest allowed version, regardless of prerelease status.

data/lib/bundler/man/bundle-outdated.1

@@ -37,7 +37,7 @@ List gems organized by groups\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-patch\fR
 Prefer updating only to next patch version\.

data/lib/bundler/man/bundle-outdated.1.ronn

@@ -55,7 +55,7 @@ are up to date, Bundler will exit with a status of 0. Otherwise, it will exit 1.
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--patch`:
   Prefer updating only to next patch version.

data/lib/bundler/man/bundle-update.1

@@ -54,7 +54,7 @@ Prefer updating only to next patch version\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-pre\fR
 Always choose the highest allowed version, regardless of prerelease status\.
@@ -175,7 +175,7 @@ Prefer updating only to next patch version\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-strict\fR
 Do not allow any gem to be updated past latest \fB\-\-patch\fR | \fB\-\-minor\fR | \fB\-\-major\fR\.

data/lib/bundler/man/bundle-update.1.ronn

@@ -83,7 +83,7 @@ gem.
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--pre`:
   Always choose the highest allowed version, regardless of prerelease status.
@@ -238,7 +238,7 @@ versions are resolved. One of the following options can be used: `--patch`,
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--strict`:
   Do not allow any gem to be updated past latest `--patch` | `--minor` | `--major`.

data/lib/bundler/templates/newgem/ext/newgem/Cargo.toml.tt

@@ -12,7 +12,7 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-magnus = { version = "0.8.2" }
+magnus = { version = "0.9" }
 rb-sys = { version = "0.9", features = ["stable-api-compiled-fallback"] }
 
 [build-dependencies]

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.21".freeze
+  VERSION = "4.0.22".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

data/lib/bundler.rb

@@ -119,9 +119,7 @@ module Bundler
     def bin_path
       @bin_path ||= begin
         path = Bundler.settings[:bin] || "bin"
-        path = Pathname.new(path).expand_path(root).expand_path
-        mkdir_p(path)
-        path
+        Pathname.new(path).expand_path(root).expand_path
       end
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 4.0.21
+  version: 4.0.22
 platform: ruby
 authors:
 - André Arko