bundler 4.0.21 → 4.1.0.beta1

data/lib/bundler/man/gemfile.5.ronn

@@ -562,6 +562,59 @@ call.
 This can be useful to run tests against multiple combinations of dependencies,
 or to load per-developer gems from an untracked gemfile.
 
+## OVERRIDE
+
+The `override` directive rewrites a constraint on another gem before
+resolution runs. It targets the common case where an upstream gem's
+published metadata is too narrow on the current project's machine -- a stale
+upper bound, an unwanted floor, or a transitive pin that has to be lifted.
+
+    override <target>, <field>: <operation>
+
+`<target>` is a gem name string or `:all`. `<field>` is one of `version:`,
+`required_ruby_version:`, or `required_rubygems_version:`. `<operation>` is
+one of:
+
+  * a version requirement string (e.g. `">= 8.0"`), which **replaces** the
+    target's requirement absolutely. The original requirement, both direct
+    and transitive, is discarded in favour of the override.
+  * `:ignore_upper`, which removes upper-bound operators (`<` and `<=`) from
+    the existing requirement and folds `~>` into its lower bound (`~> 1.5`
+    becomes `>= 1.5`). Other operators, including `!=`, are preserved.
+  * `nil`, which collapses the requirement to `>= 0` (no constraint at all).
+
+`:all` only applies to `required_ruby_version:` and `required_rubygems_version:`.
+A per-gem override on the same field takes precedence over an `:all` override.
+`:all + version:` is rejected: version requirements only make sense per gem.
+
+Multiple `override` calls for distinct targets are allowed; declaring the
+same `target` and `field` twice is an error.
+
+    source "https://rubygems.org"
+
+    # Force every reference to "rails" -- direct or transitive -- to >= 8.0.
+    override "rails", version: ">= 8.0"
+
+    # Strip the upper bound on nokogiri.
+    override "nokogiri", version: :ignore_upper
+
+    # Drop the version pin on legacy entirely.
+    override "legacy", version: nil
+
+    # Loosen every gem's required_ruby_version upper bound.
+    override :all, required_ruby_version: :ignore_upper
+
+    # Override one specific gem's required_rubygems_version.
+    override "tricky", required_rubygems_version: nil
+
+    gem "rails", "~> 7.0"
+
+The override only affects resolution and the install-time Ruby/RubyGems
+compatibility checks; `Gemfile.lock` continues to reflect the resolved
+versions, not the rewritten requirements. When resolution still fails,
+Bundler appends the active overrides (with their Gemfile location) to the
+error message so it is clear which override shaped the constraint set.
+
 ## SOURCE PRIORITY
 
 When attempting to locate a gem to satisfy a gem requirement,

data/lib/bundler/match_metadata.rb

@@ -14,6 +14,18 @@ module Bundler
       @required_rubygems_version.satisfied_by?(Gem.rubygems_version)
     end
 
+    def matches_current_metadata_with_overrides?(overrides)
+      matches_current_ruby_with_overrides?(overrides) && matches_current_rubygems_with_overrides?(overrides)
+    end
+
+    def matches_current_ruby_with_overrides?(overrides)
+      effective_required_version(@required_ruby_version, :required_ruby_version, overrides).satisfied_by?(Gem.ruby_version)
+    end
+
+    def matches_current_rubygems_with_overrides?(overrides)
+      effective_required_version(@required_rubygems_version, :required_rubygems_version, overrides).satisfied_by?(Gem.rubygems_version)
+    end
+
     def expanded_dependencies
       runtime_dependencies + [
         metadata_dependency("Ruby", @required_ruby_version),
@@ -26,5 +38,13 @@ module Bundler
 
       Gem::Dependency.new("#{name}\0", requirement)
     end
+
+    private
+
+    def effective_required_version(requirement, field, overrides)
+      return requirement if overrides.nil? || overrides.empty?
+      override = Override.find_for(overrides, name, field)
+      override ? override.apply_to(requirement) : requirement
+    end
   end
 end

data/lib/bundler/match_platform.rb

@@ -2,6 +2,10 @@
 
 module Bundler
   module MatchPlatform
+    def content_address
+      nil
+    end
+
     def installable_on_platform?(target_platform) # :nodoc:
       return true if [Gem::Platform::RUBY, nil, target_platform].include?(platform)
       return true if Gem::Platform.new(platform) === target_platform
@@ -11,13 +15,32 @@ module Bundler
 
     def self.select_best_platform_match(specs, platform, force_ruby: false, prefer_locked: false)
       matching = select_all_platform_match(specs, platform, force_ruby: force_ruby, prefer_locked: prefer_locked)
+      matching = prefer_content_addressable(matching)
 
       Gem::Platform.sort_and_filter_best_platform_match(matching, platform)
     end
 
-    def self.select_best_local_platform_match(specs, force_ruby: false)
+    def self.select_all_content_address_match(specs, content_address)
+      return specs unless Gem::ContentAddress.match?(content_address)
+
+      specs.select {|spec| spec.content_address == content_address }
+    end
+
+    def self.prefer_content_addressable(matching)
+      addressable, non_addressable = matching.partition {|s| Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false) }
+      return matching if addressable.empty?
+
+      compatible = addressable.select(&:matches_current_metadata?)
+      return compatible if compatible.any?
+
+      non_addressable.any? ? non_addressable : matching
+    end
+
+    def self.select_best_local_platform_match(specs, force_ruby: false, locked_platforms: nil)
       local = Bundler.local_platform
-      matching = select_all_platform_match(specs, local, force_ruby: force_ruby).filter_map(&:materialized_for_installation)
+      matching = select_all_platform_match(specs, local, force_ruby: force_ruby)
+      matching = matching.filter_map {|spec| spec.materialized_for_installation(locked_platforms) }
+      matching = prefer_content_addressable(matching)
 
       Gem::Platform.sort_best_platform_match(matching, local)
     end

data/lib/bundler/match_remote_metadata.rb

@@ -6,19 +6,34 @@ module Bundler
     # API didn't include that field, so some marshalled specs in the index have it
     # set to +nil+.
     def matches_current_ruby?
-      @required_ruby_version ||= _remote_specification.required_ruby_version || Gem::Requirement.default
-
+      ensure_required_ruby_version_loaded
       super
     end
 
     def matches_current_rubygems?
-      # A fallback is included because the original version of the specification
-      # API didn't include that field, so some marshalled specs in the index have it
-      # set to +nil+.
-      @required_rubygems_version ||= _remote_specification.required_rubygems_version || Gem::Requirement.default
+      ensure_required_rubygems_version_loaded
+      super
+    end
+
+    def matches_current_ruby_with_overrides?(overrides)
+      ensure_required_ruby_version_loaded
+      super
+    end
 
+    def matches_current_rubygems_with_overrides?(overrides)
+      ensure_required_rubygems_version_loaded
       super
     end
+
+    private
+
+    def ensure_required_ruby_version_loaded
+      @required_ruby_version ||= _remote_specification.required_ruby_version || Gem::Requirement.default # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    def ensure_required_rubygems_version_loaded
+      @required_rubygems_version ||= _remote_specification.required_rubygems_version || Gem::Requirement.default # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
   end
 
   module MatchRemoteMetadata

data/lib/bundler/materialization.rb

@@ -12,6 +12,7 @@ module Bundler
       @dep = dep
       @platform = platform
       @candidates = candidates
+      @locked_platforms = candidates&.map(&:platform)
     end
 
     def complete?
@@ -24,7 +25,7 @@ module Bundler
       elsif platform
         MatchPlatform.select_best_platform_match(@candidates, platform, force_ruby: dep.force_ruby_platform)
       else
-        MatchPlatform.select_best_local_platform_match(@candidates, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform)
+        MatchPlatform.select_best_local_platform_match(@candidates, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform, locked_platforms: @locked_platforms)
       end
     end
 

data/lib/bundler/override.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Bundler
+  class Override
+    UPPER_BOUND_OPERATORS = ["<", "<="].freeze
+
+    def self.find_for(overrides, name, field)
+      overrides.find {|o| o.target == name && o.field == field } ||
+        overrides.find {|o| o.target == :all && o.field == field }
+    end
+
+    # Attach the given overrides onto every LazySpecification in `specs` so
+    # downstream consumers (LazySpecification#choose_compatible, the install-
+    # time compatibility check, etc.) can read the override list off the spec
+    # itself. Non-LazySpec entries (StubSpecification, Gem::Specification, ...)
+    # are left untouched.
+    def self.attach(specs, overrides)
+      return if overrides.nil? || overrides.empty?
+      specs.each {|s| s.overrides = overrides if s.is_a?(LazySpecification) }
+    end
+
+    attr_reader :target, :field, :operation, :source_location
+
+    def initialize(target, field, operation, source_location: nil)
+      @target = target
+      @field = field
+      @operation = operation
+      @source_location = source_location
+    end
+
+    def source_location_label
+      return nil unless @source_location
+      "#{File.basename(@source_location.path)}:#{@source_location.lineno}"
+    end
+
+    def apply_to(requirement)
+      case operation
+      when nil
+        Gem::Requirement.default
+      when :ignore_upper
+        remove_upper_bounds(requirement)
+      when String
+        Gem::Requirement.new(operation)
+      else
+        raise ArgumentError, "unsupported override operation: #{operation.inspect}"
+      end
+    end
+
+    private
+
+    def remove_upper_bounds(requirement)
+      return Gem::Requirement.default if requirement.nil? || requirement.none?
+
+      preserved = requirement.requirements.filter_map do |op, version|
+        if UPPER_BOUND_OPERATORS.include?(op)
+          nil
+        elsif op == "~>"
+          [">=", version]
+        else
+          [op, version]
+        end
+      end
+
+      return Gem::Requirement.default if preserved.empty?
+
+      Gem::Requirement.new(preserved.map {|op, v| "#{op} #{v}" })
+    end
+  end
+end

data/lib/bundler/plugin/dsl.rb

@@ -5,12 +5,11 @@ module Bundler
     # Dsl to parse the Gemfile looking for plugins to install
     class DSL < Bundler::Dsl
       class PluginGemfileError < PluginError; end
-      alias_method :_gem, :gem # To use for plugin installation as gem
 
       # So that we don't have to override all there methods to dummy ones
       # explicitly.
       # They will be handled by method_missing
-      [:gemspec, :gem, :install_if, :platforms, :env].each {|m| undef_method m }
+      [:gemspec, :install_if, :platforms, :env].each {|m| undef_method m }
 
       # This lists the plugins that was added automatically and not specified by
       # the user.
@@ -24,12 +23,11 @@ module Bundler
 
       def initialize
         super
-        @sources = Plugin::SourceList.new
         @inferred_plugins = [] # The source plugins inferred from :type
       end
 
-      def plugin(name, *args)
-        _gem(name, *args)
+      def gem(*args)
+        # Ignore regular dependencies when doing the plugins-only pre-parse
       end
 
       def method_missing(name, *args)

data/lib/bundler/plugin/events.rb

@@ -30,6 +30,54 @@ module Bundler
         @events.key?(event)
       end
 
+      # @!parse
+      #   A hook called before the Gemfile is evaluated
+      #   Includes the Gemfile path and the Lockfile path
+      #   GEM_BEFORE_EVAL = "before-eval"
+      define :GEM_BEFORE_EVAL, "before-eval"
+
+      # @!parse
+      #   A hook called after the Gemfile is evaluated
+      #   Includes a Bundler::Definition
+      #   GEM_AFTER_EVAL = "after-eval"
+      define :GEM_AFTER_EVAL, "after-eval"
+
+      # @!parse
+      #   A hook called before any gems install
+      #   Includes an Array of Bundler::Dependency objects
+      #   GEM_BEFORE_INSTALL_ALL = "before-install-all"
+      define :GEM_BEFORE_INSTALL_ALL, "before-install-all"
+
+      # @!parse
+      #   A hook called before each individual gem is downloaded from a remote source.
+      #   Includes a spec-like object responding to the Gem::Specification API
+      #   (for example, a Bundler spec proxy such as Bundler::EndpointSpecification
+      #   or Bundler::RemoteSpecification). Does not fire when the gem is already
+      #   present at the initial download-cache check.
+      #   GEM_BEFORE_FETCH = "before-fetch"
+      define :GEM_BEFORE_FETCH, "before-fetch"
+
+      # @!parse
+      #   A hook called after each individual gem is downloaded from a remote source.
+      #   Includes a spec-like object responding to the Gem::Specification API
+      #   (for example, a Bundler spec proxy such as Bundler::EndpointSpecification
+      #   or Bundler::RemoteSpecification). Does not fire when the gem is already
+      #   present at the initial download-cache check.
+      #   GEM_AFTER_FETCH = "after-fetch"
+      define :GEM_AFTER_FETCH, "after-fetch"
+
+      # @!parse
+      #   A hook called before a git source is fetched or checked out.
+      #   Includes a Bundler::Source::Git reference.
+      #   GIT_BEFORE_FETCH = "before-git-fetch"
+      define :GIT_BEFORE_FETCH, "before-git-fetch"
+
+      # @!parse
+      #   A hook called after a git source is fetched or checked out.
+      #   Includes a Bundler::Source::Git reference.
+      #   GIT_AFTER_FETCH = "after-git-fetch"
+      define :GIT_AFTER_FETCH, "after-git-fetch"
+
       # @!parse
       #   A hook called before each individual gem is installed
       #   Includes a Bundler::ParallelInstaller::SpecInstallation.
@@ -45,18 +93,18 @@ module Bundler
       #   GEM_AFTER_INSTALL = "after-install"
       define :GEM_AFTER_INSTALL,  "after-install"
 
-      # @!parse
-      #   A hook called before any gems install
-      #   Includes an Array of Bundler::Dependency objects
-      #   GEM_BEFORE_INSTALL_ALL = "before-install-all"
-      define :GEM_BEFORE_INSTALL_ALL, "before-install-all"
-
       # @!parse
       #   A hook called after any gems install
       #   Includes an Array of Bundler::Dependency objects
       #   GEM_AFTER_INSTALL_ALL = "after-install-all"
       define :GEM_AFTER_INSTALL_ALL,  "after-install-all"
 
+      # @!parse
+      #   A hook called before any gems require
+      #   Includes an Array of Bundler::Dependency objects.
+      #   GEM_BEFORE_REQUIRE_ALL = "before-require-all"
+      define :GEM_BEFORE_REQUIRE_ALL, "before-require-all"
+
       # @!parse
       #   A hook called before each individual gem is required
       #   Includes a Bundler::Dependency.
@@ -69,17 +117,11 @@ module Bundler
       #   GEM_AFTER_REQUIRE = "after-require"
       define :GEM_AFTER_REQUIRE,  "after-require"
 
-      # @!parse
-      #   A hook called before any gems require
-      #   Includes an Array of Bundler::Dependency objects.
-      #   GEM_BEFORE_REQUIRE_ALL = "before-require-all"
-      define :GEM_BEFORE_REQUIRE_ALL, "before-require-all"
-
       # @!parse
       #   A hook called after all gems required
       #   Includes an Array of Bundler::Dependency objects.
       #   GEM_AFTER_REQUIRE_ALL = "after-require-all"
-      define :GEM_AFTER_REQUIRE_ALL,  "after-require-all"
+      define :GEM_AFTER_REQUIRE_ALL, "after-require-all"
     end
   end
 end

data/lib/bundler/plugin/index.rb

@@ -163,20 +163,28 @@ module Bundler
       # @param [Pathname] index file path
       # @param [Boolean] is the index file global index
       def load_index(index_file, global = false)
+        base = base_for_index(global)
+
         SharedHelpers.filesystem_access(index_file, :read) do |index_f|
           valid_file = index_f&.exist? && !index_f.size.zero?
           break unless valid_file
 
           data = index_f.read
 
-          require_relative "../yaml_serializer"
-          index = YAMLSerializer.load(data)
+          require "rubygems/yaml_serializer"
+          # Empty sections load as nil, e.g. from index files written by
+          # older Bundler versions, which dumped empty hashes as a bare key.
+          index = Gem::YAMLSerializer.load(data) || {}
+
+          escaping = escaping_plugins(index, base)
+          hooks = (index["hooks"] || {}).transform_values {|names| Array(names) - escaping }
 
-          @commands.merge!(index["commands"])
-          @hooks.merge!(index["hooks"])
-          @load_paths.merge!(index["load_paths"])
-          @plugin_paths.merge!(index["plugin_paths"])
-          @sources.merge!(index["sources"]) unless global
+          @commands.merge!(owned_by(index["commands"] || {}, escaping))
+          # An event whose plugins all escaped is left out rather than merged in empty.
+          @hooks.merge!(hooks.reject {|_, names| names.empty? })
+          @load_paths.merge!(named(transform_index_paths(index["load_paths"]) {|p| absolutize_path(p, base) }, escaping))
+          @plugin_paths.merge!(named(transform_index_paths(index["plugin_paths"]) {|p| absolutize_path(p, base) }, escaping))
+          @sources.merge!(owned_by(index["sources"] || {}, escaping)) unless global
         end
       end
 
@@ -184,20 +192,88 @@ module Bundler
       # instance variables in YAML format. (The instance variables are supposed
       # to be only String key value pairs)
       def save_index
+        base = base_for_index(false)
+
         index = {
           "commands" => @commands,
           "hooks" => @hooks,
-          "load_paths" => @load_paths,
-          "plugin_paths" => @plugin_paths,
+          "load_paths" => transform_index_paths(@load_paths) {|p| relativize_path(p, base) },
+          "plugin_paths" => transform_index_paths(@plugin_paths) {|p| relativize_path(p, base) },
           "sources" => @sources,
         }
 
-        require_relative "../yaml_serializer"
+        require "rubygems/yaml_serializer"
         SharedHelpers.filesystem_access(index_file) do |index_f|
           FileUtils.mkdir_p(index_f.dirname)
-          File.open(index_f, "w") {|f| f.puts YAMLSerializer.dump(index) }
+          File.open(index_f, "w") {|f| f.puts Gem::YAMLSerializer.dump(index) }
+        end
+      end
+
+      def base_for_index(global)
+        global ? Plugin.global_root : Plugin.root
+      end
+
+      # A relative path only means anything inside the root, so an entry that escapes is not one Bundler installed.
+      def escaping_plugins(index, base)
+        names = []
+
+        %w[load_paths plugin_paths].each do |key|
+          (index[key] || {}).each do |name, value|
+            escapes = Array(value).any? do |path|
+              !Pathname.new(path).absolute? && !contained_in?(absolutize_path(path, base), base)
+            end
+
+            names << name if escapes
+          end
+        end
+
+        names.uniq
+      end
+
+      # Expanded here, not by the caller: what gets stored stays joined, because
+      # #installed_in_plugin_root? matches it against Plugin.root as written.
+      def contained_in?(path, base)
+        path = File.expand_path(path)
+        base = File.expand_path(base)
+
+        path == base || path.start_with?("#{base}#{File::SEPARATOR}")
+      end
+
+      # commands and sources are keyed by what they provide, load_paths and plugin_paths by the plugin.
+      def owned_by(mapping, names)
+        mapping.reject {|_, plugin| names.include?(plugin) }
+      end
+
+      def named(mapping, names)
+        mapping.reject {|plugin, _| names.include?(plugin) }
+      end
+
+      def transform_index_paths(paths)
+        return {} unless paths
+
+        paths.transform_values do |value|
+          if value.is_a?(Array)
+            value.map {|path| yield path }
+          else
+            yield value
+          end
         end
       end
+
+      def relativize_path(path, base)
+        pathname = Pathname.new(path)
+        return path unless pathname.absolute?
+
+        return path unless contained_in?(pathname.to_s, base)
+
+        pathname.relative_path_from(Pathname.new(base)).to_s
+      end
+
+      def absolutize_path(path, base)
+        pathname = Pathname.new(path)
+        pathname = Pathname.new(base).join(pathname) unless pathname.absolute?
+        pathname.to_s
+      end
     end
   end
 end

data/lib/bundler/plugin/installer/path.rb

@@ -5,7 +5,7 @@ module Bundler
     class Installer
       class Path < Bundler::Source::Path
         def root
-          SharedHelpers.in_bundle? ? Bundler.root : Plugin.root
+          Plugin.root
         end
 
         def eql?(other)

data/lib/bundler/plugin/installer.rb

@@ -32,12 +32,18 @@ module Bundler
       #
       # @param [Definition] definition object
       # @return [Hash] map of names to their specs they are installed with
-      def install_definition(definition)
+      def install_definition(definition, latest = false)
         def definition.lock(*); end
-        definition.remotely!
+
+        if latest || definition.missing_specs?
+          definition.remotely!
+        else
+          definition.with_cache!
+        end
+
         specs = definition.specs
 
-        install_from_specs specs
+        install_from_specs(specs)
       end
 
       private
@@ -89,14 +95,14 @@ module Bundler
       end
 
       def install_all_sources(names, version, source_list, source = nil)
-        deps = names.map {|name| Dependency.new(name, version, { "source" => source }) }
+        deps = names.map {|name| Dependency.new(name, version, { "source" => source, "plugin" => true }) }
 
         Bundler.configure_gem_home_and_path(Plugin.root)
 
         Bundler.settings.temporary(deployment: false, frozen: false) do
           definition = Definition.new(nil, deps, source_list, true)
 
-          install_definition(definition)
+          install_definition(definition, true)
         end
       end
 
@@ -110,6 +116,8 @@ module Bundler
         paths = {}
 
         specs.each do |spec|
+          next if spec.name == "bundler"
+
           spec.source.download(spec)
           spec.source.install(spec)