bundler 4.0.22 → 4.1.0.beta2

data/lib/bundler/source/git.rb

@@ -7,12 +7,13 @@ module Bundler
     class Git < Path
       autoload :GitProxy, File.expand_path("git/git_proxy", __dir__)
 
-      attr_reader :uri, :ref, :branch, :options, :glob, :submodules
+      attr_reader :uri, :ref, :branch, :options, :glob, :submodules, :sparse_checkout
 
       def initialize(options)
         @options = options
         @checksum_store = Checksum::Store.new
-        @glob = options["glob"] || DEFAULT_GLOB
+        @sparse_checkout = normalize_sparse_checkout(options)
+        @glob = options["glob"] || sparse_checkout_glob || DEFAULT_GLOB
 
         @allow_cached = false
         @allow_remote = false
@@ -30,6 +31,7 @@ module Bundler
 
         @copied     = false
         @local      = false
+        @cached_app_cache_path = nil
       end
 
       def remote!
@@ -57,12 +59,13 @@ module Bundler
         %w[ref branch tag submodules].each do |opt|
           out << "  #{opt}: #{options[opt]}\n" if options[opt]
         end
+        @sparse_checkout&.each {|dir| out << "  sparse_checkout: #{dir}\n" }
         out << "  glob: #{@glob}\n" unless default_glob?
         out << "  specs:\n"
       end
 
       def to_gemfile
-        specifiers = %w[ref branch tag submodules glob].map do |opt|
+        specifiers = %w[ref branch tag submodules glob sparse_checkout].map do |opt|
           "#{opt}: #{options[opt]}" if options[opt]
         end
 
@@ -70,14 +73,15 @@ module Bundler
       end
 
       def hash
-        [self.class, uri, ref, branch, name, glob, submodules].hash
+        [self.class, uri, ref, branch, name, glob, submodules, sparse_checkout].hash
       end
 
       def eql?(other)
         other.is_a?(Git) && uri == other.uri && ref == other.ref &&
           branch == other.branch && name == other.name &&
           glob == other.glob &&
-          submodules == other.submodules
+          submodules == other.submodules &&
+          sparse_checkout == other.sparse_checkout
       end
 
       alias_method :==, :eql?
@@ -86,7 +90,8 @@ module Bundler
         other.is_a?(Git) && uri == other.uri &&
           name == other.name &&
           glob == other.glob &&
-          submodules == other.submodules
+          submodules == other.submodules &&
+          sparse_checkout == other.sparse_checkout
       end
 
       def to_s
@@ -191,8 +196,13 @@ module Bundler
         set_cache_path!(app_cache_path) if use_app_cache?
 
         if requires_checkout? && !@copied
-          fetch unless use_app_cache?
-          checkout
+          Plugin.hook(Plugin::Events::GIT_BEFORE_FETCH, self)
+          begin
+            fetch unless use_app_cache?
+            checkout
+          ensure
+            Plugin.hook(Plugin::Events::GIT_AFTER_FETCH, self)
+          end
         end
 
         local_specs
@@ -272,6 +282,11 @@ module Bundler
 
         app_cache_path = app_cache_path(custom_path)
 
+        # When several gems share a single git source, this is called once per
+        # gem. Copying the repository is expensive for large repos, so skip it
+        # if we already populated this cache during the same command.
+        return if @cached_app_cache_path == app_cache_path
+
         migrate = try_migrate ? bare_repo?(app_cache_path) : false
 
         set_cache_path!(nil) if migrate
@@ -283,6 +298,8 @@ module Bundler
         git_proxy.checkout if migrate || requires_checkout?
         git_proxy.copy_to(app_cache_path, @submodules)
         serialize_gemspecs_in(app_cache_path)
+
+        @cached_app_cache_path = app_cache_path
       end
 
       def checkout
@@ -376,7 +393,30 @@ module Bundler
       end
 
       def shortref_for_path(ref)
-        ref[0..11]
+        shortref = ref[0..11]
+        return shortref unless @sparse_checkout
+
+        # Checkouts of the same revision with different cones hold different files
+        "#{shortref}-#{Bundler::Digest.sha1(@sparse_checkout.join("\n"))[0..7]}"
+      end
+
+      def normalize_sparse_checkout(options)
+        return unless options["sparse_checkout"]
+
+        dirs = Array(options["sparse_checkout"])
+        unless dirs.any? && dirs.all? {|dir| dir.is_a?(String) && !dir.empty? }
+          raise GemfileError, "The :sparse_checkout option must be a directory or an array of directories, " \
+            "but #{options["sparse_checkout"].inspect} was given"
+        end
+
+        options["sparse_checkout"] = dirs
+      end
+
+      def sparse_checkout_glob
+        return unless @sparse_checkout
+
+        dirs = @sparse_checkout.size == 1 ? @sparse_checkout.first : "{#{@sparse_checkout.join(",")}}"
+        "#{dirs}/#{DEFAULT_GLOB}"
       end
 
       def glob_for_display
@@ -405,10 +445,6 @@ module Bundler
         options["revision"]
       end
 
-      def cached?
-        cache_path.exist?
-      end
-
       def git_proxy
         @git_proxy ||= GitProxy.new(cache_path, uri, options, locked_revision, self)
       end

data/lib/bundler/source/path/installer.rb

@@ -24,7 +24,7 @@ module Bundler
         def post_install
           run_hooks(:pre_install)
 
-          unless @disable_extensions
+          unless @disable_extensions || Bundler.settings[:no_build_extension]
             build_extensions
             run_hooks(:post_build)
           end

data/lib/bundler/source/rubygems/remote.rb

@@ -18,12 +18,17 @@ module Bundler
         end
 
         # Returns the cooldown days that apply to this remote, resolving the
-        # precedence CLI > config > Gemfile per-source. Returns nil if no
-        # cooldown applies.
+        # precedence CLI > config > Gemfile per-source and then raising the
+        # result to RubyGems' own setting. Returns nil if no cooldown applies.
+        #
+        # The resolver asks once per candidate spec, so the settings lookup is
+        # memoized. That snapshots the value: a Remote created before a
+        # settings change keeps the old one. Nothing in Bundler changes the
+        # cooldown setting after the sources are built (the CLI flag is applied
+        # before the Definition exists), so build a new Remote if you need to.
         def effective_cooldown
-          override = Bundler.settings[:cooldown]
-          return override if override
-          @cooldown
+          return @effective_cooldown if defined?(@effective_cooldown)
+          @effective_cooldown = Bundler.settings.cooldown_for(@cooldown)
         end
 
         MAX_CACHE_SLUG_HOST_SIZE = 255 - 1 - 32 # 255 minus dot minus MD5 length

data/lib/bundler/source/rubygems.rb

@@ -25,6 +25,7 @@ module Bundler
         @checksum_store = Checksum::Store.new
         @gem_installers = {}
         @gem_installers_mutex = Mutex.new
+        @remote_spec_for_mutex = Mutex.new
         @remote_specs_mutex = Mutex.new
 
         cooldown = options["cooldown"]
@@ -196,6 +197,8 @@ module Bundler
              "the security policy didn't allow it, with the message: #{e.message}"
           end
 
+          s.content_address = spec.content_address if spec.content_address
+
           spec.__swap__(s)
         end
 
@@ -230,8 +233,12 @@ module Bundler
         spec.post_install_message
       end
 
+      def uncached?(spec)
+        caches.none? {|cache| File.exist?(package_path(cache, spec)) }
+      end
+
       def cache(spec, custom_path = nil)
-        cached_path = Bundler.settings[:cache_all_platforms] ? fetch_gem_if_possible(spec) : cached_gem(spec)
+        cached_path = fetch_gem_if_possible(spec)
         raise GemNotFound, "Missing gem file '#{spec.file_name}'." unless cached_path
         return if File.dirname(cached_path) == Bundler.app_cache.to_s
         Bundler.ui.info "  * #{File.basename(cached_path)}"
@@ -437,12 +444,14 @@ module Bundler
       # Looks up a single spec in the remote sources, fetching only its own
       # name when the full remote index is not already materialized.
       def remote_spec_for(spec)
-        return remote_specs.search(spec).first if @remote_specs || api_fetchers.empty?
+        @remote_spec_for_mutex.synchronize do
+          return remote_specs.search(spec).first if @remote_specs || api_fetchers.empty?
 
-        index = Index.build do |idx|
-          fetch_names(api_fetchers, [spec.name], idx)
+          index = Index.build do |idx|
+            fetch_names(api_fetchers, [spec.name], idx)
+          end
+          index.search(spec).first
         end
-        index.search(spec).first
       end
 
       def fetch_names(fetchers, dependency_names, index)
@@ -462,10 +471,24 @@ module Bundler
         if spec.remote
           fetch_gem(spec, previous_spec)
         else
-          cached_gem(spec)
+          cached_gem(spec) || refetch_gem(spec, previous_spec)
         end
       end
 
+      # An installed gem materializes without a remote, so a reinstall forced by
+      # `--redownload` has to look the gem up in the remote index again before it
+      # can download the archive that the cache no longer holds.
+      def refetch_gem(spec, previous_spec = nil)
+        return unless @allow_remote
+
+        remote_spec = remote_spec_for(spec)
+        return unless remote_spec && remote_spec.full_name == spec.full_name
+
+        path = fetch_gem(remote_spec, previous_spec)
+        spec.remote = remote_spec.remote
+        path
+      end
+
       def fetch_gem(spec, previous_spec = nil)
         spec.fetch_platform
 
@@ -545,8 +568,13 @@ module Bundler
         Bundler.ui.confirm("Fetching #{version_message(spec, previous_spec)}")
         gem_remote_fetcher = remote_fetchers.fetch(spec.remote).gem_remote_fetcher
 
-        Gem.time("Downloaded #{spec.name} in", 0, true) do
-          Bundler.rubygems.download_gem(spec, uri, download_cache_path, gem_remote_fetcher)
+        Plugin.hook(Plugin::Events::GEM_BEFORE_FETCH, spec)
+        begin
+          Gem.time("Downloaded #{spec.name} in", 0, true) do
+            Bundler.rubygems.download_gem(spec, uri, download_cache_path, gem_remote_fetcher)
+          end
+        ensure
+          Plugin.hook(Plugin::Events::GEM_AFTER_FETCH, spec)
         end
       end
 
@@ -566,7 +594,12 @@ module Bundler
         return unless remote = spec.remote
         return unless cache_slug = remote.cache_slug
 
-        Bundler.user_cache.join("gems", cache_slug)
+        if Gem.respond_to?(:global_gem_cache_path)
+          Pathname.new(Gem.global_gem_cache_path).join(cache_slug)
+        else
+          # Fall back to old location for older RubyGems versions
+          Bundler.user_cache.join("gems", cache_slug)
+        end
       end
 
       def extension_cache_slug(spec)
@@ -574,11 +607,11 @@ module Bundler
         remote.cache_slug
       end
 
-      # We are using a mutex to reaed and write from/to the hash.
+      # We are using a mutex to read and write from/to the hash.
       # The reason this double synchronization was added is for performance
       # and to lock the mutex for the shortest possible amount of time. Otherwise,
       # all threads are fighting over this mutex and when it gets acquired it gets locked
-      # until a threads finishes downloading a gem, leaving the other threads waiting
+      # until a thread finishes downloading a gem, leaving the other threads waiting
       # doing nothing.
       def rubygems_gem_installer(spec, options)
         @gem_installers_mutex.synchronize { @gem_installers[spec.name] } || begin
@@ -589,6 +622,7 @@ module Bundler
 
           installer = Bundler::RubyGemsGemInstaller.at(
             path,
+            content_address: (spec.content_address if Gem::ContentAddress.content_addressed?(spec, validate_ruby_abi: false)),
             security_policy: Bundler.rubygems.security_policies[Bundler.settings["trust-policy"]],
             install_dir: rubygems_dir.to_s,
             bin_dir: Bundler.system_bindir.to_s,
@@ -596,7 +630,9 @@ module Bundler
             wrappers: true,
             env_shebang: true,
             build_args: options[:build_args],
-            bundler_extension_cache_path: extension_cache_path(spec)
+            bundler_extension_cache_path: extension_cache_path(spec),
+            build_extension: Bundler.settings[:no_build_extension] ? false : nil,
+            install_plugin: Bundler.settings[:no_install_plugin] ? false : nil
           )
           @gem_installers_mutex.synchronize { @gem_installers[spec.name] ||= installer }
         end

data/lib/bundler/source/rubygems_aggregate.rb

@@ -29,7 +29,7 @@ module Bundler
 
       def build_index
         Index.build do |idx|
-          dependency_names = source_map.pinned_spec_names
+          dependency_names = source_map.pinned_spec_names | source_map.replacement_names
 
           sources.all_sources.each do |source|
             next if @excluded_sources.include?(source)

data/lib/bundler/source_map.rb

@@ -2,12 +2,15 @@
 
 module Bundler
   class SourceMap
-    attr_reader :sources, :dependencies, :locked_specs
+    attr_reader :sources, :dependencies, :locked_specs, :replacement_names
 
-    def initialize(sources, dependencies, locked_specs)
+    def initialize(sources, dependencies, locked_specs, replacement_names = [])
       @sources = sources
       @dependencies = dependencies
       @locked_specs = locked_specs
+      # No gemspec names a gem that a `from:`/`to:` override substitutes, so
+      # the dependency API never fetches it unless asked.
+      @replacement_names = replacement_names
     end
 
     def pinned_spec_names(skip = nil)
@@ -22,6 +25,7 @@ module Bundler
       end
 
       unmet_deps = explicit_sources.map do |source|
+        source.add_dependency_names(replacement_names)
         (source.spec_names - pinned_spec_names).each do |indirect_dependency_name|
           previous_source = requirements[indirect_dependency_name]
           if previous_source.nil?
@@ -39,7 +43,7 @@ module Bundler
         source.unmet_deps
       end
 
-      sources.default_source.add_dependency_names(unmet_deps.flatten - requirements.keys)
+      sources.default_source.add_dependency_names(unmet_deps.flatten + replacement_names - requirements.keys)
 
       requirements
     end

data/lib/bundler/spec_set.rb

@@ -84,11 +84,14 @@ module Bundler
       platforms.delete(Bundler.local_platform) if less_specific_platform
     end
 
-    def validate_deps(s)
-      s.runtime_dependencies.each do |dep|
+    def validate_deps(s, overrides = s.is_a?(LazySpecification) ? Array(s.overrides) : [])
+      Override.rewrite_dependencies(overrides, s.name, s.runtime_dependencies).each do |dep|
         next if dep.name == "bundler"
 
         return :missing unless names.include?(dep.name)
+
+        override = Override.find_for(overrides, dep.name, :version)
+        dep = Gem::Dependency.new(dep.name, override.apply_to(dep.requirement)) if override
         return :invalid if none? {|spec| dep.matches_spec?(spec) }
       end
 
@@ -178,7 +181,7 @@ module Bundler
     end
 
     def find_by_name_and_platform(name, platform)
-      @specs.detect {|spec| spec.name == name && spec.installable_on_platform?(platform) }
+      lookup[name]&.detect {|spec| spec.installable_on_platform?(platform) }
     end
 
     def specs_with_additional_variants_from(other)
@@ -274,13 +277,25 @@ module Bundler
 
       valid_platform = lookup.all? do |_, specs|
         spec = specs.first
+        # The matching candidates returned by source.specs.search are remote
+        # specs that do not carry the override list themselves. Borrow it from
+        # the LazySpec we are validating so platform-variant validation honors
+        # the same overrides the install/resolve path already applies.
+        overrides = spec.is_a?(LazySpecification) ? Array(spec.overrides) : []
         matching_specs = spec.source.specs.search([spec.name, spec.version])
         platform_spec = MatchPlatform.select_best_platform_match(matching_specs, platform).find do |s|
-          valid?(s)
+          s.matches_current_metadata_with_overrides?(overrides) && validate_deps(s, overrides) == :valid
         end
 
         if platform_spec
-          new_specs << LazySpecification.from_spec(platform_spec) unless specs.include?(platform_spec)
+          unless specs.include?(platform_spec)
+            new_lazy = LazySpecification.from_spec(platform_spec)
+            # Carry the overrides forward so a follow-up complete_platform
+            # call that picks this synthesized variant as its exemplar still
+            # honors the user's override list.
+            new_lazy.overrides = overrides if overrides.any?
+            new_specs << new_lazy
+          end
           true
         else
           false
@@ -314,7 +329,7 @@ module Bundler
     end
 
     def sorted
-      @sorted ||= ([@specs.find {|s| s.name == "rake" }] + tsort).compact.uniq
+      @sorted ||= ([lookup["rake"]&.first] + tsort).compact.uniq
     rescue Gem::TSort::Cyclic => error
       cgems = extract_circular_gems(error)
       raise CyclicDependencyError, "Your bundle requires gems that depend" \
@@ -342,7 +357,8 @@ module Bundler
     end
 
     def tsort_each_child(s)
-      s.dependencies.sort_by(&:name).each do |d|
+      dependencies = s.is_a?(LazySpecification) ? Override.rewrite_dependencies(s.overrides, s.name, s.dependencies) : s.dependencies
+      dependencies.sort_by(&:name).each do |d|
         next if d.type == :development
 
         specs_for_name = lookup[d.name]

data/lib/bundler/stub_specification.rb

@@ -4,7 +4,8 @@ module Bundler
   class StubSpecification < RemoteSpecification
     def self.from_stub(stub)
       return stub if stub.is_a?(Bundler::StubSpecification)
-      spec = new(stub.name, stub.version, stub.platform, nil)
+      content_address = stub.content_address
+      spec = new(stub.name, stub.version, stub.platform, nil, content_address: content_address)
       spec.stub = stub
       spec
     end

data/lib/bundler/templates/newgem/Gemfile.tt

@@ -6,19 +6,19 @@ source "https://rubygems.org"
 gemspec
 
 gem "irb"
-gem "rake", "~> 13.0"
+gem "rake", ">= 13.0"
 <%- if config[:ext] -%>
 
 gem "rake-compiler"
 <%- end -%>
 <%- if config[:test] -%>
 
-gem "<%= config[:test] %>", "~> <%= config[:test_framework_version] %>"
+gem "<%= config[:test] %>"
 <%- end -%>
 <%- if config[:linter] == "rubocop" -%>
 
-gem "rubocop", "~> <%= config[:linter_version] %>"
+gem "rubocop"
 <%- elsif config[:linter] == "standard" -%>
 
-gem "standard", "~> <%= config[:linter_version] %>"
+gem "standard"
 <%- end -%>

data/lib/bundler/templates/newgem/newgem.gemspec.tt

@@ -45,12 +45,12 @@ Gem::Specification.new do |spec|
 <%- end -%>
 
   # Uncomment to register a new dependency of your gem
-  # spec.add_dependency "example-gem", "~> 1.0"
+  # spec.add_dependency "example-gem", ">= 1.0"
 <%- if config[:ext] == 'rust' -%>
-  spec.add_dependency "rb_sys", "~> 0.9.128"
+  spec.add_dependency "rb_sys", ">= 0.9.128"
 <%- end -%>
 <%- if config[:ext] == 'go' -%>
-  spec.add_dependency "go_gem", "~> 0.2"
+  spec.add_dependency "go_gem", ">= 0.2"
 <%- end -%>
 
   # For more information and examples about making a new gem, check out our

data/lib/bundler/templates/newgem/spec/newgem_spec.rb.tt

@@ -9,7 +9,7 @@ RSpec.describe <%= config[:constant_name] %> do
   it "can call into Rust" do
     result = <%= config[:constant_name] %>.hello("world")
 
-    expect(result).to be("Hello earth, from Rust!")
+    expect(result).to eq("Hello world, from Rust!")
   end
 <%- else -%>
   it "does something useful" do

data/lib/bundler/templates/newgem/test/minitest/test_newgem.rb.tt

@@ -9,7 +9,7 @@ class <%= config[:minitest_constant_name] %> < Minitest::Test
 
 <%- if config[:ext] == 'rust' -%>
   def test_hello_world
-    assert_equal "Hello earth, from Rust!", <%= config[:constant_name] %>.hello("world")
+    assert_equal "Hello world, from Rust!", <%= config[:constant_name] %>.hello("world")
   end
 <%- else -%>
   def test_it_does_something_useful

data/lib/bundler/ui/shell.rb

@@ -76,10 +76,6 @@ module Bundler
         level("debug")
       end
 
-      def quiet?
-        level("quiet")
-      end
-
       def ask(msg)
         @shell.ask(msg, :green)
       end

data/lib/bundler/ui/silent.rb

@@ -45,10 +45,6 @@ module Bundler
         false
       end
 
-      def quiet?
-        false
-      end
-
       def warn?
         false
       end

data/lib/bundler/vendor/thor/lib/thor/actions/inject_into_file.rb

@@ -2,6 +2,38 @@ require_relative "empty_directory"
 
 class Bundler::Thor
   module Actions
+    WARNINGS = {unchanged_no_flag: "File unchanged! Either the supplied flag value not found or the content has already been inserted!"}
+
+    # Injects the given content into a file, raising an error if the contents of
+    # the file are not changed. Different from gsub_file, this method is reversible.
+    #
+    # ==== Parameters
+    # destination<String>:: Relative path to the destination root
+    # data<String>:: Data to add to the file. Can be given as a block.
+    # config<Hash>:: give :verbose => false to not log the status and the flag
+    #                for injection (:after or :before) or :force => true for
+    #                insert two or more times the same content.
+    #
+    # ==== Examples
+    #
+    #   insert_into_file "config/environment.rb", "config.gem :thor", :after => "Rails::Initializer.run do |config|\n"
+    #
+    #   insert_into_file "config/environment.rb", :after => "Rails::Initializer.run do |config|\n" do
+    #     gems = ask "Which gems would you like to add?"
+    #     gems.split(" ").map{ |gem| "  config.gem :#{gem}" }.join("\n")
+    #   end
+    #
+    def insert_into_file!(destination, *args, &block)
+      data = block_given? ? block : args.shift
+
+      config = args.shift || {}
+      config[:after] = /\z/ unless config.key?(:before) || config.key?(:after)
+      config = config.merge({error_on_no_change: true})
+
+      action InjectIntoFile.new(self, destination, data, config)
+    end
+    alias_method :inject_into_file!, :insert_into_file!
+
     # Injects the given content into a file. Different from gsub_file, this
     # method is reversible.
     #
@@ -21,8 +53,6 @@ class Bundler::Thor
     #     gems.split(" ").map{ |gem| "  config.gem :#{gem}" }.join("\n")
     #   end
     #
-    WARNINGS = {unchanged_no_flag: "File unchanged! Either the supplied flag value not found or the content has already been inserted!"}
-
     def insert_into_file(destination, *args, &block)
       data = block_given? ? block : args.shift
 
@@ -47,6 +77,7 @@ class Bundler::Thor
 
         @replacement = data.is_a?(Proc) ? data.call : data
         @flag = Regexp.escape(@flag) unless @flag.is_a?(Regexp)
+        @error_on_no_change = @config.fetch(:error_on_no_change, false)
       end
 
       def invoke!
@@ -59,6 +90,8 @@ class Bundler::Thor
         if exists?
           if replace!(/#{flag}/, content, config[:force])
             say_status(:invoke)
+          elsif @error_on_no_change
+            raise Bundler::Thor::Error, "The content of #{destination} did not change"
           elsif replacement_present?
             say_status(:unchanged, color: :blue)
           else

data/lib/bundler/vendor/thor/lib/thor/base.rb

@@ -13,8 +13,9 @@ class Bundler::Thor
   autoload :RakeCompat, File.expand_path("rake_compat", __dir__)
   autoload :Group,      File.expand_path("group", __dir__)
 
-  # Shortcuts for help.
+  # Shortcuts for help and tree commands.
   HELP_MAPPINGS       = %w(-h -? --help -D)
+  TREE_MAPPINGS       = %w(-t --tree)
 
   # Bundler::Thor methods that should not be overwritten by the user.
   THOR_RESERVED_WORDS = %w(invoke shell options behavior root destination_root relative_root

data/lib/bundler/vendor/thor/lib/thor/shell/basic.rb

@@ -311,13 +311,11 @@ class Bundler::Thor
       end
 
       def show_diff(destination, content) #:nodoc:
-        diff_cmd = ENV["THOR_DIFF"] || ENV["RAILS_DIFF"] || "diff -u"
-
         require "tempfile"
         Tempfile.open(File.basename(destination), File.dirname(destination), binmode: true) do |temp|
           temp.write content
           temp.rewind
-          system %(#{diff_cmd} "#{destination}" "#{temp.path}")
+          system(*diff_tool, destination, temp.path)
         end
       end
 
@@ -369,15 +367,25 @@ class Bundler::Thor
 
       def merge(destination, content) #:nodoc:
         require "tempfile"
-        Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination)) do |temp|
+        Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination), binmode: true) do |temp|
           temp.write content
           temp.rewind
-          system(merge_tool, temp.path, destination)
+          system(*merge_tool, temp.path, destination)
         end
       end
 
       def merge_tool #:nodoc:
-        @merge_tool ||= ENV["THOR_MERGE"] || "git difftool --no-index"
+        @merge_tool ||= begin
+          require "shellwords"
+          Shellwords.split(ENV["THOR_MERGE"] || "git difftool --no-index")
+        end
+      end
+
+      def diff_tool #:nodoc:
+        @diff_cmd ||= begin
+          require "shellwords"
+          Shellwords.split(ENV["THOR_DIFF"] || ENV["RAILS_DIFF"] || "diff -u")
+        end
       end
     end
   end

data/lib/bundler/vendor/thor/lib/thor/shell/color.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "basic"
 
 class Bundler::Thor

data/lib/bundler/vendor/thor/lib/thor/version.rb

@@ -1,3 +1,3 @@
 class Bundler::Thor
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end