bundler 4.0.22 → 4.1.0.beta2

data/lib/bundler/man/bundle-remove.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-REMOVE" "1" "April 2026" ""
+.TH "BUNDLE\-REMOVE" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-remove\fR \- Removes gems from the Gemfile
 .SH "SYNOPSIS"

data/lib/bundler/man/bundle-show.1

@@ -1,10 +1,10 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-SHOW" "1" "April 2026" ""
+.TH "BUNDLE\-SHOW" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-show\fR \- Shows all the gems in your bundle, or the path to a gem
 .SH "SYNOPSIS"
-\fBbundle show\fR [GEM] [\-\-paths]
+\fBbundle show\fR [GEM] [\-\-paths] [\-\-exact\-match]
 .SH "DESCRIPTION"
 Without the [GEM] option, \fBshow\fR will print a list of the names and versions of all gems that are required by your [\fBGemfile(5)\fR][Gemfile(5)], sorted by name\.
 .P
@@ -13,4 +13,7 @@ Calling show with [GEM] will list the exact location of that gem on your machine
 .TP
 \fB\-\-paths\fR
 List the paths of all gems that are required by your [\fBGemfile(5)\fR][Gemfile(5)], sorted by gem name\.
+.TP
+\fB\-\-exact\-match\fR
+Only match gems whose names exactly match the given name\.
 

data/lib/bundler/man/bundle-show.1.ronn

@@ -5,6 +5,7 @@ bundle-show(1) -- Shows all the gems in your bundle, or the path to a gem
 
 `bundle show` [GEM]
               [--paths]
+              [--exact-match]
 
 ## DESCRIPTION
 
@@ -19,3 +20,6 @@ machine.
 * `--paths`:
   List the paths of all gems that are required by your [`Gemfile(5)`][Gemfile(5)],
   sorted by gem name.
+
+* `--exact-match`:
+  Only match gems whose names exactly match the given name.

data/lib/bundler/man/bundle-update.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-UPDATE" "1" "April 2026" ""
+.TH "BUNDLE\-UPDATE" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-update\fR \- Update your gems to the latest available versions
 .SH "SYNOPSIS"
@@ -66,7 +66,7 @@ Do not allow any gem to be updated past latest \fB\-\-patch\fR | \fB\-\-minor\fR
 Use bundle install conservative update behavior and do not allow indirect dependencies to be updated\.
 .TP
 \fB\-\-cooldown=<number>\fR
-Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. Combine with \fB\-\-conservative\fR to minimize transitive churn when bypassing cooldown for an urgent update\. See \fBcooldown\fR in bundle\-config(1)\.
+Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run, overriding every other cooldown setting, RubyGems' own included\. Combine with \fB\-\-conservative\fR to minimize transitive churn when bypassing cooldown for an urgent update\. See \fBcooldown\fR in bundle\-config(1)\.
 .SH "UPDATING ALL GEMS"
 If you run \fBbundle update \-\-all\fR, bundler will ignore any previously installed gems and resolve all dependencies again based on the latest versions of all gems available in the sources\.
 .P

data/lib/bundler/man/bundle-update.1.ronn

@@ -96,8 +96,8 @@ gem.
 
 * `--cooldown=<number>`:
   Only consider gem versions published at least <number> days ago when
-  resolving. Pass `0` to disable cooldown for this run, overriding any
-  per-source or global configuration. Combine with `--conservative` to
+  resolving. Pass `0` to disable cooldown for this run, overriding every
+  other cooldown setting, RubyGems' own included. Combine with `--conservative` to
   minimize transitive churn when bypassing cooldown for an urgent
   update. See `cooldown` in bundle-config(1).
 

data/lib/bundler/man/bundle-version.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-VERSION" "1" "April 2026" ""
+.TH "BUNDLE\-VERSION" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-version\fR \- Prints Bundler version information
 .SH "SYNOPSIS"

data/lib/bundler/man/bundle.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE" "1" "April 2026" ""
+.TH "BUNDLE" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\fR \- Ruby Dependency Management
 .SH "SYNOPSIS"

data/lib/bundler/man/gemfile.5

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "GEMFILE" "5" "April 2026" ""
+.TH "GEMFILE" "5" "May 2026" ""
 .SH "NAME"
 \fBGemfile\fR \- A format for describing gem dependencies for Ruby programs
 .SH "SYNOPSIS"
@@ -295,6 +295,13 @@ gem "rails", git: "https://github\.com/rails/rails\.git", ref: "4aded"
 .TP
 \fBsubmodules\fR
 For reference, a git submodule \fIhttps://git\-scm\.com/book/en/v2/Git\-Tools\-Submodules\fR lets you have another git repository within a subfolder of your repository\. Specify \fBsubmodules: true\fR to cause bundler to expand any submodules included in the git repository
+.TP
+\fBsparse_checkout\fR
+Specify a directory, or an array of directories, to include when checking out a git repository\. Uses git's sparse\-checkout feature (requires git 2\.25+) to only check out the specified directories, reducing disk usage for large repos\. Unless \fBglob\fR is given, the \fB\.gemspec\fR is looked up within those directories\.
+.IP
+gem "foo", git: "https://github\.com/org/monorepo\.git", sparse_checkout: "packages/foo"
+.IP
+Files at the top level of the repository are always checked out\. On git versions below 2\.25, the entire repository will be checked out with a warning\.
 .P
 If a git repository contains multiple \fB\.gemspecs\fR, each \fB\.gemspec\fR represents a gem located at the same place in the file system as the \fB\.gemspec\fR\.
 .IP "" 4
@@ -471,6 +478,75 @@ eval_gemfile "another\.gemfile"
 .IP "" 0
 .P
 This can be useful to run tests against multiple combinations of dependencies, or to load per\-developer gems from an untracked gemfile\.
+.SH "OVERRIDE"
+The \fBoverride\fR directive rewrites a constraint on another gem before resolution runs\. It targets the common case where an upstream gem's published metadata is too narrow on the current project's machine \-\- a stale upper bound, an unwanted floor, or a transitive pin that has to be lifted\.
+.IP "" 4
+.nf
+override <target>, <field>: <operation>
+.fi
+.IP "" 0
+.P
+\fB<target>\fR is a gem name string or \fB:all\fR\. \fB<field>\fR is one of \fBversion:\fR, \fBrequired_ruby_version:\fR, or \fBrequired_rubygems_version:\fR\. \fB<operation>\fR is one of:
+.IP "\(bu" 4
+a version requirement string (e\.g\. \fB">= 8\.0"\fR), which \fBreplaces\fR the target's requirement absolutely\. The original requirement, both direct and transitive, is discarded in favour of the override\.
+.IP "\(bu" 4
+\fB:ignore_upper\fR, which removes upper\-bound operators (\fB<\fR and \fB<=\fR) from the existing requirement and folds \fB~>\fR into its lower bound (\fB~> 1\.5\fR becomes \fB>= 1\.5\fR)\. Other operators, including \fB!=\fR, are preserved\.
+.IP "\(bu" 4
+\fBnil\fR, which collapses the requirement to \fB>= 0\fR (no constraint at all)\.
+.IP "" 0
+.P
+\fB:all\fR only applies to \fBrequired_ruby_version:\fR and \fBrequired_rubygems_version:\fR\. A per\-gem override on the same field takes precedence over an \fB:all\fR override\. \fB:all + version:\fR is rejected: version requirements only make sense per gem\.
+.P
+Declaring the same \fBtarget\fR and \fBfield\fR twice is an error\.
+.IP "" 4
+.nf
+source "https://rubygems\.org"
+
+# Force every reference to "rails" \-\- direct or transitive \-\- to >= 8\.0\.
+override "rails", version: ">= 8\.0"
+
+# Strip the upper bound on nokogiri\.
+override "nokogiri", version: :ignore_upper
+
+# Drop the version pin on legacy entirely\.
+override "legacy", version: nil
+
+# Loosen every gem's required_ruby_version upper bound\.
+override :all, required_ruby_version: :ignore_upper
+
+# Override one specific gem's required_rubygems_version\.
+override "tricky", required_rubygems_version: nil
+
+gem "rails", "~> 7\.0"
+.fi
+.IP "" 0
+.P
+The override only affects resolution and the install\-time Ruby/RubyGems compatibility checks; \fBGemfile\.lock\fR continues to reflect the resolved versions, not the rewritten requirements\. When resolution still fails, Bundler appends the active overrides (with their Gemfile location) to the error message so it is clear which override shaped the constraint set\.
+.SS "DROPPING OR REPLACING A DEPENDENCY"
+\fBfrom:\fR and \fBto:\fR rewrite a single dependency of a single gem:
+.IP "" 4
+.nf
+override <target>, from: <gem>, to: nil
+override <target>, from: <gem>, to: <replacement>, version: <requirement>
+.fi
+.IP "" 0
+.P
+\fBto: nil\fR removes the dependency of \fB<gem>\fR on \fB<target>\fR, so \fB<target>\fR is not installed unless something else still requires it\. \fBto: <replacement>\fR makes \fB<gem>\fR depend on \fB<replacement>\fR instead of \fB<target>\fR\. The requirement \fB<gem>\fR put on \fB<target>\fR is discarded, and the optional \fBversion:\fR gives the replacement its own\. Both forms apply whether \fB<gem>\fR is a direct or a transitive dependency\.
+.P
+\fBfrom:\fR is required, and so is \fBto:\fR once \fBfrom:\fR is given\. To rewrite the same dependency of several gems, write one \fBoverride\fR per gem\. It is an error to declare the same \fB<target>\fR and \fBfrom:\fR twice, to drop a gem that the Gemfile requires directly, or to replace a gem that another gem still requires, since both would then be in the bundle\.
+.IP "" 4
+.nf
+# jekyll only loads em\-websocket for `jekyll serve \-\-livereload`\.
+override "em\-websocket", from: "jekyll", to: nil
+
+# Use an API\-compatible gem that provides the same files\.
+override "foo", from: "bar", to: "foo\-lite"
+.fi
+.IP "" 0
+.P
+Bundler does not check what a gem loads at runtime\. If \fB<gem>\fR requires \fB<target>\fR unconditionally, dropping it makes that require raise \fBLoadError\fR, as with jekyll's dependency on jekyll\-sass\-converter or the adapters that faraday 1\.x requires on load\. A replacement only works when it provides the files \fB<gem>\fR requires, and it does not take over the name of \fB<target>\fR: \fBGem\.loaded_specs\fR has no entry for \fB<target>\fR, and \fBgem "<target>"\fR fails\.
+.P
+\fBGemfile\.lock\fR keeps listing \fB<target>\fR under \fB<gem>\fR as the gem publishes it, while the locked gems leave \fB<target>\fR out or include \fB<replacement>\fR\. A frozen install accepts that lockfile as long as the Gemfile still has the override\. Removing the override makes Bundler resolve \fB<target>\fR again\.
 .SH "SOURCE PRIORITY"
 When attempting to locate a gem to satisfy a gem requirement, bundler uses the following priority order:
 .IP "1." 4

data/lib/bundler/man/gemfile.5.ronn

@@ -359,6 +359,20 @@ Git repositories support a number of additional options.
     Specify `submodules: true` to cause bundler to expand any
     submodules included in the git repository
 
+  * `sparse_checkout`:
+    Specify a directory, or an array of directories, to include when
+    checking out a git repository. Uses git's sparse-checkout feature
+    (requires git 2.25+) to only check out the specified directories,
+    reducing disk usage for large repos. Unless `glob` is given, the
+    `.gemspec` is looked up within those directories.
+
+      gem "foo", git: "https://github.com/org/monorepo.git",
+                 sparse_checkout: "packages/foo"
+
+    Files at the top level of the repository are always checked out.
+    On git versions below 2.25, the entire repository will be checked
+    out with a warning.
+
 If a git repository contains multiple `.gemspecs`, each `.gemspec`
 represents a gem located at the same place in the file system as
 the `.gemspec`.
@@ -562,6 +576,96 @@ call.
 This can be useful to run tests against multiple combinations of dependencies,
 or to load per-developer gems from an untracked gemfile.
 
+## OVERRIDE
+
+The `override` directive rewrites a constraint on another gem before
+resolution runs. It targets the common case where an upstream gem's
+published metadata is too narrow on the current project's machine -- a stale
+upper bound, an unwanted floor, or a transitive pin that has to be lifted.
+
+    override <target>, <field>: <operation>
+
+`<target>` is a gem name string or `:all`. `<field>` is one of `version:`,
+`required_ruby_version:`, or `required_rubygems_version:`. `<operation>` is
+one of:
+
+  * a version requirement string (e.g. `">= 8.0"`), which **replaces** the
+    target's requirement absolutely. The original requirement, both direct
+    and transitive, is discarded in favour of the override.
+  * `:ignore_upper`, which removes upper-bound operators (`<` and `<=`) from
+    the existing requirement and folds `~>` into its lower bound (`~> 1.5`
+    becomes `>= 1.5`). Other operators, including `!=`, are preserved.
+  * `nil`, which collapses the requirement to `>= 0` (no constraint at all).
+
+`:all` only applies to `required_ruby_version:` and `required_rubygems_version:`.
+A per-gem override on the same field takes precedence over an `:all` override.
+`:all + version:` is rejected: version requirements only make sense per gem.
+
+Declaring the same `target` and `field` twice is an error.
+
+    source "https://rubygems.org"
+
+    # Force every reference to "rails" -- direct or transitive -- to >= 8.0.
+    override "rails", version: ">= 8.0"
+
+    # Strip the upper bound on nokogiri.
+    override "nokogiri", version: :ignore_upper
+
+    # Drop the version pin on legacy entirely.
+    override "legacy", version: nil
+
+    # Loosen every gem's required_ruby_version upper bound.
+    override :all, required_ruby_version: :ignore_upper
+
+    # Override one specific gem's required_rubygems_version.
+    override "tricky", required_rubygems_version: nil
+
+    gem "rails", "~> 7.0"
+
+The override only affects resolution and the install-time Ruby/RubyGems
+compatibility checks; `Gemfile.lock` continues to reflect the resolved
+versions, not the rewritten requirements. When resolution still fails,
+Bundler appends the active overrides (with their Gemfile location) to the
+error message so it is clear which override shaped the constraint set.
+
+### DROPPING OR REPLACING A DEPENDENCY
+
+`from:` and `to:` rewrite a single dependency of a single gem:
+
+    override <target>, from: <gem>, to: nil
+    override <target>, from: <gem>, to: <replacement>, version: <requirement>
+
+`to: nil` removes the dependency of `<gem>` on `<target>`, so `<target>` is
+not installed unless something else still requires it. `to: <replacement>`
+makes `<gem>` depend on `<replacement>` instead of `<target>`. The requirement
+`<gem>` put on `<target>` is discarded, and the optional `version:` gives the
+replacement its own. Both forms apply whether `<gem>` is a direct or a
+transitive dependency.
+
+`from:` is required, and so is `to:` once `from:` is given. To rewrite the
+same dependency of several gems, write one `override` per gem. It is an error
+to declare the same `<target>` and `from:` twice, to drop a gem that the
+Gemfile requires directly, or to replace a gem that another gem still
+requires, since both would then be in the bundle.
+
+    # jekyll only loads em-websocket for `jekyll serve --livereload`.
+    override "em-websocket", from: "jekyll", to: nil
+
+    # Use an API-compatible gem that provides the same files.
+    override "foo", from: "bar", to: "foo-lite"
+
+Bundler does not check what a gem loads at runtime. If `<gem>` requires
+`<target>` unconditionally, dropping it makes that require raise `LoadError`,
+as with jekyll's dependency on jekyll-sass-converter or the adapters that
+faraday 1.x requires on load. A replacement only works when it provides the
+files `<gem>` requires, and it does not take over the name of `<target>`:
+`Gem.loaded_specs` has no entry for `<target>`, and `gem "<target>"` fails.
+
+`Gemfile.lock` keeps listing `<target>` under `<gem>` as the gem publishes it,
+while the locked gems leave `<target>` out or include `<replacement>`. A
+frozen install accepts that lockfile as long as the Gemfile still has the
+override. Removing the override makes Bundler resolve `<target>` again.
+
 ## SOURCE PRIORITY
 
 When attempting to locate a gem to satisfy a gem requirement,

data/lib/bundler/match_metadata.rb

@@ -14,6 +14,18 @@ module Bundler
       @required_rubygems_version.satisfied_by?(Gem.rubygems_version)
     end
 
+    def matches_current_metadata_with_overrides?(overrides)
+      matches_current_ruby_with_overrides?(overrides) && matches_current_rubygems_with_overrides?(overrides)
+    end
+
+    def matches_current_ruby_with_overrides?(overrides)
+      effective_required_version(@required_ruby_version, :required_ruby_version, overrides).satisfied_by?(Gem.ruby_version)
+    end
+
+    def matches_current_rubygems_with_overrides?(overrides)
+      effective_required_version(@required_rubygems_version, :required_rubygems_version, overrides).satisfied_by?(Gem.rubygems_version)
+    end
+
     def expanded_dependencies
       runtime_dependencies + [
         metadata_dependency("Ruby", @required_ruby_version),
@@ -26,5 +38,13 @@ module Bundler
 
       Gem::Dependency.new("#{name}\0", requirement)
     end
+
+    private
+
+    def effective_required_version(requirement, field, overrides)
+      return requirement if overrides.nil? || overrides.empty?
+      override = Override.find_for(overrides, name, field)
+      override ? override.apply_to(requirement) : requirement
+    end
   end
 end

data/lib/bundler/match_platform.rb

@@ -2,6 +2,10 @@
 
 module Bundler
   module MatchPlatform
+    def content_address
+      nil
+    end
+
     def installable_on_platform?(target_platform) # :nodoc:
       return true if [Gem::Platform::RUBY, nil, target_platform].include?(platform)
       return true if Gem::Platform.new(platform) === target_platform
@@ -11,13 +15,32 @@ module Bundler
 
     def self.select_best_platform_match(specs, platform, force_ruby: false, prefer_locked: false)
       matching = select_all_platform_match(specs, platform, force_ruby: force_ruby, prefer_locked: prefer_locked)
+      matching = prefer_content_addressable(matching)
 
       Gem::Platform.sort_and_filter_best_platform_match(matching, platform)
     end
 
-    def self.select_best_local_platform_match(specs, force_ruby: false)
+    def self.select_all_content_address_match(specs, content_address)
+      return specs unless Gem::ContentAddress.match?(content_address)
+
+      specs.select {|spec| spec.content_address == content_address }
+    end
+
+    def self.prefer_content_addressable(matching)
+      addressable, non_addressable = matching.partition {|s| Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false) }
+      return matching if addressable.empty?
+
+      compatible = addressable.select(&:matches_current_metadata?)
+      return compatible if compatible.any?
+
+      non_addressable.any? ? non_addressable : matching
+    end
+
+    def self.select_best_local_platform_match(specs, force_ruby: false, locked_platforms: nil)
       local = Bundler.local_platform
-      matching = select_all_platform_match(specs, local, force_ruby: force_ruby).filter_map(&:materialized_for_installation)
+      matching = select_all_platform_match(specs, local, force_ruby: force_ruby)
+      matching = matching.filter_map {|spec| spec.materialized_for_installation(locked_platforms) }
+      matching = prefer_content_addressable(matching)
 
       Gem::Platform.sort_best_platform_match(matching, local)
     end

data/lib/bundler/match_remote_metadata.rb

@@ -6,19 +6,34 @@ module Bundler
     # API didn't include that field, so some marshalled specs in the index have it
     # set to +nil+.
     def matches_current_ruby?
-      @required_ruby_version ||= _remote_specification.required_ruby_version || Gem::Requirement.default
-
+      ensure_required_ruby_version_loaded
       super
     end
 
     def matches_current_rubygems?
-      # A fallback is included because the original version of the specification
-      # API didn't include that field, so some marshalled specs in the index have it
-      # set to +nil+.
-      @required_rubygems_version ||= _remote_specification.required_rubygems_version || Gem::Requirement.default
+      ensure_required_rubygems_version_loaded
+      super
+    end
+
+    def matches_current_ruby_with_overrides?(overrides)
+      ensure_required_ruby_version_loaded
+      super
+    end
 
+    def matches_current_rubygems_with_overrides?(overrides)
+      ensure_required_rubygems_version_loaded
       super
     end
+
+    private
+
+    def ensure_required_ruby_version_loaded
+      @required_ruby_version ||= _remote_specification.required_ruby_version || Gem::Requirement.default # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    def ensure_required_rubygems_version_loaded
+      @required_rubygems_version ||= _remote_specification.required_rubygems_version || Gem::Requirement.default # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
   end
 
   module MatchRemoteMetadata

data/lib/bundler/materialization.rb

@@ -12,6 +12,7 @@ module Bundler
       @dep = dep
       @platform = platform
       @candidates = candidates
+      @locked_platforms = candidates&.map(&:platform)
     end
 
     def complete?
@@ -24,12 +25,14 @@ module Bundler
       elsif platform
         MatchPlatform.select_best_platform_match(@candidates, platform, force_ruby: dep.force_ruby_platform)
       else
-        MatchPlatform.select_best_local_platform_match(@candidates, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform)
+        MatchPlatform.select_best_local_platform_match(@candidates, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform, locked_platforms: @locked_platforms)
       end
     end
 
     def dependencies
-      (materialized_spec || specs.first).runtime_dependencies.map {|d| [d, platform] }
+      spec = materialized_spec || specs.first
+      overrides = specs.first.overrides if specs.first.is_a?(LazySpecification)
+      Override.rewrite_dependencies(overrides, spec.name, spec.runtime_dependencies).map {|d| [d, platform] }
     end
 
     def materialized_spec

data/lib/bundler/override.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Bundler
+  class Override
+    UPPER_BOUND_OPERATORS = ["<", "<="].freeze
+
+    def self.find_for(overrides, name, field)
+      overrides.find {|o| o.target == name && o.field == field } ||
+        overrides.find {|o| o.target == :all && o.field == field }
+    end
+
+    # Drops or replaces the dependencies of the gem named `from` that a
+    # `from:`/`to:` override targets. The requirement `from` put on the
+    # replaced gem is discarded.
+    def self.rewrite_dependencies(overrides, from, dependencies)
+      return dependencies if overrides.nil? || overrides.none? {|o| o.from == from }
+
+      dependencies.filter_map do |dep|
+        override = overrides.find {|o| o.from == from && o.target == dep.name }
+        next dep unless override
+        next unless override.operation
+        Gem::Dependency.new(override.operation, *Array(override.requirement))
+      end
+    end
+
+    # Attach the given overrides onto every LazySpecification in `specs` so
+    # downstream consumers (LazySpecification#choose_compatible, the install-
+    # time compatibility check, etc.) can read the override list off the spec
+    # itself. Non-LazySpec entries (StubSpecification, Gem::Specification, ...)
+    # are left untouched.
+    def self.attach(specs, overrides)
+      return if overrides.nil? || overrides.empty?
+      specs.each {|s| s.overrides = overrides if s.is_a?(LazySpecification) }
+    end
+
+    attr_reader :target, :field, :operation, :from, :requirement, :source_location
+
+    def initialize(target, field, operation, from: nil, requirement: nil, source_location: nil)
+      @target = target
+      @field = field
+      @operation = operation
+      @from = from
+      @requirement = requirement
+      @source_location = source_location
+    end
+
+    def source_location_label
+      return nil unless @source_location
+      "#{File.basename(@source_location.path)}:#{@source_location.lineno}"
+    end
+
+    def to_s
+      options = if @from
+        ["from: #{@from.inspect}", "to: #{@operation.inspect}", *("version: #{@requirement.inspect}" if @requirement)].join(", ")
+      else
+        "#{@field}: #{@operation.inspect}"
+      end
+      location = source_location_label
+      "override #{@target == :all ? ":all" : @target.inspect}, #{options}#{" (declared at #{location})" if location}"
+    end
+
+    def apply_to(requirement)
+      raise ArgumentError, "#{self} rewrites a dependency and has no requirement to apply" if @from
+
+      case operation
+      when nil
+        Gem::Requirement.default
+      when :ignore_upper
+        remove_upper_bounds(requirement)
+      when String
+        Gem::Requirement.new(operation)
+      else
+        raise ArgumentError, "unsupported override operation: #{operation.inspect}"
+      end
+    end
+
+    private
+
+    def remove_upper_bounds(requirement)
+      return Gem::Requirement.default if requirement.nil? || requirement.none?
+
+      preserved = requirement.requirements.filter_map do |op, version|
+        if UPPER_BOUND_OPERATORS.include?(op)
+          nil
+        elsif op == "~>"
+          [">=", version]
+        else
+          [op, version]
+        end
+      end
+
+      return Gem::Requirement.default if preserved.empty?
+
+      Gem::Requirement.new(preserved.map {|op, v| "#{op} #{v}" })
+    end
+  end
+end

data/lib/bundler/plugin/dsl.rb

@@ -5,12 +5,11 @@ module Bundler
     # Dsl to parse the Gemfile looking for plugins to install
     class DSL < Bundler::Dsl
       class PluginGemfileError < PluginError; end
-      alias_method :_gem, :gem # To use for plugin installation as gem
 
       # So that we don't have to override all there methods to dummy ones
       # explicitly.
       # They will be handled by method_missing
-      [:gemspec, :gem, :install_if, :platforms, :env].each {|m| undef_method m }
+      [:gemspec, :install_if, :platforms, :env].each {|m| undef_method m }
 
       # This lists the plugins that was added automatically and not specified by
       # the user.
@@ -24,12 +23,11 @@ module Bundler
 
       def initialize
         super
-        @sources = Plugin::SourceList.new
         @inferred_plugins = [] # The source plugins inferred from :type
       end
 
-      def plugin(name, *args)
-        _gem(name, *args)
+      def gem(*args)
+        # Ignore regular dependencies when doing the plugins-only pre-parse
       end
 
       def method_missing(name, *args)