bundler 4.0.23 → 4.0.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ec361c599b55bcc5b770889047d0a539d2788e65025307f06401454c015897c
-  data.tar.gz: ac97ed4c20f2f9fbbd629f41ae9630f34b37fa3eab192c6dc136a6a7eeab1c91
+  metadata.gz: 567f97bf89a588c5a651c2b3f49298bb655349d8058b21d50c417b733485151d
+  data.tar.gz: 804d2843f77a7e567a90874cf52d528e2244b0ba7cbcb4966cf405d7d6121dfa
 SHA512:
-  metadata.gz: a6860a40c1b9b692d6d9ed0fbf6d76b7d0ce0a32dc661d24783c637ce9bed2e1552808953fedd5349bd102984df027fb1b9f250f226cc05e7965259a4806b2ff
-  data.tar.gz: 81891f385b11b80572b9ec4be939462a944d34072e0ddad6d238084b1dc80a5f7dba37154796f6e70d8d93ece45a2152f15ab97255e6cf425a8404749a600332
+  metadata.gz: aa6563d132a3f30113d97077ed5feb832306f9ef1511eb4a57c1017b55eedba715a3613426c7cc19bd4595f4ba71c1d6d0b1f204f95c6a4e903af9f33208ac9f
+  data.tar.gz: 55a6eaccc845bfd3a5154331a245da04956c05f8ddf3df029d3e4ce5a9742916a237fb5004f461e7b31cfc29ae4f7acd3bf0089bec1476224aa289a3a4723e3b

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 4.0.24 / 2026-11-05
+
+### Enhancements:
+
+* Read the Ruby version from mise's inline table form. Pull request [#9991](https://github.com/ruby/rubygems/pull/9991) by Hiroshi SHIBATA
+* Report which locked gems can't be materialized for the current platform. Pull request [#9738](https://github.com/ruby/rubygems/pull/9738) by Muhammad Moussa
+
+### Bug fixes:
+
+* Fix `bundle exec` with no arguments for paths containing spaces. Pull request [#9996](https://github.com/ruby/rubygems/pull/9996) by Brandon Weiss
+* Respect enclosing platforms and install_if for gemspec development dependencies. Pull request [#9992](https://github.com/ruby/rubygems/pull/9992) by Hiroshi SHIBATA
+* Respect enclosing group and platforms for gemspec dependencies. Pull request [#9990](https://github.com/ruby/rubygems/pull/9990) by Denis Talakevich
+* Don't report locked gems in the cooldown summary. Pull request [#9981](https://github.com/ruby/rubygems/pull/9981) by Patrik Ragnarsson
+* Make `Bundler::Source::Rubygems#hash` agree with `eql?`. Pull request [#9983](https://github.com/ruby/rubygems/pull/9983) by Hiroshi SHIBATA
+* Add checksums after platform changes in `bundle lock`. Pull request [#9960](https://github.com/ruby/rubygems/pull/9960) by Farid Zakaria
+* Apply BUNDLE_RETRY to lazy gemspec downloads. Pull request [#9868](https://github.com/ruby/rubygems/pull/9868) by Islam Elsayed
+* Fix file locks letting multiple processes in when lock files are removed. Pull request [#9930](https://github.com/ruby/rubygems/pull/9930) by Richard Janita and Hiroshi SHIBATA
+
 ## 4.0.23 / 2026-10-14
 
 ### Enhancements:

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-10-14".freeze
-    @git_commit_sha = "642a23e".freeze
+    @built_at = "2026-11-05".freeze
+    @git_commit_sha = "3b396e4".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/exec.rb

@@ -24,7 +24,7 @@ module Bundler
           kernel_load(bin_path, *args)
         else
           bin_path = explicit_path(bin_path)
-          kernel_exec(bin_path, *args)
+          kernel_exec([bin_path, bin_path], *args)
         end
       else
         # exec using the given command

data/lib/bundler/cli/lock.rb

@@ -43,7 +43,6 @@ module Bundler
 
       Bundler.settings.temporary(frozen: false) do
         definition = Bundler.definition(update, Bundler.default_lockfile)
-        definition.add_checksums if options["add-checksums"]
 
         Bundler::CLI::Common.configure_gem_version_promoter(definition, options) if options[:update]
 
@@ -65,6 +64,11 @@ module Bundler
           raise InvalidOption, "Removing all platforms from the bundle is not allowed"
         end
 
+        # Adding checksums resolves the bundle to fetch them, so it has to
+        # run after every platform change above has been recorded, or the
+        # new platforms are listed in the lockfile without their specs.
+        definition.add_checksums if options["add-checksums"]
+
         definition.remotely! unless options[:local]
 
         if options["normalize-platforms"]

data/lib/bundler/definition.rb

@@ -748,7 +748,9 @@ module Bundler
       loop do
         break if incomplete_specs.empty?
 
-        Bundler.ui.debug("The lockfile does not have all gems needed for the current platform though, Bundler will still re-resolve dependencies")
+        Bundler.ui.debug("The lockfile does not have all gems needed for the current platform (#{Bundler.local_platform}) though, " \
+                         "Bundler will still re-resolve dependencies. The following locked gems could not be materialized for it: " \
+                         "#{incomplete_specs.map(&:full_name).join(", ")}")
         sources.remote!
         reresolve_without(incomplete_specs)
         specs = resolve.materialize(dependencies)

data/lib/bundler/dsl.rb

@@ -80,11 +80,15 @@ module Bundler
         @gemspecs << spec
 
         path path, "glob" => glob, "name" => spec.name, "gemspec" => spec do
-          add_dependency spec.name
+          options = {}
+          normalize_options(spec.name, [], options)
+          add_dependency spec.name, nil, options
         end
 
         spec.development_dependencies.each do |dep|
-          add_dependency dep.name, dep.requirement.as_list, "gemspec_dev_dep" => true, "group" => development_group
+          options = {}
+          normalize_options(dep.name, dep.requirement.as_list, options)
+          add_dependency dep.name, dep.requirement.as_list, options.merge("gemspec_dev_dep" => true, "group" => development_group)
         end
       when 0
         raise InvalidOption, "There are no gemspecs at #{expanded_path}"

data/lib/bundler/fetcher.rb

@@ -156,7 +156,10 @@ module Bundler
       elsif cached_spec_path = gemspec_cached_path(spec_file_name)
         Bundler.load_gemspec(cached_spec_path)
       else
-        Bundler.safe_load_marshal Bundler.rubygems.inflate(downloader.fetch(uri).body)
+        body = Bundler::Retry.new("fetcher", FAIL_ERRORS).attempts do
+          downloader.fetch(uri).body
+        end
+        Bundler.safe_load_marshal Bundler.rubygems.inflate(body)
       end
       raise MarshalError, "is #{spec.inspect}" unless spec.is_a?(Gem::Specification)
       spec

data/lib/bundler/man/gemfile.5

@@ -461,6 +461,8 @@ The \fBgemspec\fR method adds any runtime dependencies as gem requirements in th
 .P
 The \fBgemspec\fR method supports optional \fB:path\fR, \fB:glob\fR, \fB:name\fR, and \fB:development_group\fR options, which control where bundler looks for the \fB\.gemspec\fR, the glob it uses to look for the gemspec (defaults to: \fB{,*,*/*}\.gemspec\fR), what named \fB\.gemspec\fR it uses (if more than one is present), and which group development dependencies are included in\.
 .P
+When \fBgemspec\fR is called inside a \fBgroup\fR block, the gem requirement on your project goes into that group instead of the default group, and so do its runtime dependencies\. Development dependencies stay in the \fBdevelopment\fR group, or the group given by \fB:development_group\fR\. An enclosing \fBplatforms\fR or \fBinstall_if\fR block applies to the project and its development dependencies alike\.
+.P
 When a \fBgemspec\fR dependency encounters version conflicts during resolution, the local version under development will always be selected \-\- even if there are remote versions that better match other requirements for the \fBgemspec\fR gem\.
 .SH "EVAL_GEMFILE"
 A Gemfile \fBMAY\fR be split across multiple files\. The \fBeval_gemfile\fR method reads the contents of another file as if they appeared in the current Gemfile\. A relative path is resolved against the directory of the file containing the call\.

data/lib/bundler/man/gemfile.5.ronn

@@ -546,6 +546,12 @@ options, which control where bundler looks for the `.gemspec`, the glob it uses
 for the gemspec (defaults to: `{,*,*/*}.gemspec`), what named `.gemspec` it uses
 (if more than one is present), and which group development dependencies are included in.
 
+When `gemspec` is called inside a `group` block, the gem requirement on your
+project goes into that group instead of the default group, and so do its runtime
+dependencies. Development dependencies stay in the `development` group, or the
+group given by `:development_group`. An enclosing `platforms` or `install_if`
+block applies to the project and its development dependencies alike.
+
 When a `gemspec` dependency encounters version conflicts during resolution, the
 local version under development will always be selected -- even if there are
 remote versions that better match other requirements for the `gemspec` gem.

data/lib/bundler/resolver.rb

@@ -499,6 +499,8 @@ module Bundler
       @cooldown_skipped_specs.each do |(name, version), spec|
         resolved = resolved_versions[name]
         next unless resolved && version > resolved
+        package = @base.get_package(name)
+        next if !package.unlock? && package.locked_version == resolved
         next unless requirements[name].all? {|req| req.satisfied_by?(version) }
         newest = newest_skipped[name]
         newest_skipped[name] = spec if newest.nil? || version > newest.version

data/lib/bundler/ruby_dsl.rb

@@ -42,11 +42,12 @@ module Bundler
     # Loads the file relative to the dirname of the Gemfile itself.
     def normalize_ruby_file(filename)
       file_content = Bundler.read_file(gemfile.dirname.join(filename))
-      # match "ruby-3.2.2", ruby = "3.2.2", ruby = '3.2.2' or "ruby   3.2.2" capturing version string up to the first space or comment
+      # match "ruby-3.2.2", ruby = "3.2.2", ruby = '3.2.2', ruby = { version = "3.2.2" } or "ruby   3.2.2" capturing version string up to the first space or comment
       version_match = /^               # Start of line
                       ruby             # Literal "ruby"
                       [\s-]*           # Optional whitespace or hyphens (for "ruby-3.2.2" format)
                       (?:=\s*)?        # Optional equals sign with whitespace (for ruby = "3.2.2" format)
+                      (?:\{[^}]*?\bversion\s*=\s*)? # Optional inline table up to its version key (for ruby = { version = "3.2.2" } format)
                       (?:
                         "([^"]+)"      # Double quoted version
                         |

data/lib/bundler/rubygems_ext.rb

@@ -40,11 +40,22 @@ module Gem
         end
       end
 
-      def open_file_with_lock(path, &block)
+      def open_file_with_lock(path)
         file_lock = "#{path}.lock"
-        open_file_with_flock(file_lock, &block)
-      ensure
-        FileUtils.rm_f file_lock
+
+        loop do
+          open_file_with_flock(file_lock) do |io|
+            # The previous holder removed the file while we were waiting on it,
+            # so leave this block and try again on the file now at the lock path
+            next unless File.identical?(io, file_lock)
+
+            begin
+              return yield io
+            ensure
+              FileUtils.rm_f file_lock
+            end
+          end
+        end
       end
     end
   end

data/lib/bundler/source/rubygems.rb

@@ -76,7 +76,7 @@ module Bundler
       end
 
       def hash
-        @remotes.hash
+        credless_remotes.hash
       end
 
       def eql?(other)

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.23".freeze
+  VERSION = "4.0.24".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 4.0.23
+  version: 4.0.24
 platform: ruby
 authors:
 - André Arko