bundler 4.1.0.beta1 → 4.1.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64a16d95664584fa37c3a29d228d05929ff6ab31adfb8784a8625b242e27563d
-  data.tar.gz: fcf44920ce08c9436bb0076a8a000f2344487858db6ee94644f4d6acced91cc4
+  metadata.gz: 3c0da83afaf51ba4984bf6afadad1dc16ba90dd523a7a70ed5ca4e353fb5a3ef
+  data.tar.gz: 252ab201fa16d64d654b43f3f642d622dbaa94c653b90bddea01af7f8dfdf6a7
 SHA512:
-  metadata.gz: f39b20fc90c76be12671a4f4e5dfe73f697d9d46183786fbf0de925f977675e188fa74db50f3cf010053fdfc62724bdeca2ad65341167ee7f2b2c434a77b9773
-  data.tar.gz: 0f7806fa9c0e09b79eeab58116f92d7f3b0bfd395a091de186a1c129e5cda7595ad02f891f993d0d1436cdfc993692783b8ff3a506d2bbbfbe7028976b0e53cd
+  metadata.gz: d3d0486d8ace2df28048406ccba0335f679c5d7bef8e3ab20c8c72628fb1500ddc3d80ac8ae897b63ecb268a33a7fcb9a826b5833414ee7e63fb46c37e674528
+  data.tar.gz: e9e6a99a38ff138d0fb3bc992843384bf06f732513c65e015c7758fa72dd210c5d369aced9826813799ca189b073270499a109cc4b5290183e67db5010430d3c

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-09-09".freeze
-    @git_commit_sha = "98e4d8083a7".freeze
+    @built_at = "2026-10-08".freeze
+    @git_commit_sha = "f8b8b02".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/common.rb

@@ -122,6 +122,10 @@ module Bundler
       raise GemNotFound, gem_not_found_message(name, Bundler.definition.dependencies)
     end
 
+    def self.select_spec_with_match_type(name, options)
+      select_spec(name, options["exact-match"] ? nil : :regex_match)
+    end
+
     def self.default_gem_spec(name)
       gem_spec = Gem::Specification.find_all_by_name(name).last
       gem_spec if gem_spec&.default_gem?

data/lib/bundler/cli/doctor/ssl.rb

@@ -124,14 +124,10 @@ module Bundler
       ctx = OpenSSL::SSL::SSLContext.new
       supported = true
 
-      if ctx.respond_to?(:min_version=)
-        begin
-          ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
-        rescue OpenSSL::SSL::SSLError, NameError
-          supported = false
-        end
-      else
-        supported = OpenSSL::SSL::SSLContext::METHODS.include?(:TLSv1_2) # rubocop:disable Naming/VariableNumber
+      begin
+        ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
+      rescue OpenSSL::SSL::SSLError, NameError
+        supported = false
       end
 
       Bundler.ui.warn(<<~EOM) unless supported

data/lib/bundler/cli/info.rb

@@ -26,7 +26,7 @@ module Bundler
     private
 
     def spec_for_gem(name)
-      Bundler::CLI::Common.select_spec(name, :regex_match)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
     end
 
     def print_gem_version(spec)

data/lib/bundler/cli/lock.rb

@@ -74,10 +74,21 @@ module Bundler
           puts definition.to_lock
         else
           file = options[:lockfile]
-          file = file ? Pathname.new(file).expand_path : Bundler.default_lockfile
+          file = if file
+            Pathname.new(file).expand_path
+          elsif ENV["BUNDLE_LOCKFILE"].to_s.empty?
+            definition.lockfile
+          else
+            # BUNDLE_LOCKFILE outranks the lockfile method in the Gemfile, see gemfile(5)
+            Bundler.default_lockfile
+          end
 
-          puts "Writing lockfile to #{file}"
-          definition.write_lock(file, false)
+          if file
+            puts "Writing lockfile to #{file}"
+            definition.write_lock(file, false)
+          else
+            Bundler.ui.warn "Not writing a lockfile because the Gemfile sets `lockfile false`"
+          end
         end
 
         Bundler::CLI::Common.output_cooldown_skipped_summary(definition)

data/lib/bundler/cli/open.rb

@@ -13,7 +13,7 @@ module Bundler
       raise InvalidOption, "Cannot specify `--path` option without a value" if !@path.nil? && @path.empty?
       editor = [ENV["BUNDLER_EDITOR"], ENV["VISUAL"], ENV["EDITOR"]].find {|e| !e.nil? && !e.empty? }
       return Bundler.ui.info("To open a bundled gem, set $EDITOR or $BUNDLER_EDITOR") unless editor
-      return unless spec = Bundler::CLI::Common.select_spec(name, :regex_match)
+      return unless spec = spec_for_gem(name)
       if spec.default_gem?
         Bundler.ui.info "Unable to open #{name} because it's a default gem, so the directory it would normally be installed to does not exist."
       else
@@ -35,5 +35,11 @@ module Bundler
       require "shellwords"
       Shellwords.split(editor)
     end
+
+    private
+
+    def spec_for_gem(name)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
+    end
   end
 end

data/lib/bundler/cli/outdated.rb

@@ -90,7 +90,9 @@ module Bundler
         dependency = current_dependencies[current_spec.name]
         groups = ""
         if dependency && !options[:parseable]
-          groups = dependency.groups.join(", ")
+          groups = dependency.groups
+          groups = groups.sort if options_include_groups
+          groups = groups.join(", ")
         end
 
         outdated_gems << {
@@ -101,13 +103,11 @@ module Bundler
         }
       end
 
-      relevant_outdated_gems = if options_include_groups
-        outdated_gems.group_by {|g| g[:groups] }.sort.flat_map do |groups, gems|
-          contains_group = groups.split(", ").include?(options[:group])
-          next unless options[:groups] || contains_group
-
-          gems
-        end.compact
+      relevant_outdated_gems = if options[:groups]
+        without_groups, with_groups = outdated_gems.partition {|g| g[:groups].empty? }
+        with_groups.group_by {|g| g[:groups] }.sort.flat_map(&:last) + without_groups
+      elsif options_include_groups
+        outdated_gems.select {|g| g[:groups].split(", ").include?(options[:group]) }
       else
         outdated_gems
       end
@@ -333,8 +333,6 @@ module Bundler
 
       Bundler.ui.info justify(header, column_sizes)
 
-      data.sort_by! {|row| row[0] }
-
       data.each do |row|
         Bundler.ui.info justify(row, column_sizes)
       end

data/lib/bundler/cli/platform.rb

@@ -25,7 +25,7 @@ module Bundler
       else
         platforms = Bundler.definition.platforms.map {|p| "* #{p}" }
 
-        output << "Your platform is: #{Gem::Platform.local}"
+        output << platform_info
         output << "Your app has gems that work on these platforms:\n#{platforms.join("\n")}"
 
         if ruby_version
@@ -44,5 +44,19 @@ module Bundler
 
       Bundler.ui.info output.join("\n\n")
     end
+
+    private
+
+    def platform_info
+      info = "Your platform is: #{Gem::Platform.local}"
+      return info if Bundler.local_platform == Gem::Platform.local
+
+      info + "\nHowever, your effective platform is: #{Bundler.local_platform} " \
+        "(because force_ruby_platform is #{force_ruby_platform_origin})"
+    end
+
+    def force_ruby_platform_origin
+      Bundler.settings.pretty_values_for(:force_ruby_platform).first.sub(/\ASet /, "set ")
+    end
   end
 end

data/lib/bundler/cli/show.rb

@@ -20,7 +20,7 @@ module Bundler
         if gem_name == "bundler"
           path = File.expand_path("../../..", __dir__)
         else
-          spec = Bundler::CLI::Common.select_spec(gem_name, :regex_match)
+          spec = spec_for_gem(gem_name)
           return unless spec
           path = spec.full_gem_path
           unless File.directory?(path)
@@ -55,6 +55,10 @@ module Bundler
 
     private
 
+    def spec_for_gem(name)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
+    end
+
     def fetch_latest_specs
       definition = Bundler.definition(true)
       Bundler.ui.info "Fetching remote specs for outdated check...\n\n"

data/lib/bundler/cli/update.rb

@@ -13,7 +13,7 @@ module Bundler
 
       update_bundler = options[:bundler]
 
-      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler) if update_bundler
+      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler, pre: options[:pre]) if update_bundler
 
       sources = Array(options[:source])
       groups  = Array(options[:group]).map(&:to_sym)

data/lib/bundler/cli.rb

@@ -177,7 +177,7 @@ module Bundler
         else
           puts File.read("#{man_path}/#{File.basename(man_page)}.ronn")
         end
-      elsif command_path = Bundler.which("bundler-#{cli}")
+      elsif command_path = self.class.bundler_command_path(cli)
         Kernel.exec(command_path, "--help")
       else
         super
@@ -189,11 +189,23 @@ module Bundler
         return Bundler::Plugin.exec_command(command, ARGV[1..-1])
       end
 
-      return super unless command_path = Bundler.which("bundler-#{command}")
+      return super unless command_path = bundler_command_path(command)
 
       Kernel.exec(command_path, *ARGV[1..-1])
     end
 
+    # Only PATH is searched, unlike Bundler.which, which also finds a file in
+    # the current directory and returns a bare name that Kernel.exec cannot run.
+    def self.bundler_command_path(command)
+      ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |path|
+        path = path[1..-2] if path.start_with?('"') && path.end_with?('"')
+        command_path = Bundler.find_executable(File.expand_path("bundler-#{command}", path))
+        return command_path if command_path
+      end
+
+      nil
+    end
+
     desc "init [OPTIONS]", "Generates a Gemfile into the current working directory"
     long_desc <<-D
       Init generates a default Gemfile in the current working directory. When adding a
@@ -319,10 +331,10 @@ module Bundler
     method_option "source", type: :array, banner: "Update a specific source (and all gems associated with it)"
     method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "ruby", type: :boolean, banner: "Update ruby specified in Gemfile.lock"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "Always choose the highest allowed version when updating gems, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "Do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "Use bundle install conservative update behavior and do not allow shared dependencies to be updated."
@@ -342,6 +354,7 @@ module Bundler
     D
     method_option "paths", type: :boolean, banner: "List the paths of all gems that are required by your Gemfile."
     method_option "outdated", type: :boolean, banner: "Show verbose output including whether gems are outdated (removed)."
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def show(gem_name = nil)
       if ARGV.include?("--outdated")
         removed_message = "the `--outdated` flag to `bundle show` has been removed in favor of `bundle show --verbose`"
@@ -367,6 +380,7 @@ module Bundler
     desc "info GEM [OPTIONS]", "Show information for the given gem"
     method_option "path", type: :boolean, banner: "Print full path to gem"
     method_option "version", type: :boolean, banner: "Print gem version"
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def info(gem_name)
       require_relative "cli/info"
       Info.new(options, gem_name).run
@@ -434,7 +448,7 @@ module Bundler
     method_option "filter-strict", type: :boolean, aliases: "--strict", banner: "Only list newer versions allowed by your Gemfile requirements"
     method_option "update-strict", type: :boolean, banner: "Strict conservative resolution, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "filter-major", type: :boolean, banner: "Only list major newer versions"
     method_option "filter-minor", type: :boolean, banner: "Only list minor newer versions"
@@ -530,6 +544,7 @@ module Bundler
 
     desc "open GEM", "Opens the source directory of the given bundled gem"
     method_option "path", type: :string, lazy_default: "", banner: "Open relative path of the gem source."
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def open(name)
       require_relative "cli/open"
       Open.new(options, name).run
@@ -640,11 +655,11 @@ module Bundler
     method_option "normalize-platforms", type: :boolean, default: false, banner: "Normalize lockfile platforms"
     method_option "patch", type: :boolean, banner: "If updating, prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "If updating, prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "If updating, prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "If updating, prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "If updating, always choose the highest allowed version, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"

data/lib/bundler/constants.rb

@@ -3,7 +3,7 @@
 require "rbconfig"
 
 module Bundler
-  WINDOWS = RbConfig::CONFIG["host_os"] =~ /(msdos|mswin|djgpp|mingw)/
+  WINDOWS = RbConfig::CONFIG["host_os"] =~ /(mswin|mingw)/
   deprecate_constant :WINDOWS
 
   FREEBSD = RbConfig::CONFIG["host_os"].to_s.include?("bsd")

data/lib/bundler/definition.rb

@@ -198,7 +198,7 @@ module Bundler
 
       sources.cached!
 
-      if options[:add_checksums] || (!options[:local] && (install_needed? || refetch_needed?(options)))
+      if options[:add_checksums] || (!options[:local] && (install_needed? || refetch_needed?(options) || @locked_spec_with_empty_checksums))
         sources.remote!
         true
       else
@@ -346,7 +346,9 @@ module Bundler
     #
     # @return [SpecSet] resolved dependencies
     def resolve
-      @resolve ||= if Bundler.frozen_bundle?
+      return @resolve if @resolve
+
+      @resolve = if Bundler.frozen_bundle?
         Bundler.ui.debug "Frozen, using resolution from the lockfile"
         @locked_specs
       elsif no_resolve_needed?
@@ -366,6 +368,8 @@ module Bundler
 
         start_resolution
       end
+      warn_inert_overrides(@resolve)
+      @resolve
     end
 
     def spec_git_paths
@@ -650,7 +654,7 @@ module Bundler
         @missing_lockfile_dep ||
         @unlocking_bundler ||
         @locked_spec_with_missing_checksums ||
-        @locked_spec_with_empty_checksums ||
+        empty_checksums_actionable? ||
         @locked_spec_with_missing_deps ||
         @locked_spec_with_invalid_deps
     end
@@ -659,6 +663,16 @@ module Bundler
       unlocking? || something_changed?
     end
 
+    # Only a remote fetch can fill an empty CHECKSUMS entry, so it justifies a
+    # resolution only when one is coming. Resolving locally for it would repeat
+    # on every `Bundler.setup` without changing the lockfile. Frozen mode still
+    # has to refuse the entry.
+    def empty_checksums_actionable?
+      return false unless @locked_spec_with_empty_checksums
+
+      Bundler.frozen_bundle? || !sources.local_mode?
+    end
+
     def should_add_extra_platforms?
       !lockfile_exists? && Bundler::MatchPlatform.generic_local_platform_is_ruby? && !Bundler.settings[:force_ruby_platform]
     end
@@ -1095,25 +1109,61 @@ module Bundler
       end
 
       converge_overrides_outside_dependencies
+      converge_rewritten_dependencies
 
       @changed_dependencies.any?
     end
 
-    def converge_overrides_outside_dependencies
+    # The lockfile keeps the upstream dependencies of every gem, so a gem that
+    # a `from:`/`to:` override cut loose stays locked until a resolution drops
+    # it.
+    def converge_rewritten_dependencies
       @overrides.each do |override|
-        # :all overrides are intentionally not pre-unlocked. They take effect on
-        # fresh resolution (no lockfile) or when the user runs `bundle update`.
-        # Forcing a full re-resolve from a single :all directive would surprise
-        # users with unrelated dependency churn.
-        next unless override.target.is_a?(String)
+        next unless override.from
 
         name = override.target
-        next if @changed_dependencies.include?(name)
         next if @originally_locked_specs[name].empty?
-        # version: overrides on direct deps are detected in the per-dep
+        next if @dependencies.any? {|d| d.name == name }
+
+        still_required = @originally_locked_specs.any? do |s|
+          Override.rewrite_dependencies(@overrides, s.name, s.runtime_dependencies).any? {|d| d.name == name }
+        end
+        next if still_required
+
+        @gems_to_unlock << name
+        @changed_dependencies << name
+      end
+    end
+
+    # A misspelled `from:` gem leaves the override with nothing to rewrite.
+    def warn_inert_overrides(specs)
+      @overrides.each do |override|
+        next unless override.from
+        next if specs[override.from].any? {|s| s.dependencies.any? {|d| d.name == override.target } }
+
+        Bundler.ui.warn "#{override} has no effect because the bundle has no #{override.from} that depends on #{override.target}"
+      end
+    end
+
+    def converge_overrides_outside_dependencies
+      @overrides.each do |override|
+        # :all and metadata overrides are intentionally not pre-unlocked. The
+        # lockfile does not record overrides, so unlocking for them would
+        # re-resolve on every run and reject every frozen install. Install-time
+        # compatibility checks already honor them for locked specs, and they
+        # affect resolution on a fresh lock or when the user runs `bundle update`.
+        next unless override.target.is_a?(String) && override.field == :version
+
+        name = override.target
+        # Overrides on direct deps are detected in the per-dep
         # converge_dependencies loop via apply_override_to + matches_spec?.
-        # Other fields are not visible there, so they always reach here.
-        next if override.field == :version && @dependencies.any? {|d| d.name == name }
+        next if @dependencies.any? {|d| d.name == name }
+
+        locked_specs = @originally_locked_specs[name]
+        next if locked_specs.empty?
+        # Only a version string constrains on its own. :ignore_upper and nil
+        # loosen requirements the lockfile already satisfies.
+        next if override.apply_to(Gem::Requirement.default).satisfied_by?(locked_specs.first.version)
 
         @gems_to_unlock << name
         @changed_dependencies << name
@@ -1342,7 +1392,7 @@ module Bundler
     end
 
     def source_map
-      @source_map ||= SourceMap.new(sources, dependencies, @locked_specs)
+      @source_map ||= SourceMap.new(sources, dependencies, @locked_specs, @overrides.filter_map {|o| o.operation if o.from })
     end
 
     def new_resolver_for_full_update

data/lib/bundler/dsl.rb

@@ -17,7 +17,7 @@ module Bundler
     VALID_PLATFORMS = Bundler::CurrentRuby::PLATFORM_MAP.keys.freeze
 
     VALID_KEYS = %w[group groups git path glob name branch ref tag require submodules
-                    platform platforms source install_if force_ruby_platform].freeze
+                    platform platforms source install_if force_ruby_platform sparse_checkout].freeze
 
     GITHUB_PULL_REQUEST_URL = %r{\Ahttps://github\.com/([A-Za-z0-9_\-\.]+/[A-Za-z0-9_\-\.]+)/pull/(\d+)\z}
     GITLAB_MERGE_REQUEST_URL = %r{\Ahttps://gitlab\.com/([A-Za-z0-9_\-\./]+)/-/merge_requests/(\d+)\z}
@@ -200,6 +200,12 @@ module Bundler
 
     def override(target, **operations)
       validate_override_target!(target)
+      source_location = caller_locations(1, 1)&.first
+
+      if operations.key?(:from) || operations.key?(:to)
+        add_dependency_override(target, operations, source_location)
+        return
+      end
 
       if target == :all && operations.key?(:version)
         raise ArgumentError, "`override :all, version:` is not allowed; version requirements are per-gem"
@@ -211,7 +217,6 @@ module Bundler
         validate_override_uniqueness!(target, field)
       end
 
-      source_location = caller_locations(1, 1)&.first
       operations.each do |field, operation|
         @overrides << Override.new(target, field, operation, source_location: source_location)
       end
@@ -219,6 +224,7 @@ module Bundler
 
     def to_definition(lockfile, unlock)
       check_primary_source_safety
+      check_dropped_dependencies
       lockfile = @lockfile unless @lockfile.nil?
       Definition.new(lockfile, @dependencies, @sources, unlock, @ruby_version, @optional_groups, @gemfiles, @overrides)
     end
@@ -317,6 +323,54 @@ module Bundler
       raise ArgumentError, "duplicate override for #{target.inspect} `#{field}:`"
     end
 
+    def add_dependency_override(target, operations, source_location)
+      unless operations.key?(:from)
+        raise ArgumentError, "`override #{target.inspect}, to:` requires `from:` naming the gem whose dependency is rewritten"
+      end
+      unless operations.key?(:to)
+        raise ArgumentError, "`override #{target.inspect}, from:` requires `to:`; use `to: nil` to drop the dependency or `to: \"<gem>\"` to replace it"
+      end
+
+      from = operations[:from]
+      to = operations[:to]
+      requirement = operations[:version]
+
+      raise ArgumentError, "`override :all` does not accept `from:`" if target == :all
+      raise ArgumentError, "`from:` must be a gem name string, got #{from.inspect}" unless from.is_a?(String)
+      raise ArgumentError, "`to:` must be a gem name string or nil, got #{to.inspect}" unless to.nil? || to.is_a?(String)
+      raise ArgumentError, "`to:` must name a gem other than #{target.inspect} and #{from.inspect}" if to == target || to == from
+      validate_gem_name!(from)
+      validate_gem_name!(to) if to
+
+      unsupported = operations.keys - [:from, :to, :version]
+      if unsupported.any?
+        raise ArgumentError, "unsupported override field `#{unsupported.first}:` with `from:`; supported fields: `to:`, `version:`"
+      end
+
+      if operations.key?(:version)
+        raise ArgumentError, "`version:` with `from:` requires `to:` to name a replacement gem" if to.nil?
+        raise ArgumentError, "`version:` with `from:` must be a version requirement string, got #{requirement.inspect}" unless requirement.is_a?(String)
+        validate_override_operation!(requirement)
+      end
+
+      if @overrides.any? {|o| o.target == target && o.from == from }
+        raise ArgumentError, "duplicate override for #{target.inspect} `from: #{from.inspect}`"
+      end
+
+      @overrides << Override.new(target, :to, to, from: from, requirement: requirement, source_location: source_location)
+    end
+
+    # Dropping a gem the Gemfile requires directly would leave it installed
+    # anyway, with only the parent's requirement gone.
+    def check_dropped_dependencies
+      @overrides.each do |override|
+        next unless override.from && override.operation.nil?
+        next unless @dependencies.any? {|d| d.name == override.target }
+
+        raise GemfileError, "#{override} cannot drop #{override.target} because the Gemfile depends on it directly"
+      end
+    end
+
     def add_dependency(name, version = nil, options = {})
       options["gemfile"] = @gemfile
       options["source"] ||= @source
@@ -460,7 +514,7 @@ module Bundler
       @valid_keys ||= VALID_KEYS
     end
 
-    def normalize_options(name, version, opts)
+    def validate_gem_name!(name)
       if name.is_a?(Symbol)
         raise GemfileError, %(You need to specify gem names as Strings. Use 'gem "#{name}"' instead)
       end
@@ -468,6 +522,10 @@ module Bundler
         raise GemfileError, %('#{name}' is not a valid gem name because it contains whitespace)
       end
       raise GemfileError, %(an empty gem name is not valid) if name.empty?
+    end
+
+    def normalize_options(name, version, opts)
+      validate_gem_name!(name)
 
       normalize_hash(opts)
 

data/lib/bundler/fetcher/downloader.rb

@@ -56,9 +56,13 @@ module Bundler
           if https?(uri) && !https?(new_uri)
             raise HTTPError, "Redirecting to a non-https URI is not allowed: #{URICredentialsFilter.credential_filtered_uri(new_uri)}"
           end
-          if new_uri.host == uri.host
+          if [new_uri.scheme, new_uri.host, new_uri.port] == [uri.scheme, uri.host, uri.port]
             new_uri.user = uri.user
             new_uri.password = uri.password
+          else
+            # see Gem::RemoteFetcher#fetch_http. A nil value removes the header
+            # that ConnectionPools adds from its override_headers.
+            headers = headers.merge("X-Gemfile-Source" => nil)
           end
           fetch(new_uri, headers, counter + 1)
         when Gem::Net::HTTPRequestedRangeNotSatisfiable

data/lib/bundler/gem_helper.rb

@@ -216,7 +216,7 @@ module Bundler
       Bundler.ui.debug(cmd)
       SharedHelpers.chdir(base) do
         outbuf = IO.popen(cmd, err: [:child, :out], &:read)
-        status = $?
+        status = Process.last_status
         block&.call(outbuf) if status.success?
         [outbuf, status]
       end

data/lib/bundler/installer/parallel_installer.rb

@@ -69,7 +69,8 @@ module Bundler
       @specs = all_specs.map {|s| SpecInstallation.new(s) }
       specs_by_name = @specs.to_h {|s| [s.name, s] }
       @specs.each do |spec_install|
-        spec_install.dependencies = spec_install.spec.dependencies.filter_map do |dep|
+        dependencies = Override.rewrite_dependencies(installer.definition.overrides, spec_install.name, spec_install.spec.dependencies)
+        spec_install.dependencies = dependencies.filter_map do |dep|
           specs_by_name[dep.name] unless dep.type == :development || dep.name == spec_install.name
         end
       end

data/lib/bundler/installer.rb

@@ -103,7 +103,7 @@ module Bundler
 
       if options[:binstubs_cmd] && spec.executables.empty?
         options = {}
-        spec.runtime_dependencies.each do |dep|
+        Override.rewrite_dependencies(@definition.overrides, spec.name, spec.runtime_dependencies).each do |dep|
           bins = @definition.specs[dep].first.executables
           options[dep.name] = bins unless bins.empty?
         end
@@ -127,6 +127,8 @@ module Bundler
       template_path = File.expand_path("templates/Executable", __dir__)
       template = File.read(template_path)
 
+      Bundler.mkdir_p(bin_path)
+
       exists = []
       spec.executables.each do |executable|
         binstub_path = "#{bin_path}/#{executable}"
@@ -173,6 +175,8 @@ module Bundler
       ruby_command = Thor::Util.ruby_command
       ruby_command = ruby_command
 
+      Bundler.mkdir_p(bin_path)
+
       spec.executables.each do |executable|
         next if executable == "bundle"
         executable_path = Pathname(spec.full_gem_path).join(spec.bindir, executable).relative_path_from(bin_path)

data/lib/bundler/lazy_specification.rb

@@ -286,7 +286,7 @@ module Bundler
     # which would affect `bundler/setup` performance.
     def validate_dependencies(spec)
       if !@materialization_options[:strict] && spec.is_a?(StubSpecification)
-        spec.dependencies = dependencies
+        spec.dependencies = Override.rewrite_dependencies(overrides, name, dependencies)
       else
         if !source.is_a?(Source::Path) && spec.runtime_dependencies.sort != dependencies.sort
           raise IncorrectLockfileDependencies.new(self, spec.runtime_dependencies, dependencies)

data/lib/bundler/lockfile_parser.rb

@@ -49,7 +49,7 @@ module Bundler
     PATH         = "PATH"
     PLUGIN       = "PLUGIN SOURCE"
     SPECS        = "  specs:"
-    OPTIONS      = /^  ([a-z]+): (.*)$/i
+    OPTIONS      = /^  ([a-z_]+): (.*)$/i
     SOURCE       = [GIT, GEM, PATH, PLUGIN].freeze
 
     SECTIONS_BY_VERSION_INTRODUCED = {