bundler 4.1.0.beta1 → 4.1.0.beta2

data/lib/bundler/man/bundle-info.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-info\fR \- Show information for the given gem in your bundle
 .SH "SYNOPSIS"
-\fBbundle info\fR [GEM_NAME] [\-\-path] [\-\-version]
+\fBbundle info\fR [GEM_NAME] [\-\-path] [\-\-version] [\-\-exact\-match]
 .SH "DESCRIPTION"
 Given a gem name present in your bundle, print the basic information about it such as homepage, version, path and summary\.
 .SH "OPTIONS"
@@ -14,4 +14,7 @@ Print the path of the given gem
 .TP
 \fB\-\-version\fR
 Print gem version
+.TP
+\fB\-\-exact\-match\fR
+Only match gems whose names exactly match the given name\.
 

data/lib/bundler/man/bundle-info.1.ronn

@@ -6,6 +6,7 @@ bundle-info(1) -- Show information for the given gem in your bundle
 `bundle info` [GEM_NAME]
               [--path]
               [--version]
+              [--exact-match]
 
 ## DESCRIPTION
 
@@ -19,3 +20,6 @@ Given a gem name present in your bundle, print the basic information about it
 
 * `--version`:
   Print gem version
+
+* `--exact-match`:
+  Only match gems whose names exactly match the given name.

data/lib/bundler/man/bundle-lock.1

@@ -13,7 +13,7 @@ Lock the gems specified in Gemfile\.
 Ignores the existing lockfile\. Resolve then updates lockfile\. Taking a list of gems or updating all gems if no list is given\.
 .TP
 \fB\-\-bundler[=BUNDLER]\fR
-Update the locked version of bundler to the given version or the latest version if no version is given\.
+Update the locked version of bundler\. BUNDLER can be a version such as \fB4\.0\.20\fR, or a requirement such as \fB"> 0\.a"\fR\. With no argument, update to the latest released version, which never selects a prerelease\.
 .TP
 \fB\-\-local\fR
 Do not attempt to connect to \fBrubygems\.org\fR\. Instead, Bundler will use the gems already present in Rubygems' cache or in \fBvendor/cache\fR\. Note that if a appropriate platform\-specific gem exists on \fBrubygems\.org\fR it will not be found\.
@@ -49,7 +49,7 @@ If updating, prefer updating only to next patch version\.
 If updating, prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-If updating, prefer updating to next major version (default)\.
+If updating, prefer updating to latest major version (default)\.
 .TP
 \fB\-\-pre\fR
 If updating, always choose the highest allowed version, regardless of prerelease status\.

data/lib/bundler/man/bundle-lock.1.ronn

@@ -33,8 +33,9 @@ Lock the gems specified in Gemfile.
   of gems or updating all gems if no list is given.
 
 * `--bundler[=BUNDLER]`:
-  Update the locked version of bundler to the given version or the latest
-  version if no version is given.
+  Update the locked version of bundler. BUNDLER can be a version such as
+  `4.0.20`, or a requirement such as `"> 0.a"`. With no argument, update to the
+  latest released version, which never selects a prerelease.
 
 * `--local`:
   Do not attempt to connect to `rubygems.org`. Instead, Bundler will use the
@@ -74,7 +75,7 @@ Lock the gems specified in Gemfile.
   If updating, prefer updating only to next minor version.
 
 * `--major`:
-  If updating, prefer updating to next major version (default).
+  If updating, prefer updating to latest major version (default).
 
 * `--pre`:
   If updating, always choose the highest allowed version, regardless of prerelease status.

data/lib/bundler/man/bundle-open.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-open\fR \- Opens the source directory for a gem in your bundle
 .SH "SYNOPSIS"
-\fBbundle open\fR [GEM] [\-\-path=PATH]
+\fBbundle open\fR [GEM] [\-\-path=PATH] [\-\-exact\-match]
 .SH "DESCRIPTION"
 Opens the source directory of the provided GEM in your editor\.
 .P
@@ -29,4 +29,7 @@ Will open the README\.md file of the 'rack' gem source in your bundle\.
 .TP
 \fB\-\-path[=PATH]\fR
 Specify GEM source relative path to open\.
+.TP
+\fB\-\-exact\-match\fR
+Only match gems whose names exactly match the given name\.
 

data/lib/bundler/man/bundle-open.1.ronn

@@ -3,7 +3,7 @@ bundle-open(1) -- Opens the source directory for a gem in your bundle
 
 ## SYNOPSIS
 
-`bundle open` [GEM] [--path=PATH]
+`bundle open` [GEM] [--path=PATH] [--exact-match]
 
 ## DESCRIPTION
 
@@ -26,3 +26,6 @@ Will open the README.md file of the 'rack' gem source in your bundle.
 
 * `--path[=PATH]`:
   Specify GEM source relative path to open.
+
+* `--exact-match`:
+  Only match gems whose names exactly match the given name.

data/lib/bundler/man/bundle-outdated.1

@@ -37,7 +37,7 @@ List gems organized by groups\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-patch\fR
 Prefer updating only to next patch version\.

data/lib/bundler/man/bundle-outdated.1.ronn

@@ -55,7 +55,7 @@ are up to date, Bundler will exit with a status of 0. Otherwise, it will exit 1.
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--patch`:
   Prefer updating only to next patch version.

data/lib/bundler/man/bundle-show.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-show\fR \- Shows all the gems in your bundle, or the path to a gem
 .SH "SYNOPSIS"
-\fBbundle show\fR [GEM] [\-\-paths]
+\fBbundle show\fR [GEM] [\-\-paths] [\-\-exact\-match]
 .SH "DESCRIPTION"
 Without the [GEM] option, \fBshow\fR will print a list of the names and versions of all gems that are required by your [\fBGemfile(5)\fR][Gemfile(5)], sorted by name\.
 .P
@@ -13,4 +13,7 @@ Calling show with [GEM] will list the exact location of that gem on your machine
 .TP
 \fB\-\-paths\fR
 List the paths of all gems that are required by your [\fBGemfile(5)\fR][Gemfile(5)], sorted by gem name\.
+.TP
+\fB\-\-exact\-match\fR
+Only match gems whose names exactly match the given name\.
 

data/lib/bundler/man/bundle-show.1.ronn

@@ -5,6 +5,7 @@ bundle-show(1) -- Shows all the gems in your bundle, or the path to a gem
 
 `bundle show` [GEM]
               [--paths]
+              [--exact-match]
 
 ## DESCRIPTION
 
@@ -19,3 +20,6 @@ machine.
 * `--paths`:
   List the paths of all gems that are required by your [`Gemfile(5)`][Gemfile(5)],
   sorted by gem name.
+
+* `--exact-match`:
+  Only match gems whose names exactly match the given name.

data/lib/bundler/man/bundle-update.1

@@ -27,7 +27,7 @@ Do not attempt to fetch gems remotely and use the gem cache instead\.
 Update the locked version of Ruby to the current version of Ruby\.
 .TP
 \fB\-\-bundler[=BUNDLER]\fR
-Update the locked version of bundler to the invoked bundler version\.
+Update the locked version of bundler\. BUNDLER can be a version such as \fB4\.0\.20\fR, or a requirement such as \fB"> 0\.a"\fR\. With no argument, update to the latest released version, which never selects a prerelease\.
 .TP
 \fB\-\-force\fR, \fB\-\-redownload\fR
 Force reinstalling every gem, even if already installed\.
@@ -54,7 +54,7 @@ Prefer updating only to next patch version\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-pre\fR
 Always choose the highest allowed version, regardless of prerelease status\.
@@ -175,7 +175,7 @@ Prefer updating only to next patch version\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-strict\fR
 Do not allow any gem to be updated past latest \fB\-\-patch\fR | \fB\-\-minor\fR | \fB\-\-major\fR\.

data/lib/bundler/man/bundle-update.1.ronn

@@ -53,7 +53,9 @@ gem.
   Update the locked version of Ruby to the current version of Ruby.
 
 * `--bundler[=BUNDLER]`:
-  Update the locked version of bundler to the invoked bundler version.
+  Update the locked version of bundler. BUNDLER can be a version such as
+  `4.0.20`, or a requirement such as `"> 0.a"`. With no argument, update to the
+  latest released version, which never selects a prerelease.
 
 * `--force`, `--redownload`:
   Force reinstalling every gem, even if already installed.
@@ -81,7 +83,7 @@ gem.
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--pre`:
   Always choose the highest allowed version, regardless of prerelease status.
@@ -236,7 +238,7 @@ versions are resolved. One of the following options can be used: `--patch`,
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--strict`:
   Do not allow any gem to be updated past latest `--patch` | `--minor` | `--major`.

data/lib/bundler/man/gemfile.5

@@ -295,6 +295,13 @@ gem "rails", git: "https://github\.com/rails/rails\.git", ref: "4aded"
 .TP
 \fBsubmodules\fR
 For reference, a git submodule \fIhttps://git\-scm\.com/book/en/v2/Git\-Tools\-Submodules\fR lets you have another git repository within a subfolder of your repository\. Specify \fBsubmodules: true\fR to cause bundler to expand any submodules included in the git repository
+.TP
+\fBsparse_checkout\fR
+Specify a directory, or an array of directories, to include when checking out a git repository\. Uses git's sparse\-checkout feature (requires git 2\.25+) to only check out the specified directories, reducing disk usage for large repos\. Unless \fBglob\fR is given, the \fB\.gemspec\fR is looked up within those directories\.
+.IP
+gem "foo", git: "https://github\.com/org/monorepo\.git", sparse_checkout: "packages/foo"
+.IP
+Files at the top level of the repository are always checked out\. On git versions below 2\.25, the entire repository will be checked out with a warning\.
 .P
 If a git repository contains multiple \fB\.gemspecs\fR, each \fB\.gemspec\fR represents a gem located at the same place in the file system as the \fB\.gemspec\fR\.
 .IP "" 4
@@ -490,7 +497,7 @@ a version requirement string (e\.g\. \fB">= 8\.0"\fR), which \fBreplaces\fR the
 .P
 \fB:all\fR only applies to \fBrequired_ruby_version:\fR and \fBrequired_rubygems_version:\fR\. A per\-gem override on the same field takes precedence over an \fB:all\fR override\. \fB:all + version:\fR is rejected: version requirements only make sense per gem\.
 .P
-Multiple \fBoverride\fR calls for distinct targets are allowed; declaring the same \fBtarget\fR and \fBfield\fR twice is an error\.
+Declaring the same \fBtarget\fR and \fBfield\fR twice is an error\.
 .IP "" 4
 .nf
 source "https://rubygems\.org"
@@ -515,6 +522,31 @@ gem "rails", "~> 7\.0"
 .IP "" 0
 .P
 The override only affects resolution and the install\-time Ruby/RubyGems compatibility checks; \fBGemfile\.lock\fR continues to reflect the resolved versions, not the rewritten requirements\. When resolution still fails, Bundler appends the active overrides (with their Gemfile location) to the error message so it is clear which override shaped the constraint set\.
+.SS "DROPPING OR REPLACING A DEPENDENCY"
+\fBfrom:\fR and \fBto:\fR rewrite a single dependency of a single gem:
+.IP "" 4
+.nf
+override <target>, from: <gem>, to: nil
+override <target>, from: <gem>, to: <replacement>, version: <requirement>
+.fi
+.IP "" 0
+.P
+\fBto: nil\fR removes the dependency of \fB<gem>\fR on \fB<target>\fR, so \fB<target>\fR is not installed unless something else still requires it\. \fBto: <replacement>\fR makes \fB<gem>\fR depend on \fB<replacement>\fR instead of \fB<target>\fR\. The requirement \fB<gem>\fR put on \fB<target>\fR is discarded, and the optional \fBversion:\fR gives the replacement its own\. Both forms apply whether \fB<gem>\fR is a direct or a transitive dependency\.
+.P
+\fBfrom:\fR is required, and so is \fBto:\fR once \fBfrom:\fR is given\. To rewrite the same dependency of several gems, write one \fBoverride\fR per gem\. It is an error to declare the same \fB<target>\fR and \fBfrom:\fR twice, to drop a gem that the Gemfile requires directly, or to replace a gem that another gem still requires, since both would then be in the bundle\.
+.IP "" 4
+.nf
+# jekyll only loads em\-websocket for `jekyll serve \-\-livereload`\.
+override "em\-websocket", from: "jekyll", to: nil
+
+# Use an API\-compatible gem that provides the same files\.
+override "foo", from: "bar", to: "foo\-lite"
+.fi
+.IP "" 0
+.P
+Bundler does not check what a gem loads at runtime\. If \fB<gem>\fR requires \fB<target>\fR unconditionally, dropping it makes that require raise \fBLoadError\fR, as with jekyll's dependency on jekyll\-sass\-converter or the adapters that faraday 1\.x requires on load\. A replacement only works when it provides the files \fB<gem>\fR requires, and it does not take over the name of \fB<target>\fR: \fBGem\.loaded_specs\fR has no entry for \fB<target>\fR, and \fBgem "<target>"\fR fails\.
+.P
+\fBGemfile\.lock\fR keeps listing \fB<target>\fR under \fB<gem>\fR as the gem publishes it, while the locked gems leave \fB<target>\fR out or include \fB<replacement>\fR\. A frozen install accepts that lockfile as long as the Gemfile still has the override\. Removing the override makes Bundler resolve \fB<target>\fR again\.
 .SH "SOURCE PRIORITY"
 When attempting to locate a gem to satisfy a gem requirement, bundler uses the following priority order:
 .IP "1." 4

data/lib/bundler/man/gemfile.5.ronn

@@ -359,6 +359,20 @@ Git repositories support a number of additional options.
     Specify `submodules: true` to cause bundler to expand any
     submodules included in the git repository
 
+  * `sparse_checkout`:
+    Specify a directory, or an array of directories, to include when
+    checking out a git repository. Uses git's sparse-checkout feature
+    (requires git 2.25+) to only check out the specified directories,
+    reducing disk usage for large repos. Unless `glob` is given, the
+    `.gemspec` is looked up within those directories.
+
+      gem "foo", git: "https://github.com/org/monorepo.git",
+                 sparse_checkout: "packages/foo"
+
+    Files at the top level of the repository are always checked out.
+    On git versions below 2.25, the entire repository will be checked
+    out with a warning.
+
 If a git repository contains multiple `.gemspecs`, each `.gemspec`
 represents a gem located at the same place in the file system as
 the `.gemspec`.
@@ -587,8 +601,7 @@ one of:
 A per-gem override on the same field takes precedence over an `:all` override.
 `:all + version:` is rejected: version requirements only make sense per gem.
 
-Multiple `override` calls for distinct targets are allowed; declaring the
-same `target` and `field` twice is an error.
+Declaring the same `target` and `field` twice is an error.
 
     source "https://rubygems.org"
 
@@ -615,6 +628,44 @@ versions, not the rewritten requirements. When resolution still fails,
 Bundler appends the active overrides (with their Gemfile location) to the
 error message so it is clear which override shaped the constraint set.
 
+### DROPPING OR REPLACING A DEPENDENCY
+
+`from:` and `to:` rewrite a single dependency of a single gem:
+
+    override <target>, from: <gem>, to: nil
+    override <target>, from: <gem>, to: <replacement>, version: <requirement>
+
+`to: nil` removes the dependency of `<gem>` on `<target>`, so `<target>` is
+not installed unless something else still requires it. `to: <replacement>`
+makes `<gem>` depend on `<replacement>` instead of `<target>`. The requirement
+`<gem>` put on `<target>` is discarded, and the optional `version:` gives the
+replacement its own. Both forms apply whether `<gem>` is a direct or a
+transitive dependency.
+
+`from:` is required, and so is `to:` once `from:` is given. To rewrite the
+same dependency of several gems, write one `override` per gem. It is an error
+to declare the same `<target>` and `from:` twice, to drop a gem that the
+Gemfile requires directly, or to replace a gem that another gem still
+requires, since both would then be in the bundle.
+
+    # jekyll only loads em-websocket for `jekyll serve --livereload`.
+    override "em-websocket", from: "jekyll", to: nil
+
+    # Use an API-compatible gem that provides the same files.
+    override "foo", from: "bar", to: "foo-lite"
+
+Bundler does not check what a gem loads at runtime. If `<gem>` requires
+`<target>` unconditionally, dropping it makes that require raise `LoadError`,
+as with jekyll's dependency on jekyll-sass-converter or the adapters that
+faraday 1.x requires on load. A replacement only works when it provides the
+files `<gem>` requires, and it does not take over the name of `<target>`:
+`Gem.loaded_specs` has no entry for `<target>`, and `gem "<target>"` fails.
+
+`Gemfile.lock` keeps listing `<target>` under `<gem>` as the gem publishes it,
+while the locked gems leave `<target>` out or include `<replacement>`. A
+frozen install accepts that lockfile as long as the Gemfile still has the
+override. Removing the override makes Bundler resolve `<target>` again.
+
 ## SOURCE PRIORITY
 
 When attempting to locate a gem to satisfy a gem requirement,

data/lib/bundler/materialization.rb

@@ -30,7 +30,9 @@ module Bundler
     end
 
     def dependencies
-      (materialized_spec || specs.first).runtime_dependencies.map {|d| [d, platform] }
+      spec = materialized_spec || specs.first
+      overrides = specs.first.overrides if specs.first.is_a?(LazySpecification)
+      Override.rewrite_dependencies(overrides, spec.name, spec.runtime_dependencies).map {|d| [d, platform] }
     end
 
     def materialized_spec

data/lib/bundler/override.rb

@@ -9,6 +9,20 @@ module Bundler
         overrides.find {|o| o.target == :all && o.field == field }
     end
 
+    # Drops or replaces the dependencies of the gem named `from` that a
+    # `from:`/`to:` override targets. The requirement `from` put on the
+    # replaced gem is discarded.
+    def self.rewrite_dependencies(overrides, from, dependencies)
+      return dependencies if overrides.nil? || overrides.none? {|o| o.from == from }
+
+      dependencies.filter_map do |dep|
+        override = overrides.find {|o| o.from == from && o.target == dep.name }
+        next dep unless override
+        next unless override.operation
+        Gem::Dependency.new(override.operation, *Array(override.requirement))
+      end
+    end
+
     # Attach the given overrides onto every LazySpecification in `specs` so
     # downstream consumers (LazySpecification#choose_compatible, the install-
     # time compatibility check, etc.) can read the override list off the spec
@@ -19,12 +33,14 @@ module Bundler
       specs.each {|s| s.overrides = overrides if s.is_a?(LazySpecification) }
     end
 
-    attr_reader :target, :field, :operation, :source_location
+    attr_reader :target, :field, :operation, :from, :requirement, :source_location
 
-    def initialize(target, field, operation, source_location: nil)
+    def initialize(target, field, operation, from: nil, requirement: nil, source_location: nil)
       @target = target
       @field = field
       @operation = operation
+      @from = from
+      @requirement = requirement
       @source_location = source_location
     end
 
@@ -33,7 +49,19 @@ module Bundler
       "#{File.basename(@source_location.path)}:#{@source_location.lineno}"
     end
 
+    def to_s
+      options = if @from
+        ["from: #{@from.inspect}", "to: #{@operation.inspect}", *("version: #{@requirement.inspect}" if @requirement)].join(", ")
+      else
+        "#{@field}: #{@operation.inspect}"
+      end
+      location = source_location_label
+      "override #{@target == :all ? ":all" : @target.inspect}, #{options}#{" (declared at #{location})" if location}"
+    end
+
     def apply_to(requirement)
+      raise ArgumentError, "#{self} rewrites a dependency and has no requirement to apply" if @from
+
       case operation
       when nil
         Gem::Requirement.default

data/lib/bundler/resolver.rb

@@ -71,6 +71,7 @@ module Bundler
       @cached_dependencies = Hash.new do |dependencies, package|
         dependencies[package] = Hash.new do |versions, version|
           deps = version.dependencies.reject {|d| d.name == package.name }
+          deps = Override.rewrite_dependencies(@base.overrides, package.name, deps)
           deps = apply_metadata_overrides(deps, package.name)
           versions[version] = to_dependency_hash(deps, @packages)
         end
@@ -88,6 +89,7 @@ module Bundler
       solver = Gem::PubGrub::VersionSolver.new(source: self, root: root, strategy: Strategy.new(self), logger: logger)
       result = solver.solve
       resolved_specs = result.flat_map {|package, version| version.to_specs(package, @most_specific_locked_platform) }
+      check_replaced_gems(resolved_specs)
       Override.attach(resolved_specs, @base.overrides)
       spec_set = SpecSet.new(resolved_specs).specs_with_additional_variants_from(@base.locked_specs)
       @cooldown_skipped = cooldown_skipped_summary(spec_set)
@@ -137,15 +139,37 @@ module Bundler
       raise SolveFailure.new(explanation)
     end
 
+    # A replacement is only useful when it provides the files of the gem it
+    # replaces, so the two cannot be loaded side by side.
+    def check_replaced_gems(specs)
+      names = specs.map(&:name)
+
+      @base.overrides.each do |override|
+        next unless override.from && override.operation
+        next unless names.include?(override.target) && names.include?(override.operation)
+        next unless specs.any? {|s| s.name == override.from && s.dependencies.any? {|d| d.name == override.target } }
+
+        dependents = specs.select do |spec|
+          Override.rewrite_dependencies(@base.overrides, spec.name, spec.dependencies).any? {|d| d.name == override.target }
+        end.map(&:name).uniq
+
+        lines = ["#{override} would leave both #{override.target} and #{override.operation} in the bundle because #{override.target} is still required by:"]
+        lines << "  the Gemfile" if @base.requirements.any? {|d| d.name == override.target }
+        lines.concat(dependents.map {|name| "  #{name}" })
+        if dependents.any?
+          lines << "Replace it for each of them, for example:"
+          lines << "  #{Override.new(override.target, :to, override.operation, from: dependents.first)}"
+        end
+        raise GemfileError, lines.join("\n")
+      end
+    end
+
     def override_diagnostic_summary
       return nil if @base.overrides.empty?
 
       lines = ["Bundler applied the following overrides while resolving:"]
       @base.overrides.each do |override|
-        target = override.target == :all ? ":all" : override.target.inspect
-        location = override.source_location_label
-        lines << "  override #{target}, #{override.field}: #{override.operation.inspect}" \
-          "#{location ? " (declared at #{location})" : ""}"
+        lines << "  #{override}"
       end
       "\n\n#{lines.join("\n")}"
     end

data/lib/bundler/self_manager.rb

@@ -30,8 +30,8 @@ module Bundler
       install_and_restart_with(restart_version)
     end
 
-    def update_bundler_and_restart_with_it_if_needed(target)
-      spec = resolve_update_version_from(target)
+    def update_bundler_and_restart_with_it_if_needed(target, pre: false)
+      spec = resolve_update_version_from(target, pre: pre)
       return unless spec
 
       version = spec.version
@@ -108,9 +108,9 @@ module Bundler
         lockfile_version
     end
 
-    def resolve_update_version_from(target)
+    def resolve_update_version_from(target, pre: false)
       requirement = Gem::Requirement.new(target)
-      update_candidate = find_latest_matching_spec(requirement)
+      update_candidate = find_latest_matching_spec(requirement, pre: pre)
 
       if update_candidate.nil?
         raise InvalidOption, "The `bundle update --bundler` target version (#{target}) does not exist"
@@ -137,18 +137,24 @@ module Bundler
       end
     end
 
-    def find_latest_matching_spec(requirement)
+    def find_latest_matching_spec(requirement, pre: false)
       Bundler.configure
-      local_result = find_latest_matching_spec_from_collection(local_specs, requirement)
+      # A bare `bundle update --bundler` must stay on releases, like `gem update
+      # --system`, so only `--pre` or a prerelease requirement opts into one.
+      allow_prerelease = pre || requirement.prerelease?
+
+      local_result = find_latest_matching_spec_from_collection(local_specs, requirement, allow_prerelease)
       return local_result if local_result && requirement.specific?
 
-      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement)
+      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement, allow_prerelease)
       return remote_result if local_result.nil?
 
-      [local_result, remote_result].max
+      [local_result, remote_result].compact.max
     end
 
-    def find_latest_matching_spec_from_collection(specs, requirement)
+    def find_latest_matching_spec_from_collection(specs, requirement, allow_prerelease)
+      specs = specs.reject {|spec| spec.version.prerelease? } unless allow_prerelease
+
       specs.sort.reverse_each.find {|spec| requirement.satisfied_by?(spec.version) }
     end
 

data/lib/bundler/settings.rb

@@ -896,32 +896,16 @@ module Bundler
       "#{prefix}#{uri}#{suffix}"
     end
 
-    # This is a hot method, so avoid respond_to? checks on every invocation
-    if :read.respond_to?(:name)
-      def self.key_to_s(key)
-        case key
-        when String
-          key
-        when Symbol
-          key.name
-        when Gem::URI::HTTP
-          key.to_s
-        else
-          raise ArgumentError, "Invalid key: #{key.inspect}"
-        end
-      end
-    else
-      def self.key_to_s(key)
-        case key
-        when String
-          key
-        when Symbol
-          key.to_s
-        when Gem::URI::HTTP
-          key.to_s
-        else
-          raise ArgumentError, "Invalid key: #{key.inspect}"
-        end
+    def self.key_to_s(key)
+      case key
+      when String
+        key
+      when Symbol
+        key.name
+      when Gem::URI::HTTP
+        key.to_s
+      else
+        raise ArgumentError, "Invalid key: #{key.inspect}"
       end
     end
   end

data/lib/bundler/source/git/git_proxy.rb

@@ -54,7 +54,7 @@ module Bundler
       # All actions required by the Git source is encapsulated in this
       # object.
       class GitProxy
-        attr_accessor :path, :uri, :branch, :tag, :ref, :explicit_ref
+        attr_accessor :path, :uri, :branch, :tag, :ref, :explicit_ref, :sparse_checkout
         attr_writer :revision
 
         def self.version
@@ -95,6 +95,7 @@ module Bundler
           @revision = revision
           @git      = git
           @commit_ref = nil
+          @sparse_checkout = options["sparse_checkout"]
         end
 
         def revision
@@ -159,6 +160,8 @@ module Bundler
             end
           end
 
+          setup_sparse_checkout(destination)
+
           ref = @commit_ref || (locked_to_full_sha? && @revision)
           if ref
             git "config", "uploadpack.allowAnySHA1InWant", "true", dir: path.to_s if @commit_ref.nil? && needs_allow_any_sha1_in_want?
@@ -507,7 +510,15 @@ module Bundler
 
           return ["git", *opts, *cmd] unless dir
 
-          ["git", "-C", dir.to_s, *opts, *cmd]
+          # With safe.bareRepository=explicit, git refuses to discover a bare
+          # repository from -C, so the cache clone is named with --git-dir.
+          # Working trees, like a local override, still go through -C.
+          location = bare_repo?(dir) ? "--git-dir" : "-C"
+          ["git", location, dir.to_s, *opts, *cmd]
+        end
+
+        def bare_repo?(dir)
+          File.exist?(File.join(dir, "objects")) && File.exist?(File.join(dir, "HEAD"))
         end
 
         def extra_clone_args
@@ -565,6 +576,32 @@ module Bundler
         def supports_cloning_with_no_tags?
           @supports_cloning_with_no_tags ||= Gem::Version.new(version) >= Gem::Version.new("2.14.0-rc0")
         end
+
+        def supports_sparse_checkout?
+          @supports_sparse_checkout ||= Gem::Version.new(version) >= Gem::Version.new("2.25.0")
+        end
+
+        def supports_sparse_checkout_set_with_cone?
+          @supports_sparse_checkout_set_with_cone ||= Gem::Version.new(version) >= Gem::Version.new("2.35.0")
+        end
+
+        def setup_sparse_checkout(destination)
+          return unless @sparse_checkout
+
+          unless supports_sparse_checkout?
+            Bundler.ui.warn "Git #{version} doesn't support sparse-checkout (requires 2.25+). Checking out the full repository."
+            return
+          end
+
+          Bundler.ui.debug "Setting sparse checkout to only include #{@sparse_checkout.join(", ")}"
+          if supports_sparse_checkout_set_with_cone?
+            git "sparse-checkout", "set", "--cone", *@sparse_checkout, dir: destination
+          else
+            # Before git 2.35, `set` keeps an unknown --cone as a pattern instead of rejecting it.
+            git "sparse-checkout", "init", "--cone", dir: destination
+            git "sparse-checkout", "set", *@sparse_checkout, dir: destination
+          end
+        end
       end
     end
   end