bundler 4.1.0.beta1 → 4.1.0.beta2

data/lib/bundler/source/git.rb

@@ -7,12 +7,13 @@ module Bundler
     class Git < Path
       autoload :GitProxy, File.expand_path("git/git_proxy", __dir__)
 
-      attr_reader :uri, :ref, :branch, :options, :glob, :submodules
+      attr_reader :uri, :ref, :branch, :options, :glob, :submodules, :sparse_checkout
 
       def initialize(options)
         @options = options
         @checksum_store = Checksum::Store.new
-        @glob = options["glob"] || DEFAULT_GLOB
+        @sparse_checkout = normalize_sparse_checkout(options)
+        @glob = options["glob"] || sparse_checkout_glob || DEFAULT_GLOB
 
         @allow_cached = false
         @allow_remote = false
@@ -58,12 +59,13 @@ module Bundler
         %w[ref branch tag submodules].each do |opt|
           out << "  #{opt}: #{options[opt]}\n" if options[opt]
         end
+        @sparse_checkout&.each {|dir| out << "  sparse_checkout: #{dir}\n" }
         out << "  glob: #{@glob}\n" unless default_glob?
         out << "  specs:\n"
       end
 
       def to_gemfile
-        specifiers = %w[ref branch tag submodules glob].map do |opt|
+        specifiers = %w[ref branch tag submodules glob sparse_checkout].map do |opt|
           "#{opt}: #{options[opt]}" if options[opt]
         end
 
@@ -71,14 +73,15 @@ module Bundler
       end
 
       def hash
-        [self.class, uri, ref, branch, name, glob, submodules].hash
+        [self.class, uri, ref, branch, name, glob, submodules, sparse_checkout].hash
       end
 
       def eql?(other)
         other.is_a?(Git) && uri == other.uri && ref == other.ref &&
           branch == other.branch && name == other.name &&
           glob == other.glob &&
-          submodules == other.submodules
+          submodules == other.submodules &&
+          sparse_checkout == other.sparse_checkout
       end
 
       alias_method :==, :eql?
@@ -87,7 +90,8 @@ module Bundler
         other.is_a?(Git) && uri == other.uri &&
           name == other.name &&
           glob == other.glob &&
-          submodules == other.submodules
+          submodules == other.submodules &&
+          sparse_checkout == other.sparse_checkout
       end
 
       def to_s
@@ -389,7 +393,30 @@ module Bundler
       end
 
       def shortref_for_path(ref)
-        ref[0..11]
+        shortref = ref[0..11]
+        return shortref unless @sparse_checkout
+
+        # Checkouts of the same revision with different cones hold different files
+        "#{shortref}-#{Bundler::Digest.sha1(@sparse_checkout.join("\n"))[0..7]}"
+      end
+
+      def normalize_sparse_checkout(options)
+        return unless options["sparse_checkout"]
+
+        dirs = Array(options["sparse_checkout"])
+        unless dirs.any? && dirs.all? {|dir| dir.is_a?(String) && !dir.empty? }
+          raise GemfileError, "The :sparse_checkout option must be a directory or an array of directories, " \
+            "but #{options["sparse_checkout"].inspect} was given"
+        end
+
+        options["sparse_checkout"] = dirs
+      end
+
+      def sparse_checkout_glob
+        return unless @sparse_checkout
+
+        dirs = @sparse_checkout.size == 1 ? @sparse_checkout.first : "{#{@sparse_checkout.join(",")}}"
+        "#{dirs}/#{DEFAULT_GLOB}"
       end
 
       def glob_for_display

data/lib/bundler/source/rubygems_aggregate.rb

@@ -29,7 +29,7 @@ module Bundler
 
       def build_index
         Index.build do |idx|
-          dependency_names = source_map.pinned_spec_names
+          dependency_names = source_map.pinned_spec_names | source_map.replacement_names
 
           sources.all_sources.each do |source|
             next if @excluded_sources.include?(source)

data/lib/bundler/source_map.rb

@@ -2,12 +2,15 @@
 
 module Bundler
   class SourceMap
-    attr_reader :sources, :dependencies, :locked_specs
+    attr_reader :sources, :dependencies, :locked_specs, :replacement_names
 
-    def initialize(sources, dependencies, locked_specs)
+    def initialize(sources, dependencies, locked_specs, replacement_names = [])
       @sources = sources
       @dependencies = dependencies
       @locked_specs = locked_specs
+      # No gemspec names a gem that a `from:`/`to:` override substitutes, so
+      # the dependency API never fetches it unless asked.
+      @replacement_names = replacement_names
     end
 
     def pinned_spec_names(skip = nil)
@@ -22,6 +25,7 @@ module Bundler
       end
 
       unmet_deps = explicit_sources.map do |source|
+        source.add_dependency_names(replacement_names)
         (source.spec_names - pinned_spec_names).each do |indirect_dependency_name|
           previous_source = requirements[indirect_dependency_name]
           if previous_source.nil?
@@ -39,7 +43,7 @@ module Bundler
         source.unmet_deps
       end
 
-      sources.default_source.add_dependency_names(unmet_deps.flatten - requirements.keys)
+      sources.default_source.add_dependency_names(unmet_deps.flatten + replacement_names - requirements.keys)
 
       requirements
     end

data/lib/bundler/spec_set.rb

@@ -84,11 +84,14 @@ module Bundler
       platforms.delete(Bundler.local_platform) if less_specific_platform
     end
 
-    def validate_deps(s)
-      s.runtime_dependencies.each do |dep|
+    def validate_deps(s, overrides = s.is_a?(LazySpecification) ? Array(s.overrides) : [])
+      Override.rewrite_dependencies(overrides, s.name, s.runtime_dependencies).each do |dep|
         next if dep.name == "bundler"
 
         return :missing unless names.include?(dep.name)
+
+        override = Override.find_for(overrides, dep.name, :version)
+        dep = Gem::Dependency.new(dep.name, override.apply_to(dep.requirement)) if override
         return :invalid if none? {|spec| dep.matches_spec?(spec) }
       end
 
@@ -281,7 +284,7 @@ module Bundler
         overrides = spec.is_a?(LazySpecification) ? Array(spec.overrides) : []
         matching_specs = spec.source.specs.search([spec.name, spec.version])
         platform_spec = MatchPlatform.select_best_platform_match(matching_specs, platform).find do |s|
-          s.matches_current_metadata_with_overrides?(overrides) && valid_dependencies?(s)
+          s.matches_current_metadata_with_overrides?(overrides) && validate_deps(s, overrides) == :valid
         end
 
         if platform_spec
@@ -354,7 +357,8 @@ module Bundler
     end
 
     def tsort_each_child(s)
-      s.dependencies.sort_by(&:name).each do |d|
+      dependencies = s.is_a?(LazySpecification) ? Override.rewrite_dependencies(s.overrides, s.name, s.dependencies) : s.dependencies
+      dependencies.sort_by(&:name).each do |d|
         next if d.type == :development
 
         specs_for_name = lookup[d.name]

data/lib/bundler/templates/newgem/ext/newgem/Cargo.toml.tt

@@ -12,7 +12,7 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-magnus = { version = "0.8.2" }
+magnus = { version = "0.9" }
 rb-sys = { version = "0.9", features = ["stable-api-compiled-fallback"] }
 
 [build-dependencies]

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.1.0.beta1".freeze
+  VERSION = "4.1.0.beta2".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

data/lib/bundler.rb

@@ -119,9 +119,7 @@ module Bundler
     def bin_path
       @bin_path ||= begin
         path = Bundler.settings[:bin] || "bin"
-        path = Pathname.new(path).expand_path(root).expand_path
-        mkdir_p(path)
-        path
+        Pathname.new(path).expand_path(root).expand_path
       end
     end
 

data/lib/rubygems/compact_index_client/http_fetcher.rb

@@ -48,9 +48,11 @@ class Gem::CompactIndexClient
         if https?(uri) && !https?(redirect)
           raise Gem::RemoteFetcher::FetchError.new("redirecting to non-https resource: #{Gem::Uri.redact(redirect)}", uri)
         end
-        # An absolute Location on the same host drops the credentials that a
-        # relative one would have kept.
-        redirect.userinfo = uri.userinfo if redirect.host == uri.host && !redirect.userinfo
+        # An absolute Location on the same origin drops the credentials that a
+        # relative one would have kept. Another port or scheme on the same host
+        # is a different protection space (RFC 9110, Section 11.5).
+        same_origin = [redirect.scheme, redirect.host, redirect.port] == [uri.scheme, uri.host, uri.port]
+        redirect.userinfo = uri.userinfo if same_origin && !redirect.userinfo
 
         fetch(redirect, headers, redirects_remaining - 1)
       when Gem::Net::HTTPRangeNotSatisfiable