bundler 4.1.0.beta1 → 4.1.0.beta3

data/lib/bundler/man/gemfile.5.ronn

@@ -359,6 +359,20 @@ Git repositories support a number of additional options.
     Specify `submodules: true` to cause bundler to expand any
     submodules included in the git repository
 
+  * `sparse_checkout`:
+    Specify a directory, or an array of directories, to include when
+    checking out a git repository. Uses git's sparse-checkout feature
+    (requires git 2.25+) to only check out the specified directories,
+    reducing disk usage for large repos. Unless `glob` is given, the
+    `.gemspec` is looked up within those directories.
+
+      gem "foo", git: "https://github.com/org/monorepo.git",
+                 sparse_checkout: "packages/foo"
+
+    Files at the top level of the repository are always checked out.
+    On git versions below 2.25, the entire repository will be checked
+    out with a warning.
+
 If a git repository contains multiple `.gemspecs`, each `.gemspec`
 represents a gem located at the same place in the file system as
 the `.gemspec`.
@@ -587,8 +601,7 @@ one of:
 A per-gem override on the same field takes precedence over an `:all` override.
 `:all + version:` is rejected: version requirements only make sense per gem.
 
-Multiple `override` calls for distinct targets are allowed; declaring the
-same `target` and `field` twice is an error.
+Declaring the same `target` and `field` twice is an error.
 
     source "https://rubygems.org"
 
@@ -610,11 +623,63 @@ same `target` and `field` twice is an error.
     gem "rails", "~> 7.0"
 
 The override only affects resolution and the install-time Ruby/RubyGems
-compatibility checks; `Gemfile.lock` continues to reflect the resolved
-versions, not the rewritten requirements. When resolution still fails,
+compatibility checks; the gems in `Gemfile.lock` continue to reflect the
+resolved versions, not the rewritten requirements. The overrides themselves are
+recorded in the lockfile's `OVERRIDES` section, one line per field, sorted:
+
+    OVERRIDES
+      "rails", version: ">= 8.0"
+      :all, required_ruby_version: :ignore_upper
+
+Requirements are recorded in normalized form, so `">=8.0"` and `">= 8.0"` are
+the same override. A frozen install fails when the Gemfile's overrides differ
+from the recorded ones. Adding or removing a `:all` or metadata override
+rewrites the section and keeps the locked versions. The exception is a locked
+gem that is not installed and whose metadata rejects the current Ruby. Bundler
+re-resolves it, as it does without the override. Run `bundle update` to
+re-resolve under the override. When resolution still fails,
 Bundler appends the active overrides (with their Gemfile location) to the
 error message so it is clear which override shaped the constraint set.
 
+### DROPPING OR REPLACING A DEPENDENCY
+
+`with:` and `in:` rewrite a single dependency of a single gem:
+
+    override <target>, with: nil, in: <gem>
+    override <target>, with: <replacement>, in: <gem>, version: <requirement>
+
+`with: nil` removes the dependency of `<gem>` on `<target>`, so `<target>` is
+not installed unless something else still requires it. `with: <replacement>`
+makes `<gem>` depend on `<replacement>` instead of `<target>`. The requirement
+`<gem>` put on `<target>` is discarded, and the optional `version:` gives the
+replacement its own. Both forms apply whether `<gem>` is a direct or a
+transitive dependency.
+
+`in:` is required, and so is `with:` once `in:` is given. To rewrite the
+same dependency of several gems, write one `override` per gem. It is an error
+to declare the same `<target>` and `in:` twice, to drop a gem that the
+Gemfile requires directly, or to replace a gem that another gem still
+requires, since both would then be in the bundle.
+
+    # jekyll only loads em-websocket for `jekyll serve --livereload`.
+    override "em-websocket", with: nil, in: "jekyll"
+
+    # Use an API-compatible gem that provides the same files.
+    override "foo", with: "foo-lite", in: "bar"
+
+Bundler does not check what a gem loads at runtime. If `<gem>` requires
+`<target>` unconditionally, dropping it makes that require raise `LoadError`,
+as with jekyll's dependency on jekyll-sass-converter or the adapters that
+faraday 1.x requires on load. A replacement only works when it provides the
+files `<gem>` requires, and it does not take over the name of `<target>`:
+`Gem.loaded_specs` has no entry for `<target>`, and `gem "<target>"` fails.
+
+`Gemfile.lock` keeps listing `<target>` under `<gem>` as the gem publishes it,
+while the locked gems leave `<target>` out or include `<replacement>`, and the
+`OVERRIDES` section records the rewrite so tools that read the lockfile can
+apply it. A frozen install accepts that lockfile as long as the Gemfile still
+has the override. Removing the override makes Bundler resolve `<target>` again.
+
 ## SOURCE PRIORITY
 
 When attempting to locate a gem to satisfy a gem requirement,

data/lib/bundler/match_platform.rb

@@ -27,9 +27,18 @@ module Bundler
     end
 
     def self.prefer_content_addressable(matching)
-      addressable, non_addressable = matching.partition {|s| Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false) }
-      return matching if addressable.empty?
-
+      first = matching.index {|s| Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false) }
+      return matching unless first
+
+      addressable = [matching[first]]
+      non_addressable = matching.take(first)
+      matching.drop(first + 1).each do |s|
+        if Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false)
+          addressable << s
+        else
+          non_addressable << s
+        end
+      end
       compatible = addressable.select(&:matches_current_metadata?)
       return compatible if compatible.any?
 

data/lib/bundler/materialization.rb

@@ -30,7 +30,9 @@ module Bundler
     end
 
     def dependencies
-      (materialized_spec || specs.first).runtime_dependencies.map {|d| [d, platform] }
+      spec = materialized_spec || specs.first
+      overrides = specs.first.overrides if specs.first.is_a?(LazySpecification)
+      Override.rewrite_dependencies(overrides, spec.name, spec.runtime_dependencies).map {|d| [d, platform] }
     end
 
     def materialized_spec

data/lib/bundler/override.rb

@@ -9,6 +9,20 @@ module Bundler
         overrides.find {|o| o.target == :all && o.field == field }
     end
 
+    # Drops or replaces the dependencies of the `in:` gem, passed as `from`,
+    # that a `with:`/`in:` override targets. The requirement `from` put on the
+    # replaced gem is discarded.
+    def self.rewrite_dependencies(overrides, from, dependencies)
+      return dependencies if overrides.nil? || overrides.none? {|o| o.from == from }
+
+      dependencies.filter_map do |dep|
+        override = overrides.find {|o| o.from == from && o.target == dep.name }
+        next dep unless override
+        next unless override.operation
+        Gem::Dependency.new(override.operation, *Array(override.requirement))
+      end
+    end
+
     # Attach the given overrides onto every LazySpecification in `specs` so
     # downstream consumers (LazySpecification#choose_compatible, the install-
     # time compatibility check, etc.) can read the override list off the spec
@@ -19,12 +33,14 @@ module Bundler
       specs.each {|s| s.overrides = overrides if s.is_a?(LazySpecification) }
     end
 
-    attr_reader :target, :field, :operation, :source_location
+    attr_reader :target, :field, :operation, :from, :requirement, :source_location
 
-    def initialize(target, field, operation, source_location: nil)
+    def initialize(target, field, operation, from: nil, requirement: nil, source_location: nil)
       @target = target
       @field = field
       @operation = operation
+      @from = from
+      @requirement = requirement
       @source_location = source_location
     end
 
@@ -33,7 +49,72 @@ module Bundler
       "#{File.basename(@source_location.path)}:#{@source_location.lineno}"
     end
 
+    def to_s
+      location = source_location_label
+      "override #{to_lock}#{" (declared at #{location})" if location}"
+    end
+
+    # The override as recorded in the OVERRIDES section of Gemfile.lock: the
+    # `override` arguments with requirements normalized, so equivalent
+    # spellings ("<=3", "<= 3") record the same line.
+    def to_lock
+      target = @target == :all ? ":all" : @target.inspect
+      fields = if @from
+        ["with: #{@operation.inspect}", "in: #{@from.inspect}", *("version: #{self.class.normalize(@requirement).inspect}" if @requirement)]
+      else
+        ["#{@field}: #{self.class.normalize(@operation).inspect}"]
+      end
+      [target, *fields].join(", ")
+    end
+
+    LOCK_VALUE = /"[^"\\]*"|:[a-z_]+|nil/
+    LOCK_FIELD = /, ([a-z_]+): (#{LOCK_VALUE})/
+    LOCK_LINE = /\A(:all|"[a-zA-Z0-9._-]+")((?:#{LOCK_FIELD})+)\z/
+    private_constant :LOCK_VALUE, :LOCK_FIELD, :LOCK_LINE
+
+    # Parses a line written by #to_lock. The DSL only accepts valid gem names,
+    # and requirements are normalized, so no recorded value contains a quote
+    # or a backslash and the line can be read without evaluating it.
+    def self.from_lock(line)
+      match = LOCK_LINE.match(line)
+      raise ArgumentError, "invalid override in lockfile: #{line.inspect}" unless match
+
+      target = match[1] == ":all" ? :all : match[1][1..-2]
+      fields = match[2].scan(LOCK_FIELD).map {|key, value| [key.to_sym, parse_lock_value(value)] }
+      keys = fields.map(&:first)
+      raise ArgumentError, "invalid override in lockfile: #{line.inspect}" unless keys.uniq.size == keys.size
+      fields = fields.to_h
+
+      if fields.key?(:in)
+        unless (keys - [:in, :with, :version]).empty? && fields.key?(:with) && fields[:in].is_a?(String)
+          raise ArgumentError, "invalid override in lockfile: #{line.inspect}"
+        end
+        new(target, :with, fields[:with], from: fields[:in], requirement: normalize(fields[:version]))
+      else
+        field, operation = fields.first
+        unless fields.size == 1 && Dsl::SUPPORTED_OVERRIDE_FIELDS.include?(field)
+          raise ArgumentError, "invalid override in lockfile: #{line.inspect}"
+        end
+        new(target, field, normalize(operation))
+      end
+    end
+
+    def self.parse_lock_value(value)
+      case value
+      when "nil" then nil
+      when /\A:/ then value[1..].to_sym
+      else value[1..-2]
+      end
+    end
+    private_class_method :parse_lock_value
+
+    def self.normalize(operation)
+      operation.is_a?(String) ? Gem::Requirement.new(operation).to_s : operation
+    end
+
     def apply_to(requirement)
+      raise ArgumentError, "#{self} rewrites a dependency and has no requirement to apply" if @from
+
       case operation
       when nil
         Gem::Requirement.default

data/lib/bundler/resolver.rb

@@ -71,6 +71,7 @@ module Bundler
       @cached_dependencies = Hash.new do |dependencies, package|
         dependencies[package] = Hash.new do |versions, version|
           deps = version.dependencies.reject {|d| d.name == package.name }
+          deps = Override.rewrite_dependencies(@base.overrides, package.name, deps)
           deps = apply_metadata_overrides(deps, package.name)
           versions[version] = to_dependency_hash(deps, @packages)
         end
@@ -88,6 +89,7 @@ module Bundler
       solver = Gem::PubGrub::VersionSolver.new(source: self, root: root, strategy: Strategy.new(self), logger: logger)
       result = solver.solve
       resolved_specs = result.flat_map {|package, version| version.to_specs(package, @most_specific_locked_platform) }
+      check_replaced_gems(resolved_specs)
       Override.attach(resolved_specs, @base.overrides)
       spec_set = SpecSet.new(resolved_specs).specs_with_additional_variants_from(@base.locked_specs)
       @cooldown_skipped = cooldown_skipped_summary(spec_set)
@@ -137,15 +139,37 @@ module Bundler
       raise SolveFailure.new(explanation)
     end
 
+    # A replacement is only useful when it provides the files of the gem it
+    # replaces, so the two cannot be loaded side by side.
+    def check_replaced_gems(specs)
+      names = specs.map(&:name)
+
+      @base.overrides.each do |override|
+        next unless override.from && override.operation
+        next unless names.include?(override.target) && names.include?(override.operation)
+        next unless specs.any? {|s| s.name == override.from && s.dependencies.any? {|d| d.name == override.target } }
+
+        dependents = specs.select do |spec|
+          Override.rewrite_dependencies(@base.overrides, spec.name, spec.dependencies).any? {|d| d.name == override.target }
+        end.map(&:name).uniq
+
+        lines = ["#{override} would leave both #{override.target} and #{override.operation} in the bundle because #{override.target} is still required by:"]
+        lines << "  the Gemfile" if @base.requirements.any? {|d| d.name == override.target }
+        lines.concat(dependents.map {|name| "  #{name}" })
+        if dependents.any?
+          lines << "Replace it for each of them, for example:"
+          lines << "  #{Override.new(override.target, :with, override.operation, from: dependents.first)}"
+        end
+        raise GemfileError, lines.join("\n")
+      end
+    end
+
     def override_diagnostic_summary
       return nil if @base.overrides.empty?
 
       lines = ["Bundler applied the following overrides while resolving:"]
       @base.overrides.each do |override|
-        target = override.target == :all ? ":all" : override.target.inspect
-        location = override.source_location_label
-        lines << "  override #{target}, #{override.field}: #{override.operation.inspect}" \
-          "#{location ? " (declared at #{location})" : ""}"
+        lines << "  #{override}"
       end
       "\n\n#{lines.join("\n")}"
     end

data/lib/bundler/rubygems_ext.rb

@@ -86,11 +86,22 @@ module Gem
         end
       end
 
-      def open_file_with_lock(path, &block)
+      def open_file_with_lock(path)
         file_lock = "#{path}.lock"
-        open_file_with_flock(file_lock, &block)
-      ensure
-        FileUtils.rm_f file_lock
+
+        loop do
+          open_file_with_flock(file_lock) do |io|
+            # The previous holder removed the file while we were waiting on it,
+            # so leave this block and try again on the file now at the lock path
+            next unless File.identical?(io, file_lock)
+
+            begin
+              return yield io
+            ensure
+              FileUtils.rm_f file_lock
+            end
+          end
+        end
       end
     end
   end

data/lib/bundler/self_manager.rb

@@ -30,8 +30,8 @@ module Bundler
       install_and_restart_with(restart_version)
     end
 
-    def update_bundler_and_restart_with_it_if_needed(target)
-      spec = resolve_update_version_from(target)
+    def update_bundler_and_restart_with_it_if_needed(target, pre: false)
+      spec = resolve_update_version_from(target, pre: pre)
       return unless spec
 
       version = spec.version
@@ -108,9 +108,9 @@ module Bundler
         lockfile_version
     end
 
-    def resolve_update_version_from(target)
+    def resolve_update_version_from(target, pre: false)
       requirement = Gem::Requirement.new(target)
-      update_candidate = find_latest_matching_spec(requirement)
+      update_candidate = find_latest_matching_spec(requirement, pre: pre)
 
       if update_candidate.nil?
         raise InvalidOption, "The `bundle update --bundler` target version (#{target}) does not exist"
@@ -137,18 +137,24 @@ module Bundler
       end
     end
 
-    def find_latest_matching_spec(requirement)
+    def find_latest_matching_spec(requirement, pre: false)
       Bundler.configure
-      local_result = find_latest_matching_spec_from_collection(local_specs, requirement)
+      # A bare `bundle update --bundler` must stay on releases, like `gem update
+      # --system`, so only `--pre` or a prerelease requirement opts into one.
+      allow_prerelease = pre || requirement.prerelease?
+
+      local_result = find_latest_matching_spec_from_collection(local_specs, requirement, allow_prerelease)
       return local_result if local_result && requirement.specific?
 
-      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement)
+      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement, allow_prerelease)
       return remote_result if local_result.nil?
 
-      [local_result, remote_result].max
+      [local_result, remote_result].compact.max
     end
 
-    def find_latest_matching_spec_from_collection(specs, requirement)
+    def find_latest_matching_spec_from_collection(specs, requirement, allow_prerelease)
+      specs = specs.reject {|spec| spec.version.prerelease? } unless allow_prerelease
+
       specs.sort.reverse_each.find {|spec| requirement.satisfied_by?(spec.version) }
     end
 

data/lib/bundler/settings.rb

@@ -896,32 +896,16 @@ module Bundler
       "#{prefix}#{uri}#{suffix}"
     end
 
-    # This is a hot method, so avoid respond_to? checks on every invocation
-    if :read.respond_to?(:name)
-      def self.key_to_s(key)
-        case key
-        when String
-          key
-        when Symbol
-          key.name
-        when Gem::URI::HTTP
-          key.to_s
-        else
-          raise ArgumentError, "Invalid key: #{key.inspect}"
-        end
-      end
-    else
-      def self.key_to_s(key)
-        case key
-        when String
-          key
-        when Symbol
-          key.to_s
-        when Gem::URI::HTTP
-          key.to_s
-        else
-          raise ArgumentError, "Invalid key: #{key.inspect}"
-        end
+    def self.key_to_s(key)
+      case key
+      when String
+        key
+      when Symbol
+        key.name
+      when Gem::URI::HTTP
+        key.to_s
+      else
+        raise ArgumentError, "Invalid key: #{key.inspect}"
       end
     end
   end

data/lib/bundler/source/git/git_proxy.rb

@@ -54,7 +54,7 @@ module Bundler
       # All actions required by the Git source is encapsulated in this
       # object.
       class GitProxy
-        attr_accessor :path, :uri, :branch, :tag, :ref, :explicit_ref
+        attr_accessor :path, :uri, :branch, :tag, :ref, :explicit_ref, :sparse_checkout
         attr_writer :revision
 
         def self.version
@@ -95,6 +95,7 @@ module Bundler
           @revision = revision
           @git      = git
           @commit_ref = nil
+          @sparse_checkout = options["sparse_checkout"]
         end
 
         def revision
@@ -159,6 +160,8 @@ module Bundler
             end
           end
 
+          setup_sparse_checkout(destination)
+
           ref = @commit_ref || (locked_to_full_sha? && @revision)
           if ref
             git "config", "uploadpack.allowAnySHA1InWant", "true", dir: path.to_s if @commit_ref.nil? && needs_allow_any_sha1_in_want?
@@ -507,7 +510,15 @@ module Bundler
 
           return ["git", *opts, *cmd] unless dir
 
-          ["git", "-C", dir.to_s, *opts, *cmd]
+          # With safe.bareRepository=explicit, git refuses to discover a bare
+          # repository from -C, so the cache clone is named with --git-dir.
+          # Working trees, like a local override, still go through -C.
+          location = bare_repo?(dir) ? "--git-dir" : "-C"
+          ["git", location, dir.to_s, *opts, *cmd]
+        end
+
+        def bare_repo?(dir)
+          File.exist?(File.join(dir, "objects")) && File.exist?(File.join(dir, "HEAD"))
         end
 
         def extra_clone_args
@@ -565,6 +576,32 @@ module Bundler
         def supports_cloning_with_no_tags?
           @supports_cloning_with_no_tags ||= Gem::Version.new(version) >= Gem::Version.new("2.14.0-rc0")
         end
+
+        def supports_sparse_checkout?
+          @supports_sparse_checkout ||= Gem::Version.new(version) >= Gem::Version.new("2.25.0")
+        end
+
+        def supports_sparse_checkout_set_with_cone?
+          @supports_sparse_checkout_set_with_cone ||= Gem::Version.new(version) >= Gem::Version.new("2.35.0")
+        end
+
+        def setup_sparse_checkout(destination)
+          return unless @sparse_checkout
+
+          unless supports_sparse_checkout?
+            Bundler.ui.warn "Git #{version} doesn't support sparse-checkout (requires 2.25+). Checking out the full repository."
+            return
+          end
+
+          Bundler.ui.debug "Setting sparse checkout to only include #{@sparse_checkout.join(", ")}"
+          if supports_sparse_checkout_set_with_cone?
+            git "sparse-checkout", "set", "--cone", *@sparse_checkout, dir: destination
+          else
+            # Before git 2.35, `set` keeps an unknown --cone as a pattern instead of rejecting it.
+            git "sparse-checkout", "init", "--cone", dir: destination
+            git "sparse-checkout", "set", *@sparse_checkout, dir: destination
+          end
+        end
       end
     end
   end

data/lib/bundler/source/git.rb

@@ -7,12 +7,13 @@ module Bundler
     class Git < Path
       autoload :GitProxy, File.expand_path("git/git_proxy", __dir__)
 
-      attr_reader :uri, :ref, :branch, :options, :glob, :submodules
+      attr_reader :uri, :ref, :branch, :options, :glob, :submodules, :sparse_checkout
 
       def initialize(options)
         @options = options
         @checksum_store = Checksum::Store.new
-        @glob = options["glob"] || DEFAULT_GLOB
+        @sparse_checkout = normalize_sparse_checkout(options)
+        @glob = options["glob"] || sparse_checkout_glob || DEFAULT_GLOB
 
         @allow_cached = false
         @allow_remote = false
@@ -58,12 +59,13 @@ module Bundler
         %w[ref branch tag submodules].each do |opt|
           out << "  #{opt}: #{options[opt]}\n" if options[opt]
         end
+        @sparse_checkout&.each {|dir| out << "  sparse_checkout: #{dir}\n" }
         out << "  glob: #{@glob}\n" unless default_glob?
         out << "  specs:\n"
       end
 
       def to_gemfile
-        specifiers = %w[ref branch tag submodules glob].map do |opt|
+        specifiers = %w[ref branch tag submodules glob sparse_checkout].map do |opt|
           "#{opt}: #{options[opt]}" if options[opt]
         end
 
@@ -71,14 +73,15 @@ module Bundler
       end
 
       def hash
-        [self.class, uri, ref, branch, name, glob, submodules].hash
+        [self.class, uri, ref, branch, name, glob, submodules, sparse_checkout].hash
       end
 
       def eql?(other)
         other.is_a?(Git) && uri == other.uri && ref == other.ref &&
           branch == other.branch && name == other.name &&
           glob == other.glob &&
-          submodules == other.submodules
+          submodules == other.submodules &&
+          sparse_checkout == other.sparse_checkout
       end
 
       alias_method :==, :eql?
@@ -87,7 +90,8 @@ module Bundler
         other.is_a?(Git) && uri == other.uri &&
           name == other.name &&
           glob == other.glob &&
-          submodules == other.submodules
+          submodules == other.submodules &&
+          sparse_checkout == other.sparse_checkout
       end
 
       def to_s
@@ -389,7 +393,30 @@ module Bundler
       end
 
       def shortref_for_path(ref)
-        ref[0..11]
+        shortref = ref[0..11]
+        return shortref unless @sparse_checkout
+
+        # Checkouts of the same revision with different cones hold different files
+        "#{shortref}-#{Bundler::Digest.sha1(@sparse_checkout.join("\n"))[0..7]}"
+      end
+
+      def normalize_sparse_checkout(options)
+        return unless options["sparse_checkout"]
+
+        dirs = Array(options["sparse_checkout"])
+        unless dirs.any? && dirs.all? {|dir| dir.is_a?(String) && !dir.empty? }
+          raise GemfileError, "The :sparse_checkout option must be a directory or an array of directories, " \
+            "but #{options["sparse_checkout"].inspect} was given"
+        end
+
+        options["sparse_checkout"] = dirs
+      end
+
+      def sparse_checkout_glob
+        return unless @sparse_checkout
+
+        dirs = @sparse_checkout.size == 1 ? @sparse_checkout.first : "{#{@sparse_checkout.join(",")}}"
+        "#{dirs}/#{DEFAULT_GLOB}"
       end
 
       def glob_for_display

data/lib/bundler/source/rubygems.rb

@@ -77,11 +77,11 @@ module Bundler
       end
 
       def hash
-        @remotes.hash
+        credless_remotes.hash
       end
 
       def eql?(other)
-        other.is_a?(Rubygems) && other.credless_remotes == credless_remotes
+        equal?(other) || (other.is_a?(Rubygems) && other.credless_remotes == credless_remotes)
       end
 
       alias_method :==, :eql?

data/lib/bundler/source/rubygems_aggregate.rb

@@ -29,7 +29,7 @@ module Bundler
 
       def build_index
         Index.build do |idx|
-          dependency_names = source_map.pinned_spec_names
+          dependency_names = source_map.pinned_spec_names | source_map.replacement_names
 
           sources.all_sources.each do |source|
             next if @excluded_sources.include?(source)

data/lib/bundler/source_map.rb

@@ -2,12 +2,15 @@
 
 module Bundler
   class SourceMap
-    attr_reader :sources, :dependencies, :locked_specs
+    attr_reader :sources, :dependencies, :locked_specs, :replacement_names
 
-    def initialize(sources, dependencies, locked_specs)
+    def initialize(sources, dependencies, locked_specs, replacement_names = [])
       @sources = sources
       @dependencies = dependencies
       @locked_specs = locked_specs
+      # No gemspec names a gem that a `with:`/`in:` override substitutes, so
+      # the dependency API never fetches it unless asked.
+      @replacement_names = replacement_names
     end
 
     def pinned_spec_names(skip = nil)
@@ -22,6 +25,7 @@ module Bundler
       end
 
       unmet_deps = explicit_sources.map do |source|
+        source.add_dependency_names(replacement_names)
         (source.spec_names - pinned_spec_names).each do |indirect_dependency_name|
           previous_source = requirements[indirect_dependency_name]
           if previous_source.nil?
@@ -39,7 +43,7 @@ module Bundler
         source.unmet_deps
       end
 
-      sources.default_source.add_dependency_names(unmet_deps.flatten - requirements.keys)
+      sources.default_source.add_dependency_names(unmet_deps.flatten + replacement_names - requirements.keys)
 
       requirements
     end