bundler 2.5.23 → 2.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f964a6e36c3a9919c4326fd76e7646a5b81723f054d36348dca84d40f70272d
-  data.tar.gz: 6d5cb44abe0e95f451ac4950e044a303bfc1fb44893e1f198f800225b313129f
+  metadata.gz: 7e5040339545260efa41ad3b7bd4201dfdc9275e322b970ed3c768a45ec01e06
+  data.tar.gz: 6d8271cc5fd5a98f98637ef49a597ff4edc8ce78e2fcb2f504b21c29b6f4b0a1
 SHA512:
-  metadata.gz: e541245d67f58bd6f30bce064e02564c475c281b89b0f60083699998e5e2cf4450685f69bfdc02df1fe4900f67cf778dc6a30e1e38db858000dedd72a79384e2
-  data.tar.gz: 0af9592802c805e17e3bf35eb58d2a10b78ccf25b9fa59cdf637a8c4c8ab7bdad5ecbc1f0c9489eabf4e0b348c937831e7335283703e21209dccbf53b36727e9
+  metadata.gz: 1cfdf00dc9e185a6af93c187a55b2c4d2c61f0f21edcfd0b5e213f1b00026e010815c7b1ea4ea2efd96c199b514061b3b183257a4e7aa6b25bd1bce2b6e7404e
+  data.tar.gz: b32951d8312bb7d65fabd06c269ca6ec6e2114f9f2836aeb74aa72a73a2b219c56a173f0383f7e917072fe9ab78c7a0fa9c31a58aca24d9faf078490145e9dfa

data/CHANGELOG.md

@@ -1,3 +1,62 @@
+# 2.6.0 (December 16, 2024)
+
+## Security:
+
+  - Fix gemfury credentials written to logs in verbose mode [#8283](https://github.com/rubygems/rubygems/pull/8283)
+  - Fix private registry credentials being written to logs [#8222](https://github.com/rubygems/rubygems/pull/8222)
+
+## Breaking changes:
+
+  - Drop ruby 3.0 support [#8091](https://github.com/rubygems/rubygems/pull/8091)
+  - Remove client-side MD5 ETag transition from compact index client [#7677](https://github.com/rubygems/rubygems/pull/7677)
+
+## Deprecations:
+
+  - Cancel `bundle console` deprecation [#8218](https://github.com/rubygems/rubygems/pull/8218)
+  - Warn when platform of installed gem differs from platform in the lockfile [#8029](https://github.com/rubygems/rubygems/pull/8029)
+  - Cancel deprecation of Gemfiles without a global source [#8213](https://github.com/rubygems/rubygems/pull/8213)
+
+## Features:
+
+  - Add a `lockfile_checksums` configuration to include checksums in fresh lockfiles [#8219](https://github.com/rubygems/rubygems/pull/8219)
+  - Add `bundle lock --add-checksums` to add checksums to an existing lockfile [#8214](https://github.com/rubygems/rubygems/pull/8214)
+
+## Performance:
+
+  - Enable a couple of performance cops [#8261](https://github.com/rubygems/rubygems/pull/8261)
+  - Remove override of worker jobs for `bundle install --local` [#8248](https://github.com/rubygems/rubygems/pull/8248)
+
+## Enhancements:
+
+  - Support `bundle exec <relative-path-to-script>` when `Kernel.exec` is used under the hood [#8294](https://github.com/rubygems/rubygems/pull/8294)
+  - Improve working with different rubies using the same lockfile [#8251](https://github.com/rubygems/rubygems/pull/8251)
+  - Define a few `inspect` methods to help debugging [#8266](https://github.com/rubygems/rubygems/pull/8266)
+  - Include original error when openssl fails to load [#8232](https://github.com/rubygems/rubygems/pull/8232)
+  - Automatically fix lockfile when it's missing dependencies [#8103](https://github.com/rubygems/rubygems/pull/8103)
+  - Fix some JRuby warnings when using `bundler/setup` with Ruby's -w flag [#8205](https://github.com/rubygems/rubygems/pull/8205)
+  - Add a `--normalize-platforms` flag to `bundle lock` [#7896](https://github.com/rubygems/rubygems/pull/7896)
+  - Add plugin hooks for Bundler.require [#3439](https://github.com/rubygems/rubygems/pull/3439)
+
+## Bug fixes:
+
+  - Fix restarting with locked version when `$PROGRAM_NAME` has been changed [#8320](https://github.com/rubygems/rubygems/pull/8320)
+  - Restore the previous cache format for git sources [#8296](https://github.com/rubygems/rubygems/pull/8296)
+  - Fix installs of subdependencies of unlocked dependencies to be conservative [#8281](https://github.com/rubygems/rubygems/pull/8281)
+  - Fix test task name on generated readme when using test-unit [#8291](https://github.com/rubygems/rubygems/pull/8291)
+  - Fix `bundle exec` executable detection on windows [#8276](https://github.com/rubygems/rubygems/pull/8276)
+  - Fix `bundle remove` sometimes not removing gems [#8278](https://github.com/rubygems/rubygems/pull/8278)
+  - Fix issue with git gems locking incorrect specs sometimes [#8269](https://github.com/rubygems/rubygems/pull/8269)
+
+## Documentation:
+
+  - Normalize command flag documentation and make sure all flags are documented [#8313](https://github.com/rubygems/rubygems/pull/8313)
+  - Add missing man pages for `bundle env` and `bundle licenses` [#8315](https://github.com/rubygems/rubygems/pull/8315)
+  - Add man page for 'bundle issue' command [#8271](https://github.com/rubygems/rubygems/pull/8271)
+  - Add man page for 'bundle fund' command [#8258](https://github.com/rubygems/rubygems/pull/8258)
+  - Move pry-related contents to `debugging.md` [#8263](https://github.com/rubygems/rubygems/pull/8263)
+  - Add debugging instruction on Windows [#8236](https://github.com/rubygems/rubygems/pull/8236)
+  - Unify rubygems and bundler docs directory [#8159](https://github.com/rubygems/rubygems/pull/8159)
+
 # 2.5.23 (November 5, 2024)
 
 ## Enhancements:

data/bundler.gemspec

@@ -29,10 +29,10 @@ Gem::Specification.new do |s|
     "source_code_uri" => "https://github.com/rubygems/rubygems/tree/master/bundler",
   }
 
-  s.required_ruby_version     = ">= 3.0.0"
+  s.required_ruby_version     = ">= 3.1.0"
 
   # It should match the RubyGems version shipped with `required_ruby_version` above
-  s.required_rubygems_version = ">= 3.2.3"
+  s.required_rubygems_version = ">= 3.3.3"
 
   s.files = Dir.glob("lib/bundler{.rb,/**/*}", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
 

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2024-11-05".freeze
-    @git_commit_sha = "35f4611265e".freeze
+    @built_at = "2024-12-16".freeze
+    @git_commit_sha = "d6be0319aaf".freeze
     @release = true
     # end ivars
 

data/lib/bundler/cli/console.rb

@@ -9,10 +9,6 @@ module Bundler
     end
 
     def run
-      message = "bundle console will be replaced by `bin/console` generated by `bundle gem <name>`"
-      removed_message = "bundle console has been replaced by `bin/console` generated by `bundle gem <name>`"
-      Bundler::SharedHelpers.major_deprecation 2, message, removed_message: removed_message
-
       group ? Bundler.require(:default, *group.split(" ").map!(&:to_sym)) : Bundler.require
       ARGV.clear
 

data/lib/bundler/cli/doctor.rb

@@ -32,11 +32,11 @@ module Bundler
 
     def dylibs_ldd(path)
       output = `/usr/bin/ldd #{path.shellescape}`.chomp
-      output.split("\n").map do |l|
+      output.split("\n").filter_map do |l|
         match = l.match(LDD_REGEX)
         next if match.nil?
         match.captures[0]
-      end.compact
+      end
     end
 
     def dylibs(path)
@@ -89,11 +89,11 @@ module Bundler
 
       if broken_links.any?
         message = "The following gems are missing OS dependencies:"
-        broken_links.map do |spec, paths|
+        broken_links.flat_map do |spec, paths|
           paths.uniq.map do |path|
             "\n * #{spec.name}: #{path}"
           end
-        end.flatten.sort.each {|m| message += m }
+        end.sort.each {|m| message += m }
         raise ProductionError, message
       elsif !permissions_valid
         Bundler.ui.info "No issues found with the installed bundle"

data/lib/bundler/cli/exec.rb

@@ -22,6 +22,7 @@ module Bundler
         if !Bundler.settings[:disable_exec_load] && ruby_shebang?(bin_path)
           return kernel_load(bin_path, *args)
         end
+        bin_path = "./" + bin_path unless File.absolute_path?(bin_path)
         kernel_exec(bin_path, *args)
       else
         # exec using the given command

data/lib/bundler/cli/gem.rb

@@ -446,7 +446,7 @@ module Bundler
     end
 
     def required_ruby_version
-      "3.0.0"
+      "3.1.0"
     end
 
     def rubocop_version

data/lib/bundler/cli/info.rb

@@ -73,11 +73,11 @@ module Bundler
     end
 
     def gem_dependencies
-      @gem_dependencies ||= Bundler.definition.specs.map do |spec|
+      @gem_dependencies ||= Bundler.definition.specs.filter_map do |spec|
         dependency = spec.dependencies.find {|dep| dep.name == gem_name }
         next unless dependency
         "#{spec.name} (#{spec.version}) depends on #{gem_name} (#{dependency.requirements_list.join(", ")})"
-      end.compact.sort
+      end.sort
     end
   end
 end

data/lib/bundler/cli/inject.rb

@@ -48,7 +48,7 @@ module Bundler
 
     def last_version_number
       definition = Bundler.definition(true)
-      definition.resolve_remotely!
+      definition.remotely!
       specs = definition.index[name].sort_by(&:version)
       unless options[:pre]
         specs.delete_if {|b| b.respond_to?(:version) && b.version.prerelease? }

data/lib/bundler/cli/install.rb

@@ -23,6 +23,10 @@ module Bundler
       # Disable color in deployment mode
       Bundler.ui.shell = Thor::Shell::Basic.new if options[:deployment]
 
+      if target_rbconfig_path = options[:"target-rbconfig"]
+        Bundler.rubygems.set_target_rbconfig(target_rbconfig_path)
+      end
+
       check_for_options_conflicts
 
       check_trust_policy

data/lib/bundler/cli/lock.rb

@@ -14,6 +14,8 @@ module Bundler
         exit 1
       end
 
+      check_for_conflicting_options
+
       print = options[:print]
       previous_output_stream = Bundler.ui.output_stream
       Bundler.ui.output_stream = :stderr if print
@@ -38,6 +40,7 @@ module Bundler
 
       Bundler.settings.temporary(frozen: false) do
         definition = Bundler.definition(update, file)
+        definition.add_checksums if options["add-checksums"]
 
         Bundler::CLI::Common.configure_gem_version_promoter(definition, options) if options[:update]
 
@@ -58,7 +61,11 @@ module Bundler
           raise InvalidOption, "Removing all platforms from the bundle is not allowed"
         end
 
-        definition.resolve_remotely! unless options[:local]
+        definition.remotely! unless options[:local]
+
+        if options["normalize-platforms"]
+          definition.normalize_platforms
+        end
 
         if print
           puts definition.to_lock
@@ -70,5 +77,17 @@ module Bundler
 
       Bundler.ui.output_stream = previous_output_stream
     end
+
+    private
+
+    def check_for_conflicting_options
+      if options["normalize-platforms"] && options["add-platform"].any?
+        raise InvalidOption, "--normalize-platforms can't be used with --add-platform"
+      end
+
+      if options["normalize-platforms"] && options["remove-platform"].any?
+        raise InvalidOption, "--normalize-platforms can't be used with --remove-platform"
+      end
+    end
   end
 end

data/lib/bundler/cli/pristine.rb

@@ -49,7 +49,7 @@ module Bundler
           true
         end.map(&:name)
 
-        jobs = installer.send(:installation_parallelization, {})
+        jobs = installer.send(:installation_parallelization)
         pristine_count = definition.specs.count - installed_specs.count
         # allow a pristining a single gem to skip the parallel worker
         jobs = [jobs, pristine_count].min

data/lib/bundler/cli/show.rb

@@ -59,9 +59,9 @@ module Bundler
       definition = Bundler.definition(true)
       if options[:outdated]
         Bundler.ui.info "Fetching remote specs for outdated check...\n\n"
-        Bundler.ui.silence { definition.resolve_remotely! }
+        Bundler.ui.silence { definition.remotely! }
       else
-        definition.resolve_with_cache!
+        definition.with_cache!
       end
       Bundler.reset!
       definition.specs

data/lib/bundler/cli.rb

@@ -217,7 +217,7 @@ module Bundler
     method_option "full-index", type: :boolean, banner: "Fall back to using the single-file index of all gems"
     method_option "gemfile", type: :string, banner: "Use the specified gemfile instead of Gemfile"
     method_option "jobs", aliases: "-j", type: :numeric, banner: "Specify the number of jobs to run in parallel"
-    method_option "local", type: :boolean, banner:       "Do not attempt to fetch gems remotely and use the gem cache instead"
+    method_option "local", type: :boolean, banner: "Do not attempt to fetch gems remotely and use the gem cache instead"
     method_option "prefer-local", type: :boolean, banner: "Only attempt to fetch gems remotely if not present locally, even if newer versions are available remotely"
     method_option "no-cache", type: :boolean, banner: "Don't update the existing gem cache."
     method_option "redownload", type: :boolean, aliases: "--force", banner: "Force downloading every gem."
@@ -227,8 +227,8 @@ module Bundler
     method_option "shebang", type: :string, banner: "Specify a different shebang executable name than the default (usually 'ruby')"
     method_option "standalone", type: :array, lazy_default: [], banner: "Make a bundle that can work without the Bundler runtime"
     method_option "system", type: :boolean, banner: "Install to the system location ($BUNDLE_PATH or $GEM_HOME) even if the bundle was previously installed somewhere else for this application"
-    method_option "trust-policy", alias: "P", type: :string, banner:       "Gem trust policy (like gem install -P). Must be one of " +
-                                                                           Bundler.rubygems.security_policy_keys.join("|")
+    method_option "trust-policy", alias: "P", type: :string, banner: "Gem trust policy (like gem install -P). Must be one of #{Bundler.rubygems.security_policy_keys.join("|")}"
+    method_option "target-rbconfig", type: :string, banner: "Path to rbconfig.rb for the deployment target platform"
     method_option "without", type: :array, banner: "Exclude gems that are part of the specified named group."
     method_option "with", type: :array, banner: "Include gems that are part of the specified named group."
     def install
@@ -286,10 +286,8 @@ module Bundler
       Show lists the names and versions of all gems that are required by your Gemfile.
       Calling show with [GEM] will list the exact location of that gem on your machine.
     D
-    method_option "paths", type: :boolean,
-                           banner: "List the paths of all gems that are required by your Gemfile."
-    method_option "outdated", type: :boolean,
-                              banner: "Show verbose output including whether gems are outdated."
+    method_option "paths", type: :boolean, banner: "List the paths of all gems that are required by your Gemfile."
+    method_option "outdated", type: :boolean, banner: "Show verbose output including whether gems are outdated."
     def show(gem_name = nil)
       if ARGV.include?("--outdated")
         message = "the `--outdated` flag to `bundle show` was undocumented and will be removed without replacement"
@@ -398,9 +396,7 @@ module Bundler
     end
 
     desc "cache [OPTIONS]", "Locks and then caches all of the gems into vendor/cache"
-    method_option "all", type: :boolean,
-                         default: Bundler.feature_flag.cache_all?,
-                         banner: "Include all sources (including path and git)."
+    method_option "all", type: :boolean, default: Bundler.feature_flag.cache_all?, banner: "Include all sources (including path and git)."
     method_option "all-platforms", type: :boolean, banner: "Include gems for all platforms present in the lockfile, not only the current one"
     method_option "cache-path", type: :string, banner: "Specify a different cache path than the default (vendor/cache)."
     method_option "gemfile", type: :string, banner: "Use the specified gemfile instead of Gemfile"
@@ -438,8 +434,8 @@ module Bundler
     map aliases_for("cache")
 
     desc "exec [OPTIONS]", "Run the command in context of the bundle"
-    method_option :keep_file_descriptors, type: :boolean, default: true
-    method_option :gemfile, type: :string, required: false
+    method_option :keep_file_descriptors, type: :boolean, default: true, banner: "Passes all file descriptors to the new processes. Default is true, and setting it to false is deprecated"
+    method_option :gemfile, type: :string, required: false, banner: "Use the specified gemfile instead of Gemfile"
     long_desc <<-D
       Exec runs a command, providing it access to the gems in the bundle. While using
       bundle exec you can require and call the bundled gems as if they were installed
@@ -480,12 +476,10 @@ module Bundler
       Open.new(options, name).run
     end
 
-    unless Bundler.feature_flag.bundler_3_mode?
-      desc "console [GROUP]", "Opens an IRB session with the bundle pre-loaded"
-      def console(group = nil)
-        require_relative "cli/console"
-        Console.new(options, group).run
-      end
+    desc "console [GROUP]", "Opens an IRB session with the bundle pre-loaded"
+    def console(group = nil)
+      require_relative "cli/console"
+      Console.new(options, group).run
     end
 
     desc "version", "Prints Bundler version information"
@@ -537,55 +531,28 @@ module Bundler
       end
     end
 
-    old_gem = instance_method(:gem)
-
     desc "gem NAME [OPTIONS]", "Creates a skeleton for creating a rubygem"
     method_option :exe, type: :boolean, default: false, aliases: ["--bin", "-b"], desc: "Generate a binary executable for your library."
     method_option :coc, type: :boolean, desc: "Generate a code of conduct file. Set a default with `bundle config set --global gem.coc true`."
-    method_option :edit, type: :string, aliases: "-e", required: false, banner: "EDITOR",
-                         lazy_default: [ENV["BUNDLER_EDITOR"], ENV["VISUAL"], ENV["EDITOR"]].find {|e| !e.nil? && !e.empty? },
-                         desc: "Open generated gemspec in the specified editor (defaults to $EDITOR or $BUNDLER_EDITOR)"
+    method_option :edit, type: :string, aliases: "-e", required: false, banner: "EDITOR", lazy_default: [ENV["BUNDLER_EDITOR"], ENV["VISUAL"], ENV["EDITOR"]].find {|e| !e.nil? && !e.empty? }, desc: "Open generated gemspec in the specified editor (defaults to $EDITOR or $BUNDLER_EDITOR)"
     method_option :ext, type: :string, desc: "Generate the boilerplate for C extension code.", enum: EXTENSIONS
     method_option :git, type: :boolean, default: true, desc: "Initialize a git repo inside your library."
     method_option :mit, type: :boolean, desc: "Generate an MIT license file. Set a default with `bundle config set --global gem.mit true`."
     method_option :rubocop, type: :boolean, desc: "Add rubocop to the generated Rakefile and gemspec. Set a default with `bundle config set --global gem.rubocop true`."
     method_option :changelog, type: :boolean, desc: "Generate changelog file. Set a default with `bundle config set --global gem.changelog true`."
-    method_option :test, type: :string, lazy_default: Bundler.settings["gem.test"] || "", aliases: "-t", banner: "Use the specified test framework for your library",
-                         enum: %w[rspec minitest test-unit],
-                         desc: "Generate a test directory for your library, either rspec, minitest or test-unit. Set a default with `bundle config set --global gem.test (rspec|minitest|test-unit)`."
-    method_option :ci, type: :string, lazy_default: Bundler.settings["gem.ci"] || "",
-                       enum: %w[github gitlab circle],
-                       desc: "Generate CI configuration, either GitHub Actions, GitLab CI or CircleCI. Set a default with `bundle config set --global gem.ci (github|gitlab|circle)`"
-    method_option :linter, type: :string, lazy_default: Bundler.settings["gem.linter"] || "",
-                           enum: %w[rubocop standard],
-                           desc: "Add a linter and code formatter, either RuboCop or Standard. Set a default with `bundle config set --global gem.linter (rubocop|standard)`"
+    method_option :test, type: :string, lazy_default: Bundler.settings["gem.test"] || "", aliases: "-t", banner: "Use the specified test framework for your library", enum: %w[rspec minitest test-unit], desc: "Generate a test directory for your library, either rspec, minitest or test-unit. Set a default with `bundle config set --global gem.test (rspec|minitest|test-unit)`."
+    method_option :ci, type: :string, lazy_default: Bundler.settings["gem.ci"] || "", enum: %w[github gitlab circle], desc: "Generate CI configuration, either GitHub Actions, GitLab CI or CircleCI. Set a default with `bundle config set --global gem.ci (github|gitlab|circle)`"
+    method_option :linter, type: :string, lazy_default: Bundler.settings["gem.linter"] || "", enum: %w[rubocop standard], desc: "Add a linter and code formatter, either RuboCop or Standard. Set a default with `bundle config set --global gem.linter (rubocop|standard)`"
     method_option :github_username, type: :string, default: Bundler.settings["gem.github_username"], banner: "Set your username on GitHub", desc: "Fill in GitHub username on README so that you don't have to do it manually. Set a default with `bundle config set --global gem.github_username <your_username>`."
 
     def gem(name)
-    end
-
-    commands["gem"].tap do |gem_command|
-      def gem_command.run(instance, args = [])
-        arity = 1 # name
+      require_relative "cli/gem"
+      cmd_args = args + [self]
+      cmd_args.unshift(options)
 
-        require_relative "cli/gem"
-        cmd_args = args + [instance]
-        cmd_args.unshift(instance.options)
-
-        cmd = begin
-          Gem.new(*cmd_args)
-        rescue ArgumentError => e
-          instance.class.handle_argument_error(self, e, args, arity)
-        end
-
-        cmd.run
-      end
+      Gem.new(*cmd_args).run
     end
 
-    undef_method(:gem)
-    define_method(:gem, old_gem)
-    private :gem
-
     def self.source_root
       File.expand_path("templates", __dir__)
     end
@@ -621,8 +588,10 @@ module Bundler
     method_option "gemfile", type: :string, banner: "Use the specified gemfile instead of Gemfile"
     method_option "lockfile", type: :string, default: nil, banner: "the path the lockfile should be written to"
     method_option "full-index", type: :boolean, default: false, banner: "Fall back to using the single-file index of all gems"
+    method_option "add-checksums", type: :boolean, default: false, banner: "Adds checksums to the lockfile"
     method_option "add-platform", type: :array, default: [], banner: "Add a new platform to the lockfile"
     method_option "remove-platform", type: :array, default: [], banner: "Remove a platform from the lockfile"
+    method_option "normalize-platforms", type: :boolean, default: false, banner: "Normalize lockfile platforms"
     method_option "patch", type: :boolean, banner: "If updating, prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "If updating, prefer updating only to next minor version"
     method_option "major", type: :boolean, banner: "If updating, prefer updating to next major version (default)"

data/lib/bundler/compact_index_client/cache_file.rb

@@ -86,11 +86,6 @@ module Bundler
         end
       end
 
-      # remove this method when we stop generating md5 digests for legacy etags
-      def md5
-        @digests && @digests["md5"]
-      end
-
       def digests?
         @digests&.any?
       end

data/lib/bundler/compact_index_client/updater.rb

@@ -28,7 +28,6 @@ module Bundler
 
         CacheFile.copy(local_path) do |file|
           etag = etag_path.read.tap(&:chomp!) if etag_path.file?
-          etag ||= generate_etag(etag_path, file) # Remove this after 2.5.0 has been out for a while.
 
           # Subtract a byte to ensure the range won't be empty.
           # Avoids 416 (Range Not Satisfiable) responses.
@@ -67,16 +66,6 @@ module Bundler
         etag_path.read.tap(&:chomp!) if etag_path.file?
       end
 
-      # When first releasing this opaque etag feature, we want to generate the old MD5 etag
-      # based on the content of the file. After that it will always use the saved opaque etag.
-      # This transparently saves existing users with good caches from updating a bunch of files.
-      # Remove this behavior after 2.5.0 has been out for a while.
-      def generate_etag(etag_path, file)
-        etag = file.md5.hexdigest
-        CacheFile.write(etag_path, etag)
-        etag
-      end
-
       def etag_from_response(response)
         return unless response["ETag"]
         etag = response["ETag"].delete_prefix("W/")