bundler 4.0.0.beta1 → 4.0.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ea78831fde425df537d3ff1df353f5a3aca9f487ce4afa9e46299fa9dc97156
-  data.tar.gz: 6a00156d2407d372ee1e53ea9e8410a47c3ab253f022316001781e051c9cdb48
+  metadata.gz: 634a5d5342f3171f45785382c66e37eadd9e233782cf590ebe1163a857d7d75c
+  data.tar.gz: 2a4f5c89ba76155d05341c6651cf3583cb778f1912adf64647c752fafad03a46
 SHA512:
-  metadata.gz: b019a26c02b28e3f2e9d09dc52651549395248978130e40413800ebd738140bc3451639a112a0475a4cfa43818798aaff4d88b0105633e035133f7cc985d3003
-  data.tar.gz: dead007ff8a70c1bde02642b9c22c4eeb038cddb9751d175c4106ad030284ed2a71b84f4861e23e83d9be48e47bf3c5085e0ba0e80d9a10902ce042b6a78939b
+  metadata.gz: 4ef623469cfa6abb93f3bb7932a739824ae25285f29f59895786b041347b23d01b8f0f604ad133a5827b9f84862b0ac75a313376fbb20f480b5c44fb10a063bb
+  data.tar.gz: 2b07593c43df7d7b8e1cd4f4fbe6a83e44656804c6b10a9f5ce908057bd8c175e4f0f8683c3251bbcdd05d7aec607a43cb21e4674c405c5a7dbbea6cde669ef7

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 4.0.0.beta2 (2025-11-26)
+
+### Features:
+
+  - Support bundle install --lockfile option [#9111](https://github.com/ruby/rubygems/pull/9111)
+  - Add support for lockfile in Gemfile and bundle install --no-lock [#9059](https://github.com/ruby/rubygems/pull/9059)
+
+### Performance:
+
+  - Run git operations in parallel to speed things up: [#9100](https://github.com/ruby/rubygems/pull/9100)
+
+### Enhancements:
+
+  - Fixup GH-9085 [#9108](https://github.com/ruby/rubygems/pull/9108)
+  - Add go_gem/rake_task for Go native extention gem skeleton [#9105](https://github.com/ruby/rubygems/pull/9105)
+  - Keep legacy windows platform, not removed them [#9104](https://github.com/ruby/rubygems/pull/9104)
+
+### Bug fixes:
+
+  - Check for file existence before deletion from cache [#9095](https://github.com/ruby/rubygems/pull/9095)
+
 ## 4.0.0.beta1 (2025-11-20)
 
 ### Security:

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2025-11-20".freeze
-    @git_commit_sha = "9be811c01a".freeze
+    @built_at = "2025-11-26".freeze
+    @git_commit_sha = "743810236c".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/install.rb

@@ -44,6 +44,8 @@ module Bundler
       # (rather than some optimizations we perform at app runtime).
       definition = Bundler.definition(strict: true)
       definition.validate_runtime!
+      definition.lockfile = options["lockfile"] if options["lockfile"]
+      definition.lockfile = false if options["no-lock"]
 
       installer = Installer.install(Bundler.root, definition, options)
 

data/lib/bundler/cli.rb

@@ -59,17 +59,29 @@ module Bundler
     def initialize(*args)
       super
 
+      current_cmd = args.last[:current_command].name
+
       custom_gemfile = options[:gemfile] || Bundler.settings[:gemfile]
       if custom_gemfile && !custom_gemfile.empty?
         Bundler::SharedHelpers.set_env "BUNDLE_GEMFILE", File.expand_path(custom_gemfile)
-        Bundler.reset_settings_and_root!
+        reset_settings = true
       end
 
+      # lock --lockfile works differently than install --lockfile
+      unless current_cmd == "lock"
+        custom_lockfile = options[:lockfile] || Bundler.settings[:lockfile]
+        if custom_lockfile && !custom_lockfile.empty?
+          Bundler::SharedHelpers.set_env "BUNDLE_LOCKFILE", File.expand_path(custom_lockfile)
+          reset_settings = true
+        end
+      end
+
+      Bundler.reset_settings_and_root! if reset_settings
+
       Bundler.auto_switch
 
       Bundler.settings.set_command_option_if_given :retry, options[:retry]
 
-      current_cmd = args.last[:current_command].name
       Bundler.auto_install if AUTO_INSTALL_CMDS.include?(current_cmd)
     rescue UnknownArgumentError => e
       raise InvalidOption, e.message
@@ -232,8 +244,10 @@ module Bundler
     method_option "gemfile", type: :string, banner: "Use the specified gemfile instead of Gemfile"
     method_option "jobs", aliases: "-j", type: :numeric, banner: "Specify the number of jobs to run in parallel"
     method_option "local", type: :boolean, banner: "Do not attempt to fetch gems remotely and use the gem cache instead"
+    method_option "lockfile", type: :string, banner: "Use the specified lockfile instead of the default."
     method_option "prefer-local", type: :boolean, banner: "Only attempt to fetch gems remotely if not present locally, even if newer versions are available remotely"
     method_option "no-cache", type: :boolean, banner: "Don't update the existing gem cache."
+    method_option "no-lock", type: :boolean, banner: "Don't create a lockfile."
     method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "no-prune", type: :boolean, banner: "Don't remove stale gems from the cache (removed)."
     method_option "path", type: :string, banner: "Specify a different path than the system default, namely, $BUNDLE_PATH or $GEM_HOME (removed)."

data/lib/bundler/definition.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "lockfile_parser"
+require_relative "worker"
 
 module Bundler
   class Definition
@@ -9,6 +10,8 @@ module Bundler
       attr_accessor :no_lock
     end
 
+    attr_writer :lockfile
+
     attr_reader(
       :dependencies,
       :locked_checksums,
@@ -379,7 +382,7 @@ module Bundler
     end
 
     def write_lock(file, preserve_unknown_sections)
-      return if Definition.no_lock || file.nil?
+      return if Definition.no_lock || !lockfile || file.nil?
 
       contents = to_lock
 
@@ -1100,7 +1103,23 @@ module Bundler
       @source_requirements ||= find_source_requirements
     end
 
+    def preload_git_source_worker
+      @preload_git_source_worker ||= Bundler::Worker.new(5, "Git source preloading", ->(source, _) { source.specs })
+    end
+
+    def preload_git_sources
+      sources.git_sources.each {|source| preload_git_source_worker.enq(source) }
+    ensure
+      preload_git_source_worker.stop
+    end
+
     def find_source_requirements
+      if Gem.ruby_version >= Gem::Version.new("3.3")
+        # Ruby 3.2 has a bug that incorrectly triggers a circular dependency warning. This version will continue to
+        # fetch git repositories one by one.
+        preload_git_sources
+      end
+
       # Record the specs available in each gem's source, so that those
       # specs will be available later when the resolver knows where to
       # look for that gemspec (or its dependencies)

data/lib/bundler/dsl.rb

@@ -9,8 +9,9 @@ module Bundler
 
     def self.evaluate(gemfile, lockfile, unlock)
       builder = new
+      builder.lockfile(lockfile)
       builder.eval_gemfile(gemfile)
-      builder.to_definition(lockfile, unlock)
+      builder.to_definition(builder.lockfile_path, unlock)
     end
 
     VALID_PLATFORMS = Bundler::CurrentRuby::PLATFORM_MAP.keys.freeze
@@ -38,6 +39,7 @@ module Bundler
       @gemspecs             = []
       @gemfile              = nil
       @gemfiles             = []
+      @lockfile             = nil
       add_git_sources
     end
 
@@ -101,6 +103,15 @@ module Bundler
       add_dependency(name, version, options)
     end
 
+    # For usage in Dsl.evaluate, since lockfile is used as part of the Gemfile.
+    def lockfile_path
+      @lockfile
+    end
+
+    def lockfile(file)
+      @lockfile = file
+    end
+
     def source(source, *args, &blk)
       options = args.last.is_a?(Hash) ? args.pop.dup : {}
       options = normalize_hash(options)
@@ -175,6 +186,7 @@ module Bundler
 
     def to_definition(lockfile, unlock)
       check_primary_source_safety
+      lockfile = @lockfile unless @lockfile.nil?
       Definition.new(lockfile, @dependencies, @sources, unlock, @ruby_version, @optional_groups, @gemfiles)
     end
 
@@ -415,8 +427,8 @@ module Bundler
       windows_platforms = platforms.select {|pl| pl.to_s.match?(/mingw|mswin/) }
       if windows_platforms.any?
         windows_platforms = windows_platforms.map! {|pl| ":#{pl}" }.join(", ")
-        removed_message = "Platform #{windows_platforms} has been removed. Please use platform :windows instead."
-        Bundler::SharedHelpers.feature_removed! removed_message
+        deprecated_message = "Platform #{windows_platforms} will be removed in the future. Please use platform :windows instead."
+        Bundler::SharedHelpers.feature_deprecated! deprecated_message
       end
 
       # Save sources passed in a key

data/lib/bundler/environment_preserver.rb

@@ -6,6 +6,7 @@ module Bundler
     BUNDLER_KEYS = %w[
       BUNDLE_BIN_PATH
       BUNDLE_GEMFILE
+      BUNDLE_LOCKFILE
       BUNDLER_VERSION
       BUNDLER_SETUP
       GEM_HOME

data/lib/bundler/inline.rb

@@ -44,12 +44,14 @@ def gemfile(force_latest_compatible = false, options = {}, &gemfile)
   raise ArgumentError, "Unknown options: #{opts.keys.join(", ")}" unless opts.empty?
 
   old_gemfile = ENV["BUNDLE_GEMFILE"]
+  old_lockfile = ENV["BUNDLE_LOCKFILE"]
 
   Bundler.unbundle_env!
 
   begin
     Bundler.instance_variable_set(:@bundle_path, Pathname.new(Gem.dir))
     Bundler::SharedHelpers.set_env "BUNDLE_GEMFILE", "Gemfile"
+    Bundler::SharedHelpers.set_env "BUNDLE_LOCKFILE", "Gemfile.lock"
 
     Bundler::Plugin.gemfile_install(&gemfile) if Bundler.settings[:plugins]
     builder = Bundler::Dsl.new
@@ -94,5 +96,11 @@ def gemfile(force_latest_compatible = false, options = {}, &gemfile)
     else
       ENV["BUNDLE_GEMFILE"] = ""
     end
+
+    if old_lockfile
+      ENV["BUNDLE_LOCKFILE"] = old_lockfile
+    else
+      ENV["BUNDLE_LOCKFILE"] = ""
+    end
   end
 end

data/lib/bundler/man/bundle-config.1

@@ -145,6 +145,9 @@ Generate a \fBgems\.rb\fR instead of a \fBGemfile\fR when running \fBbundle init
 \fBjobs\fR (\fBBUNDLE_JOBS\fR)
 The number of gems Bundler can install in parallel\. Defaults to the number of available processors\.
 .TP
+\fBlockfile\fR (\fBBUNDLE_LOCKFILE\fR)
+The path to the lockfile that bundler should use\. By default, Bundler adds \fB\.lock\fR to the end of the \fBgemfile\fR entry\. Can be set to \fBfalse\fR in the Gemfile to disable lockfile creation entirely (see gemfile(5))\.
+.TP
 \fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR)
 Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\.
 .TP

data/lib/bundler/man/bundle-config.1.ronn

@@ -189,6 +189,10 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
 * `jobs` (`BUNDLE_JOBS`):
    The number of gems Bundler can install in parallel. Defaults to the number of
    available processors.
+* `lockfile` (`BUNDLE_LOCKFILE`):
+   The path to the lockfile that bundler should use. By default, Bundler adds
+   `.lock` to the end of the `gemfile` entry. Can be set to `false` in the
+   Gemfile to disable lockfile creation entirely (see gemfile(5)).
 * `lockfile_checksums` (`BUNDLE_LOCKFILE_CHECKSUMS`):
    Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources. Defaults to true.
 * `no_install` (`BUNDLE_NO_INSTALL`):

data/lib/bundler/man/bundle-install.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-install\fR \- Install the dependencies specified in your Gemfile
 .SH "SYNOPSIS"
-\fBbundle install\fR [\-\-force] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-jobs=NUMBER] [\-\-local] [\-\-no\-cache] [\-\-prefer\-local] [\-\-quiet] [\-\-retry=NUMBER] [\-\-standalone[=GROUP[ GROUP\|\.\|\.\|\.]]] [\-\-trust\-policy=TRUST\-POLICY] [\-\-target\-rbconfig=TARGET\-RBCONFIG]
+\fBbundle install\fR [\-\-force] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-jobs=NUMBER] [\-\-local] [\-\-lockfile=LOCKFILE] [\-\-no\-cache] [\-\-no\-lock] [\-\-prefer\-local] [\-\-quiet] [\-\-retry=NUMBER] [\-\-standalone[=GROUP[ GROUP\|\.\|\.\|\.]]] [\-\-trust\-policy=TRUST\-POLICY] [\-\-target\-rbconfig=TARGET\-RBCONFIG]
 .SH "DESCRIPTION"
 Install the gems specified in your Gemfile(5)\. If this is the first time you run bundle install (and a \fBGemfile\.lock\fR does not exist), Bundler will fetch all remote sources, resolve dependencies and install all needed gems\.
 .P
@@ -28,12 +28,20 @@ The maximum number of parallel download and install jobs\. The default is the nu
 \fB\-\-local\fR
 Do not attempt to connect to \fBrubygems\.org\fR\. Instead, Bundler will use the gems already present in Rubygems' cache or in \fBvendor/cache\fR\. Note that if an appropriate platform\-specific gem exists on \fBrubygems\.org\fR it will not be found\.
 .TP
+\fB\-\-lockfile=LOCKFILE\fR
+The location of the lockfile which Bundler should use\. This defaults to the Gemfile location with \fB\.lock\fR appended\.
+.TP
 \fB\-\-prefer\-local\fR
 Force using locally installed gems, or gems already present in Rubygems' cache or in \fBvendor/cache\fR, when resolving, even if newer versions are available remotely\. Only attempt to connect to \fBrubygems\.org\fR for gems that are not present locally\.
 .TP
 \fB\-\-no\-cache\fR
 Do not update the cache in \fBvendor/cache\fR with the newly bundled gems\. This does not remove any gems in the cache but keeps the newly bundled gems from being cached during the install\.
 .TP
+\fB\-\-no\-lock\fR
+Do not create a lockfile\. Useful if you want to install dependencies but not lock versions of gems\. Recommended for library development, and other situations where the code is expected to work with a range of dependency versions\.
+.IP
+This has the same effect as using \fBlockfile false\fR in the Gemfile\. See gemfile(5) for more information\.
+.TP
 \fB\-\-quiet\fR
 Do not print progress information to the standard output\.
 .TP

data/lib/bundler/man/bundle-install.1.ronn

@@ -8,7 +8,9 @@ bundle-install(1) -- Install the dependencies specified in your Gemfile
                  [--gemfile=GEMFILE]
                  [--jobs=NUMBER]
                  [--local]
+                 [--lockfile=LOCKFILE]
                  [--no-cache]
+                 [--no-lock]
                  [--prefer-local]
                  [--quiet]
                  [--retry=NUMBER]
@@ -60,6 +62,10 @@ update process below under [CONSERVATIVE UPDATING][].
   appropriate platform-specific gem exists on `rubygems.org` it will not be
   found.
 
+* `--lockfile=LOCKFILE`:
+  The location of the lockfile which Bundler should use. This defaults
+  to the Gemfile location with `.lock` appended.
+
 * `--prefer-local`:
   Force using locally installed gems, or gems already present in Rubygems' cache
   or in `vendor/cache`, when resolving, even if newer versions are available
@@ -71,6 +77,15 @@ update process below under [CONSERVATIVE UPDATING][].
   does not remove any gems in the cache but keeps the newly bundled gems from
   being cached during the install.
 
+* `--no-lock`:
+  Do not create a lockfile. Useful if you want to install dependencies but not
+  lock versions of gems. Recommended for library development, and other
+  situations where the code is expected to work with a range of dependency
+  versions.
+
+  This has the same effect as using `lockfile false` in the Gemfile.
+  See gemfile(5) for more information.
+
 * `--quiet`:
   Do not print progress information to the standard output.
 

data/lib/bundler/man/gemfile.5

@@ -469,4 +469,35 @@ For implicit gems (dependencies of explicit gems), any source, git, or path repo
 .IP "3." 4
 If neither of the above conditions are met, the global source will be used\. If multiple global sources are specified, they will be prioritized from last to first, but this is deprecated since Bundler 1\.13, so Bundler prints a warning and will abort with an error in the future\.
 .IP "" 0
+.SH "LOCKFILE"
+By default, Bundler will create a lockfile by adding \fB\.lock\fR to the end of the Gemfile name\. To change this, use the \fBlockfile\fR method:
+.IP "" 4
+.nf
+lockfile "/path/to/lockfile\.lock"
+.fi
+.IP "" 0
+.P
+This is useful when you want to use different lockfiles per ruby version or platform\.
+.P
+To avoid writing a lock file, use \fBfalse\fR as the argument:
+.IP "" 4
+.nf
+lockfile false
+.fi
+.IP "" 0
+.P
+This is useful for library development and other situations where the code is expected to work with a range of dependency versions\.
+.SS "LOCKFILE PRECEDENCE"
+When determining path to the lockfile or whether to create a lockfile, the following precedence is used:
+.IP "1." 4
+The \fBbundle install\fR \fB\-\-no\-lock\fR option (which disables lockfile creation)\.
+.IP "2." 4
+The \fBbundle install\fR \fB\-\-lockfile\fR option\.
+.IP "3." 4
+The \fBlockfile\fR method in the Gemfile\.
+.IP "4." 4
+The \fBBUNDLE_LOCKFILE\fR environment variable\.
+.IP "5." 4
+The default behavior of adding \fB\.lock\fR to the end of the Gemfile name\.
+.IP "" 0
 

data/lib/bundler/man/gemfile.5.ronn

@@ -556,3 +556,31 @@ bundler uses the following priority order:
      If multiple global sources are specified, they will be prioritized from
      last to first, but this is deprecated since Bundler 1.13, so Bundler prints
      a warning and will abort with an error in the future.
+
+## LOCKFILE
+
+By default, Bundler will create a lockfile by adding `.lock` to the end of the
+Gemfile name. To change this, use the `lockfile` method:
+
+    lockfile "/path/to/lockfile.lock"
+
+This is useful when you want to use different lockfiles per ruby version or
+platform.
+
+To avoid writing a lock file, use `false` as the argument:
+
+    lockfile false
+
+This is useful for library development and other situations where the code is
+expected to work with a range of dependency versions.
+
+### LOCKFILE PRECEDENCE
+
+When determining path to the lockfile or whether to create a lockfile, the
+following precedence is used:
+
+1. The `bundle install` `--no-lock` option (which disables lockfile creation).
+1. The `bundle install` `--lockfile` option.
+1. The `lockfile` method in the Gemfile.
+1. The `BUNDLE_LOCKFILE` environment variable.
+1. The default behavior of adding `.lock` to the end of the Gemfile name.

data/lib/bundler/runtime.rb

@@ -240,7 +240,11 @@ module Bundler
 
         cached.each do |path|
           Bundler.ui.info "  * #{File.basename(path)}"
-          File.delete(path)
+
+          begin
+            File.delete(path)
+          rescue Errno::ENOENT
+          end
         end
       end
     end

data/lib/bundler/settings.rb

@@ -65,6 +65,7 @@ module Bundler
       gem.rubocop
       gem.test
       gemfile
+      lockfile
       path
       shebang
       simulate_version

data/lib/bundler/shared_helpers.rb

@@ -23,6 +23,9 @@ module Bundler
     end
 
     def default_lockfile
+      given = ENV["BUNDLE_LOCKFILE"]
+      return Pathname.new(given) if given && !given.empty?
+
       gemfile = default_gemfile
 
       case gemfile.basename.to_s
@@ -297,6 +300,7 @@ module Bundler
     def set_bundle_variables
       Bundler::SharedHelpers.set_env "BUNDLE_BIN_PATH", bundle_bin_path
       Bundler::SharedHelpers.set_env "BUNDLE_GEMFILE", find_gemfile.to_s
+      Bundler::SharedHelpers.set_env "BUNDLE_LOCKFILE", default_lockfile.to_s
       Bundler::SharedHelpers.set_env "BUNDLER_VERSION", Bundler::VERSION
       Bundler::SharedHelpers.set_env "BUNDLER_SETUP", File.expand_path("setup", __dir__)
     end

data/lib/bundler/templates/newgem/Rakefile.tt

@@ -59,6 +59,11 @@ Rake::ExtensionTask.new("<%= config[:underscored_name] %>", GEMSPEC) do |ext|
 end
 <% end -%>
 
+<% if config[:ext] == "go" -%>
+require "go_gem/rake_task"
+
+GoGem::RakeTask.new("<%= config[:underscored_name] %>")
+<% end -%>
 <% end -%>
 <% if default_task_names.size == 1 -%>
 task default: <%= default_task_names.first.inspect %>

data/lib/bundler/ui/shell.rb

@@ -17,6 +17,7 @@ module Bundler
         @level = ENV["DEBUG"] ? "debug" : "info"
         @warning_history = []
         @output_stream = :stdout
+        @thread_safe_logger_key = "logger_level_#{object_id}"
       end
 
       def add_color(string, *color)
@@ -97,11 +98,13 @@ module Bundler
       end
 
       def level(name = nil)
-        return @level unless name
+        current_level = Thread.current.thread_variable_get(@thread_safe_logger_key) || @level
+        return current_level unless name
+
         unless index = LEVELS.index(name)
           raise "#{name.inspect} is not a valid level"
         end
-        index <= LEVELS.index(@level)
+        index <= LEVELS.index(current_level)
       end
 
       def output_stream=(symbol)
@@ -167,12 +170,13 @@ module Bundler
         end * "\n"
       end
 
-      def with_level(level)
-        original = @level
-        @level = level
+      def with_level(desired_level)
+        old_level = level
+        Thread.current.thread_variable_set(@thread_safe_logger_key, desired_level)
+
         yield
       ensure
-        @level = original
+        Thread.current.thread_variable_set(@thread_safe_logger_key, old_level)
       end
 
       def with_output_stream(symbol)

data/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.0.beta1".freeze
+  VERSION = "4.0.0.beta2".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 4.0.0.beta1
+  version: 4.0.0.beta2
 platform: ruby
 authors:
 - André Arko