kettle-dev 3.1.17 → 3.1.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7509713aebd3dc8b2dfce4e04399bd8a004fdf0ab9d128b9147a3060e183fa7c
-  data.tar.gz: 06d242cd7e431a629f278b3ca28f4f6347bc40561056381ccd712886cf6ea48d
+  metadata.gz: bd1cd8bed8e26d699094373fa5a769a6cbb941479bc93027915bf9b6da388322
+  data.tar.gz: a6457f10daf0e149eac4d9c3138efad3a715f0ca3acfaf0c4bdd8611434996f2
 SHA512:
-  metadata.gz: 4659485434c16e16fcddd290cfb9afb233f1b5f9e60adc4c2dc933d951ce49f324b27763189b80f8bf2004ceed4dfbb713fc9f73301da040c3f891391d53a754
-  data.tar.gz: ddf71af290de3619c7bb48e296bb41501a01e2bb5defdcf999e51c8126cd3a41471efbb413d537cc91c9236dfafbaf0c50459fdda92019cff8850748aacf161d
+  metadata.gz: f6414ee199198649eb4a72822e9536be47f748e98e6265e861e67769549a9a3de7433685ac058fdb064bad442ef4dd4cc119a3669d29b3ce8217ae32eb020d88
+  data.tar.gz: a3410112a6c5fffaaf1c779ec3c1c4d09ab336be891f52b4ad673847b357a8e8bdab28ad6209ad20f478c19e2175e0347ce668b29d7a5832f6aa8ed295c4e898

data/CHANGELOG.md

@@ -30,6 +30,28 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.19] - 2026-10-19
+
+- TAG: [v3.1.19][3.1.19t]
+- COVERAGE: 91.79% -- 5768/6284 lines in 48 files
+- BRANCH COVERAGE: 75.75% -- 2218/2928 branches in 48 files
+- 53.60% documented
+
+### Fixed
+
+- [kc] appraisal-bundler-pin: Pin every bundler process spawned by the appraisal rake tasks to the exact Bundler version running rake via BUNDLER_VERSION, so RubyGems can no longer resolve a child bundle to a newer prerelease with different plugin DSL behavior.
+
+## [3.1.18] - 2026-10-19
+
+- TAG: [v3.1.18][3.1.18t]
+- COVERAGE: 91.72% -- 5763/6283 lines in 48 files
+- BRANCH COVERAGE: 75.73% -- 2216/2926 branches in 48 files
+- 53.60% documented
+
+### Added
+
+- kettle-release aborts with an explicit outdated-tool error when a newer release of kettle-dev exists in the same minor series (registry lookup; failures never block; newer minors only warn; KETTLE_DEV_SKIP_TOOL_CURRENCY_CHECK skips), so a stale copy resolved from an old lockfile can no longer silently run without lockfile materialization and self-heal fixes.
+
 ## [3.1.17] - 2026-10-18
 
 - TAG: [v3.1.17][3.1.17t]
@@ -4167,7 +4189,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.17...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.19...HEAD
+[3.1.19]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.18...v3.1.19
+[3.1.19t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.19
+[3.1.18]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.17...v3.1.18
+[3.1.18t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.18
 [3.1.17]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.16...v3.1.17
 [3.1.17t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.17
 [3.1.16]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.15...v3.1.16

data/README.md

@@ -1084,7 +1084,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.273-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.284-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/rakelib/appraisal.rake

@@ -47,6 +47,10 @@ begin
     "BUNDLE_GEMFILE" => "Appraisal.root.gemfile",
     "BUNDLE_LOCKFILE" => "Appraisal.root.gemfile.lock"
   )
+  # Pin every spawned bundler process to the exact version running this rake.
+  # Without this, RubyGems resolves the child `bundle` to its latest release,
+  # which can be a prerelease with different DSL behavior.
+  appraisal_env["BUNDLER_VERSION"] = bundler_version if bundler_version
 
   run_command = lambda do |failure_message, *args|
     ok = system(*args)

data/lib/kettle/dev/release_cli.rb

@@ -268,6 +268,7 @@ module Kettle
 
       def run
         @started_at = monotonic_time
+        ensure_release_tool_current!
         emit_run_start
         status = "ok"
         error = nil
@@ -2322,6 +2323,34 @@ module Kettle
         m[2]
       end
 
+      # Refuse to run a release with an outdated release tool. kettle-release
+      # is resolved from the invoking bundle (for family releases, the family
+      # root's Gemfile, which each family version-manages); a stale copy
+      # silently misses lockfile materialization and self-heal behavior added
+      # in later patch releases. When a newer release of this gem exists in
+      # the same minor series, abort with the reason instead of misbehaving.
+      # Newer releases in other minor series only warn: a family may
+      # deliberately track an older minor. Registry lookup failure never
+      # blocks a release. Skippable with KETTLE_DEV_SKIP_TOOL_CURRENCY_CHECK
+      # for intentionally offline runs.
+      def ensure_release_tool_current!
+        return if truthy_value?(ENV["KETTLE_DEV_SKIP_TOOL_CURRENCY_CHECK"])
+
+        gem_name = "kettle-dev"
+        current = Gem::Version.new(Kettle::Dev::VERSION)
+        latest_overall, latest_series = latest_released_versions(gem_name, current.to_s)
+
+        if latest_series && Gem::Version.new(latest_series) > current
+          raise Error,
+            "kettle-release (#{gem_name} #{current}) is outdated: #{latest_series} is available in " \
+            "the same minor series. Update the invoking Gemfile (bundle update #{gem_name}) and retry."
+        end
+
+        if latest_overall && Gem::Version.new(latest_overall) > current
+          warn("[kettle-release] #{gem_name} #{latest_overall} is available (running #{current} in the #{current.segments[0, 2].join(".")} series).")
+        end
+      end
+
       def latest_released_versions(gem_name, current_version)
         data = Kettle::Dev::RubyGemsVersions.fetch(gem_name, version_hint: current_version)
         return [nil, nil] unless data.is_a?(Array)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.17"
+      VERSION = "3.1.19"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.17
+  version: 3.1.19
 platform: ruby
 authors:
 - Peter H. Boling
@@ -423,10 +423,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.17
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.17/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.19
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.19/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.17
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.19
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev