kettle-dev 3.1.7 → 3.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2de1266e7cdbbfd6174c040d8602cf8c3349a423bc301f071ba45da206cba969
-  data.tar.gz: f93264ee009dbede2c2ff3273a396916a31d51a70b1ac1cab817532e11f396f5
+  metadata.gz: 452c1019273fac5fa450b42b6bf0d24fee016a6641971eeb3c5bddcf08efaa64
+  data.tar.gz: 4919f5ac1cd4aeb579da6ae378109923cf7fe86c6568b77ab42101e2f8bd4087
 SHA512:
-  metadata.gz: 6a10b65136115e119f2b24eea184c114ea09ae969bed38f71005f39f0fe2f1f0ef1a9869449cf70cf895f075c0c01387918b02bafb914237ca3136d2f4ef868f
-  data.tar.gz: 9e14f9945043f4f104c65e34dae30e11301e84caa63f474555d0befe80a35508d604b331da62306808a927eb881e2a41a66562582896b4145cf22e9051db8c65
+  metadata.gz: 58be74c463a06ea48b7571ec6fffa36bcaca0da0eb5e1a7cab2b4d3765f7fe2a4be2932f1cf09bfc496c97a9fa32badcf36182eabcdf58e61f5eb8c7242c9d41
+  data.tar.gz: 6e679af06a75e16ff6321f348cae64f8fa8c6884408f4fca7f20c7d5d8b5498bd4cf6bac270c0dc04a84747f3e67dffe7562c89e15d91afc38d11dd7f59e82f6

data/CHANGELOG.md

@@ -30,6 +30,43 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.9] - 2026-10-09
+
+- TAG: [v3.1.9][3.1.9t]
+- COVERAGE: 91.79% -- 6291/6854 lines in 49 files
+- BRANCH COVERAGE: 75.97% -- 2397/3155 branches in 49 files
+- 51.77% documented
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 5 project files:
+  - dependencies (5)
+
+- [kc] kettle-jem/template: updated 3 project files:
+  - code and tests (2)
+  - other (1)
+
+### Fixed
+
+- [kc] bundler-pin-no-prerelease: Release step 1 (`update_bundler_and_commit!`) and `appraisal:update` pin the Bundler version when running `bundle update --bundler` instead of leaving it bare. A bare `--bundler` resolves to whatever RubyGems reports as bundler's "latest", which includes prereleases: bundler published `4.1.0.beta1` as latest, so a bare update installed the beta and rewrote `BUNDLED WITH` to it. That beta vendors its own copy of rubygems' URI constants, and loading it against rubygems' copy emits a wall of `already initialized constant Gem::URI::...` warnings on stderr, which broke any spec shelling out to an executable and asserting clean stderr — failing a later release at its coverage step. Pinning matches `LockfileReset#lockfile_command`, which already documents this hazard.
+
+## [3.1.8] - 2026-10-07
+
+- TAG: [v3.1.8][3.1.8t]
+- COVERAGE: 91.65% -- 6276/6848 lines in 49 files
+- BRANCH COVERAGE: 75.90% -- 2390/3149 branches in 49 files
+- 51.77% documented
+
+### Added
+
+- `Kettle::Dev::RubyGemsVersions.fetch` accepts a `source:` keyword so callers can query a RubyGems-compatible private registry such as gem.coop instead of only rubygems.org. The version cache is now namespaced by source host, so a private registry lagging rubygems.org cannot serve stale answers for the other. The default source keeps the historical bare gem-name cache key, so existing caches remain valid.
+
+- `Kettle::Dev::RubyGemsVersions.published_version_numbers(gem_name, source:)` returns the version numbers a registry serves for a gem, or nil when the registry could not be consulted. Callers must treat nil as "unknown" rather than "unpublished" so an offline run is not blocked; an empty list, by contrast, means the registry was reached and serves no versions.
+
+- [kc] lockfile-registry-specs: `Kettle::Dev::LockfileReset.registry_gem_specs_from_source` returns GEM-section specs as `{remote:, name:, version:}` so a caller can attribute each pinned version to the registry it was resolved from, which is what makes it possible to detect a locally built and installed gem leaking into a lockfile: bundler resolves against the local gem dir, so an ordinary `bundle install` can pin a version no registry serves, and the resulting entry is a normal GEM-section line carrying a valid checksum taken from the installed spec, so nothing in the lockfile text distinguishes it and "is this version published?" can only be answered against the remote that section recorded. `gem_specs_from_source` is now a thin wrapper over it and keeps returning `[[name, version]]` unchanged.
+
+- `Kettle::Dev::RubyGemsVersions.published_version_numbers` accepts a `version:` keyword and forwards it to `fetch` as a cache-bust hint, so the on-disk release marker that `kettle-release` writes after publishing busts the cache for exactly that gem and version instead of for every gem released within the marker TTL. Without it a caller cannot distinguish "published moments ago in this very run" from "released sometime in the last month". Also adds `RubyGemsVersions.recently_released?(gem_name, version)`, which reports whether the marker records that exact gem and version as published within the TTL, treating a missing or corrupt marker as false rather than raising.
+
 ## [3.1.7] - 2026-10-04
 
 - TAG: [v3.1.7][3.1.7t]
@@ -3984,7 +4021,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.7...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.9...HEAD
+[3.1.9]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.8...v3.1.9
+[3.1.9t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.9
+[3.1.8]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.7...v3.1.8
+[3.1.8t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.8
 [3.1.7]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.6...v3.1.7
 [3.1.7t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.7
 [3.1.6]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.5...v3.1.6

data/README.md

@@ -1067,7 +1067,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.824-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.848-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -75,19 +75,42 @@ module Kettle
         end
 
         def gem_specs_from_source(lockfile_source)
+          registry_gem_specs_from_source(lockfile_source).map { |spec| [spec.fetch(:name), spec.fetch(:version)] }.uniq
+        end
+
+        # Like gem_specs_from_source, but attributes each spec to the registry
+        # remote of the GEM section it appeared in.
+        #
+        # Remote attribution matters for detecting locally installed but
+        # unpublished versions: a lockfile can carry several GEM sections with
+        # different remotes, and "is this version published?" can only be
+        # answered against the source that was actually used. Bundler resolves
+        # a locally installed spec during an ordinary `bundle install`, so the
+        # pinned entry looks exactly like a published one — same GEM section,
+        # valid checksum — and only a registry query for that remote reveals
+        # the version does not exist there.
+        #
+        # @return [Array<Hash>] entries of {remote:, name:, version:}
+        def registry_gem_specs_from_source(lockfile_source)
           in_gem = false
           in_specs = false
+          remote = nil
           specs = []
           lockfile_source.each_line do |line|
             stripped = line.chomp
             if stripped == "GEM"
               in_gem = true
               in_specs = false
+              remote = nil
               next
             end
             next unless in_gem
             break if !stripped.empty? && stripped == stripped.upcase && !stripped.start_with?(" ")
 
+            if stripped.start_with?("  remote:")
+              remote = stripped.delete_prefix("  remote:").strip
+              next
+            end
             if stripped == "  specs:"
               in_specs = true
               next
@@ -96,7 +119,9 @@ module Kettle
             next unless line.start_with?("    ") && !line.start_with?("      ")
 
             parsed = parse_lockfile_spec_line(stripped)
-            specs << [parsed.fetch(:name), parsed.fetch(:version)] if parsed
+            next unless parsed
+
+            specs << {remote: remote, name: parsed.fetch(:name), version: parsed.fetch(:version)}
           end
           specs.uniq
         end

data/lib/kettle/dev/rakelib/appraisal.rake

@@ -6,6 +6,16 @@ begin
   require "kettle/dev/lockfile_reset"
 
   bundle = "bundle"
+  # The exact Bundler running this rake, so `bundle update --bundler=VERSION`
+  # records it instead of resolving to RubyGems' "latest" bundler, which can be
+  # a prerelease. Falls back to the bare flag only if no version is
+  # determinable, preserving prior behaviour rather than failing.
+  bundler_version = if defined?(Bundler) && Bundler::VERSION
+    Bundler::VERSION
+  elsif (bundler_spec = Gem.loaded_specs["bundler"])
+    bundler_spec.version.to_s
+  end
+  bundler_version_arg = bundler_version ? "--bundler=#{bundler_version}" : "--bundler"
   unbundled_env = Kettle::Dev::LockfileReset::UNBUNDLED_ENV_KEYS.each_with_object({}) do |key, env|
     env[key] = nil
   end
@@ -144,13 +154,20 @@ begin
             "--quiet"
           )
 
-          # 2) BUNDLE_GEMFILE=Appraisal.root.gemfile bundle update --bundler
+          # 2) BUNDLE_GEMFILE=Appraisal.root.gemfile bundle update --bundler=<version>
+          #
+          # Pinned to the executing Bundler. A bare `--bundler` resolves to
+          # whatever RubyGems reports as bundler's "latest", which includes
+          # prereleases, so it can install a beta and record it in BUNDLED WITH;
+          # that beta's vendored URI then collides with rubygems' copy and
+          # spams stderr. See ReleaseCLI#update_bundler_and_commit! and
+          # LockfileReset#lockfile_command for the same hazard.
           run_command.call(
             "appraisal:update failed: BUNDLE_GEMFILE=Appraisal.root.gemfile bundle update --bundler",
             appraisal_env,
             bundle,
             "update",
-            "--bundler"
+            bundler_version_arg
           )
 
           # 3) BUNDLE_GEMFILE=Appraisal.root.gemfile bundle install

data/lib/kettle/dev/release_cli.rb

@@ -1864,14 +1864,26 @@ module Kettle
       # Keep Bundler maintenance separate from the release metadata commit.
       # The project lockfiles are shared development state, so the update must
       # be real and committed rather than hidden behind a temporary lockfile.
+      #
+      # The version is pinned to the Bundler actually executing rather than left
+      # bare. `bundle update --bundler` resolves to whatever RubyGems reports as
+      # bundler's "latest", which includes prereleases: bundler published
+      # 4.1.0.beta1 as latest, so a bare update installed the beta and rewrote
+      # BUNDLED WITH to it. That beta vendors its own copy of rubygems' URI
+      # constants, and loading it against rubygems' copy emits a wall of
+      # "already initialized constant Gem::URI::..." warnings on stderr, which
+      # broke any spec shelling out to the executable and asserting clean stderr
+      # — failing a later release at its coverage step. Pinning matches
+      # LockfileReset#lockfile_command, which already documents this hazard.
       def update_bundler_and_commit!
-        run_cmd!(release_project_command("bundle update --bundler"))
+        bundler_version = Shellwords.escape(Bundler::VERSION)
+        run_cmd!(release_project_command("bundle update --bundler=#{bundler_version}"))
 
         appraisal_gemfile = File.join(@root, "Appraisal.root.gemfile")
         if File.file?(appraisal_gemfile)
           appraisal_lockfile = File.join(@root, "Appraisal.root.gemfile.lock")
           appraisal_command = "BUNDLE_GEMFILE=#{Shellwords.escape(appraisal_gemfile)} " \
-            "BUNDLE_LOCKFILE=#{Shellwords.escape(appraisal_lockfile)} bundle update --bundler"
+            "BUNDLE_LOCKFILE=#{Shellwords.escape(appraisal_lockfile)} bundle update --bundler=#{bundler_version}"
           run_cmd!(release_project_command(appraisal_command))
           run_cmd!(release_project_command("bundle exec rake appraisal:reset"))
         end

data/lib/kettle/dev/ruby_gems_versions.rb

@@ -16,19 +16,27 @@ module Kettle
       VERSION_CACHE_TTL_SECONDS = 30 * 24 * 60 * 60
       HTTP_OPEN_TIMEOUT_SECONDS = 5
       HTTP_READ_TIMEOUT_SECONDS = 10
+      DEFAULT_SOURCE = "https://rubygems.org"
       ENV_REFRESH = "KETTLE_RUBYGEMS_REFRESH"
       ENV_MARKER_PATH = "KETTLE_RUBYGEMS_CACHE_BUST_PATH"
       ENV_VERSION_CACHE_PATH = "KETTLE_RUBYGEMS_VERSION_CACHE_PATH"
       ENV_LEGACY_VERSION_CACHE_PATH = "KETTLE_JEM_DEPS_FLOOR_CACHE"
 
       class << self
-        def fetch(gem_name, version_hint: nil, refresh: false)
+        # Query a RubyGems-compatible versions API.
+        #
+        # +source+ selects which registry to ask, because a private registry
+        # such as gem.coop can lag rubygems.org: a version present on one may
+        # be absent from the other. Cache entries are keyed by source for the
+        # same reason, so the two registries cannot poison each other.
+        def fetch(gem_name, version_hint: nil, refresh: false, source: DEFAULT_SOURCE)
           name = gem_name.to_s
-          cached = cached_versions(name)
+          key = cache_key(name, source)
+          cached = cached_versions(key)
           cache_bust = refresh || env_refresh? || fresh_release_marker?(name, version_hint) || cached_behind_version?(cached, version_hint)
           return cached if cached && !cache_bust
 
-          uri = versions_uri(gem_name, cache_bust: cache_bust)
+          uri = versions_uri(gem_name, source: source, cache_bust: cache_bust)
           request = Net::HTTP::Get.new(uri)
           if cache_bust
             request["Cache-Control"] = "no-cache"
@@ -44,13 +52,13 @@ module Kettle
             http.request(request)
           end
           if response.code.to_i == 404
-            write_versions(name, [])
+            write_versions(key, [])
             return []
           end
           return cached unless response.is_a?(Net::HTTPSuccess)
 
           data = JSON.parse(response.body)
-          write_versions(name, data) if data.is_a?(Array)
+          write_versions(key, data) if data.is_a?(Array)
           data
         rescue => error
           return cached if cached
@@ -58,6 +66,40 @@ module Kettle
           raise error
         end
 
+        # Published version numbers for a gem on one registry, or nil when the
+        # registry could not be consulted (caller must treat that as "unknown",
+        # never as "unpublished", so offline runs are not blocked).
+        #
+        # +source+ is matched against the remote a lockfile actually recorded,
+        # since a private registry such as gem.coop can lag rubygems.org.
+        #
+        # +version+ is the version the caller is asking about, forwarded as
+        # fetch's version_hint. That makes cache-busting precise: the on-disk
+        # release marker written by kettle-release busts the cache only for the
+        # exact gem+version just published, instead of for every gem released
+        # within the marker TTL. Without it a caller cannot tell "this version
+        # was published moments ago in this very run" from "this gem was
+        # released at some point in the last month".
+        def published_version_numbers(gem_name, source: DEFAULT_SOURCE, version: nil)
+          versions = fetch(gem_name, version_hint: version, source: normalize_source(source))
+          return nil if versions.nil?
+
+          versions.filter_map { |entry| entry["number"] if entry.is_a?(Hash) }
+        rescue
+          nil
+        end
+
+        # Whether kettle-release's on-disk marker says this exact gem+version
+        # was published recently enough that cached registry data must not be
+        # trusted for it.
+        #
+        # The marker file is the authority on what this machine just published,
+        # so any process-local cache layered on top of the registry must consult
+        # it rather than serve a pre-publish answer.
+        def recently_released?(gem_name, version = nil)
+          fresh_release_marker?(gem_name.to_s, version&.to_s)
+        end
+
         def mark_released(gem_name, version)
           return if gem_name.to_s.empty? || version.to_s.empty?
 
@@ -99,8 +141,25 @@ module Kettle
 
         private
 
-        def versions_uri(gem_name, cache_bust:)
-          uri = URI("https://rubygems.org/api/v1/versions/#{gem_name}.json")
+        # Cache entries are namespaced by source host so a version list fetched
+        # from a private registry cannot be served for rubygems.org, or vice
+        # versa. The default source keeps the historical bare gem name as its
+        # key so existing caches remain valid.
+        def cache_key(gem_name, source)
+          normalized = normalize_source(source)
+          return gem_name.to_s if normalized == DEFAULT_SOURCE
+
+          "#{URI(normalized).host}:#{gem_name}"
+        rescue URI::InvalidURIError
+          "#{normalized}:#{gem_name}"
+        end
+
+        def normalize_source(source)
+          source.to_s.sub(%r{/+\z}, "")
+        end
+
+        def versions_uri(gem_name, source:, cache_bust:)
+          uri = URI("#{normalize_source(source)}/api/v1/versions/#{gem_name}.json")
           uri.query = "_kettle_cache_bust=#{Time.now.to_i}" if cache_bust
           uri
         end
@@ -145,31 +204,31 @@ module Kettle
           ENV.fetch(ENV_REFRESH, "").match?(Kettle::Dev::ENV_TRUE_RE)
         end
 
-        def cached_versions(gem_name)
+        def cached_versions(cache_key)
           path = version_cache_path
           return nil if path.empty?
 
-          entry = read_version_cache(path).fetch("versions", {})[gem_name]
+          entry = read_version_cache(path).fetch("versions", {})[cache_key]
           return nil unless entry.is_a?(Hash)
           return nil unless fresh_version_cache_entry?(entry)
 
           Array(entry["entries"])
         end
 
-        def write_versions(gem_name, entries)
+        def write_versions(cache_key, entries)
           path = version_cache_path
           return if path.empty?
 
           data = read_version_cache(path)
           data["versions"] ||= {}
-          data["versions"][gem_name] = {
+          data["versions"][cache_key] = {
             "cached_at" => Time.now.utc.iso8601,
             "entries" => entries
           }
           FileUtils.mkdir_p(File.dirname(path))
           File.write(path, JSON.pretty_generate(data) << "\n")
         rescue => error
-          warn("[kettle-dev] could not update RubyGems.org version cache: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
+          warn("[kettle-dev] could not update RubyGems version cache: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
         end
 
         def read_version_cache(path)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.7"
+      VERSION = "3.1.9"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.7
+  version: 3.1.9
 platform: ruby
 authors:
 - Peter H. Boling
@@ -276,7 +276,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.13
+        version: 3.2.14
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.13
+        version: 3.2.14
 - !ruby/object:Gem::Dependency
   name: stone_checksums
   requirement: !ruby/object:Gem::Requirement
@@ -422,10 +422,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.7
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.7/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.9
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.9/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.7
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.9
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev

metadata.gz.sig

@@ -1 +1 @@
-Z5
-w�5��:��7�睹��%ڔ�����0cfe�Y1��w�4��Po+̆�K�,������aM΅n
�T�K�V�*E\�͕�u�M�C��v�0q�D��{@8��|�����@�W�4�0��qg�G�L��'y��k�a��B��i?���ND�&�n�	�lw��M�E�B���ݓ<��#�r��2�������E y�6�����h���M��A(G8	Q��̊�1)=9�|8�Tyo&�3Fc�Y�щ�J�P�D]NA�1bS�
Eђ��gJ�n���
e5�u�<���d�o uq�&:Ĭ)��]ve�������^����0��S��ۖ�K�J��GZ3��5��}�toe$l��яpb�	������Dz
+"�
��5s_�
4+���ٻ\�ڋlb=��*��%�.$/��>���Z���=Q�R%���J�+Z���2����3��YX