kettle-dev 3.1.8 → 3.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 78a3ee1fd963f1a7cb5b8a4c0f0a7ad45b13245a6ad3359505f230298b29a6f6
-  data.tar.gz: 647c9da39ce601b3279cfe863cde3986006040cc26ae81ffe51f91164acb9b46
+  metadata.gz: 452c1019273fac5fa450b42b6bf0d24fee016a6641971eeb3c5bddcf08efaa64
+  data.tar.gz: 4919f5ac1cd4aeb579da6ae378109923cf7fe86c6568b77ab42101e2f8bd4087
 SHA512:
-  metadata.gz: 2f18613e1d4d7459c3537c710caa4b705eb940c55342d65d96657ebf992961464a1f79e2511505026af8d0726d1738fd6e9ebcd6cd9d306d77f9a90ae0f55228
-  data.tar.gz: 95d49245a2e0335c60a12ce97b20a46db0e921ec35c943641fc973c71391875d12f4d82164a222012e777b18a82c84fdfc2ad5a52aa825a67501ba7312efdba7
+  metadata.gz: 58be74c463a06ea48b7571ec6fffa36bcaca0da0eb5e1a7cab2b4d3765f7fe2a4be2932f1cf09bfc496c97a9fa32badcf36182eabcdf58e61f5eb8c7242c9d41
+  data.tar.gz: 6e679af06a75e16ff6321f348cae64f8fa8c6884408f4fca7f20c7d5d8b5498bd4cf6bac270c0dc04a84747f3e67dffe7562c89e15d91afc38d11dd7f59e82f6

data/CHANGELOG.md

@@ -30,6 +30,26 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.9] - 2026-10-09
+
+- TAG: [v3.1.9][3.1.9t]
+- COVERAGE: 91.79% -- 6291/6854 lines in 49 files
+- BRANCH COVERAGE: 75.97% -- 2397/3155 branches in 49 files
+- 51.77% documented
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 5 project files:
+  - dependencies (5)
+
+- [kc] kettle-jem/template: updated 3 project files:
+  - code and tests (2)
+  - other (1)
+
+### Fixed
+
+- [kc] bundler-pin-no-prerelease: Release step 1 (`update_bundler_and_commit!`) and `appraisal:update` pin the Bundler version when running `bundle update --bundler` instead of leaving it bare. A bare `--bundler` resolves to whatever RubyGems reports as bundler's "latest", which includes prereleases: bundler published `4.1.0.beta1` as latest, so a bare update installed the beta and rewrote `BUNDLED WITH` to it. That beta vendors its own copy of rubygems' URI constants, and loading it against rubygems' copy emits a wall of `already initialized constant Gem::URI::...` warnings on stderr, which broke any spec shelling out to an executable and asserting clean stderr — failing a later release at its coverage step. Pinning matches `LockfileReset#lockfile_command`, which already documents this hazard.
+
 ## [3.1.8] - 2026-10-07
 
 - TAG: [v3.1.8][3.1.8t]
@@ -4001,7 +4021,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.8...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.9...HEAD
+[3.1.9]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.8...v3.1.9
+[3.1.9t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.9
 [3.1.8]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.7...v3.1.8
 [3.1.8t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.8
 [3.1.7]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.6...v3.1.7

data/lib/kettle/dev/rakelib/appraisal.rake

@@ -6,6 +6,16 @@ begin
   require "kettle/dev/lockfile_reset"
 
   bundle = "bundle"
+  # The exact Bundler running this rake, so `bundle update --bundler=VERSION`
+  # records it instead of resolving to RubyGems' "latest" bundler, which can be
+  # a prerelease. Falls back to the bare flag only if no version is
+  # determinable, preserving prior behaviour rather than failing.
+  bundler_version = if defined?(Bundler) && Bundler::VERSION
+    Bundler::VERSION
+  elsif (bundler_spec = Gem.loaded_specs["bundler"])
+    bundler_spec.version.to_s
+  end
+  bundler_version_arg = bundler_version ? "--bundler=#{bundler_version}" : "--bundler"
   unbundled_env = Kettle::Dev::LockfileReset::UNBUNDLED_ENV_KEYS.each_with_object({}) do |key, env|
     env[key] = nil
   end
@@ -144,13 +154,20 @@ begin
             "--quiet"
           )
 
-          # 2) BUNDLE_GEMFILE=Appraisal.root.gemfile bundle update --bundler
+          # 2) BUNDLE_GEMFILE=Appraisal.root.gemfile bundle update --bundler=<version>
+          #
+          # Pinned to the executing Bundler. A bare `--bundler` resolves to
+          # whatever RubyGems reports as bundler's "latest", which includes
+          # prereleases, so it can install a beta and record it in BUNDLED WITH;
+          # that beta's vendored URI then collides with rubygems' copy and
+          # spams stderr. See ReleaseCLI#update_bundler_and_commit! and
+          # LockfileReset#lockfile_command for the same hazard.
           run_command.call(
             "appraisal:update failed: BUNDLE_GEMFILE=Appraisal.root.gemfile bundle update --bundler",
             appraisal_env,
             bundle,
             "update",
-            "--bundler"
+            bundler_version_arg
           )
 
           # 3) BUNDLE_GEMFILE=Appraisal.root.gemfile bundle install

data/lib/kettle/dev/release_cli.rb

@@ -1864,14 +1864,26 @@ module Kettle
       # Keep Bundler maintenance separate from the release metadata commit.
       # The project lockfiles are shared development state, so the update must
       # be real and committed rather than hidden behind a temporary lockfile.
+      #
+      # The version is pinned to the Bundler actually executing rather than left
+      # bare. `bundle update --bundler` resolves to whatever RubyGems reports as
+      # bundler's "latest", which includes prereleases: bundler published
+      # 4.1.0.beta1 as latest, so a bare update installed the beta and rewrote
+      # BUNDLED WITH to it. That beta vendors its own copy of rubygems' URI
+      # constants, and loading it against rubygems' copy emits a wall of
+      # "already initialized constant Gem::URI::..." warnings on stderr, which
+      # broke any spec shelling out to the executable and asserting clean stderr
+      # — failing a later release at its coverage step. Pinning matches
+      # LockfileReset#lockfile_command, which already documents this hazard.
       def update_bundler_and_commit!
-        run_cmd!(release_project_command("bundle update --bundler"))
+        bundler_version = Shellwords.escape(Bundler::VERSION)
+        run_cmd!(release_project_command("bundle update --bundler=#{bundler_version}"))
 
         appraisal_gemfile = File.join(@root, "Appraisal.root.gemfile")
         if File.file?(appraisal_gemfile)
           appraisal_lockfile = File.join(@root, "Appraisal.root.gemfile.lock")
           appraisal_command = "BUNDLE_GEMFILE=#{Shellwords.escape(appraisal_gemfile)} " \
-            "BUNDLE_LOCKFILE=#{Shellwords.escape(appraisal_lockfile)} bundle update --bundler"
+            "BUNDLE_LOCKFILE=#{Shellwords.escape(appraisal_lockfile)} bundle update --bundler=#{bundler_version}"
           run_cmd!(release_project_command(appraisal_command))
           run_cmd!(release_project_command("bundle exec rake appraisal:reset"))
         end

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.8"
+      VERSION = "3.1.9"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.8
+  version: 3.1.9
 platform: ruby
 authors:
 - Peter H. Boling
@@ -276,7 +276,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.13
+        version: 3.2.14
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.13
+        version: 3.2.14
 - !ruby/object:Gem::Dependency
   name: stone_checksums
   requirement: !ruby/object:Gem::Requirement
@@ -422,10 +422,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.8
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.8/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.9
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.9/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.8
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.9
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev