kettle-dev 3.0.33 → 3.0.34

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b611b573a644bc27585a4f82cf71f8d66753af9b5f6035292e051ed67f684d3
-  data.tar.gz: 15f5ffe131324656a00be51f91a8d68aacca31152f2051a0b0338ee9dc6e0742
+  metadata.gz: cf4388ae02268bbe6676ece5cee25b5548277a6e60432554c460f189ca02d2f0
+  data.tar.gz: 80841fd013dbd2868b22e36b185c18c0a7f90ed3698f5cb3a2d666c46a80b41b
 SHA512:
-  metadata.gz: '088b91253bd99bc0b7b02a526f65b2ad117cd3d5a4f15c0d50f19c42bd5829b9b0c5b2ee9db7957f1cfa9f6662d213f02f5b3f8771f150b4e7816d6bbf6c210e'
-  data.tar.gz: 394dd243472f9d6ad45489eeb00af4084069103ea5280f567bc5f1772d9f4ddf71e233c997907ad22d0c39aad95b4de8bbdbdb5c007f4e67ad1349856155c05e
+  metadata.gz: 713c1d308268ce8cde18124db06ad5efed08d53fc945af0c723843de08d840b6db23f946941de187b2adcf61e482e206e307fda8bbd52b562c3aaed1fd61ee91
+  data.tar.gz: 8e94e9a97e3ae52b955fd098db642ab23639fb6e0d67b2abed14fe8684248430c50618b8f8d6f3d0a57bb1934954e1f41fe7b17711fac151bdca9928b98a0795

data/CHANGELOG.md

@@ -30,6 +30,19 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.34] - 2026-09-09
+
+- TAG: [v3.0.34][3.0.34t]
+- COVERAGE: 91.95% -- 6101/6635 lines in 47 files
+- BRANCH COVERAGE: 76.43% -- 2332/3051 branches in 47 files
+- 50.23% documented
+
+### Fixed
+
+- Detect and reset release lockfiles whose BUNDLED WITH version lacks a matching Bundler checksum.
+
+- Declare the intentional version_gem runtime-heads dependency overlap for templating self-tests.
+
 ## [3.0.33] - 2026-09-07
 
 - TAG: [v3.0.33][3.0.33t]
@@ -3834,7 +3847,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.33...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.34...HEAD
+[3.0.34]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.33...v3.0.34
+[3.0.34t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.34
 [3.0.33]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.32...v3.0.33
 [3.0.33t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.33
 [3.0.32]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.31...v3.0.32

data/README.md

@@ -1066,7 +1066,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.613-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.635-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -194,6 +194,29 @@ module Kettle
           env["GEM_HOME"] = isolated_gem_home
           env["GEM_PATH"] = isolated_gem_path || isolated_gem_home
         end
+        command_prefix = bundler_command_prefix(env)
+        command = +"#{command_prefix} bundle lock"
+        # Bundler accepts each platform option once followed by a list. Repeating
+        # either option silently keeps only the final occurrence with Bundler 4.
+        command << " --remove-platform #{removed_platforms.sort.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless removed_platforms.empty?
+        command << " --add-platform #{platforms.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless platforms.empty?
+        command << " --update"
+        command << " #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
+        command << " --add-checksums" unless update_bundler
+        return command unless update_bundler
+
+        # `bundle lock --bundler` accepts a requirement and retains a locked
+        # prerelease that satisfies it. `bundle update --bundler=VERSION`
+        # records the exact Bundler that is executing the reset instead.
+        # Finish with `bundle lock --add-checksums`, since `bundle update`
+        # does not support that option.
+        bundler_version = Shellwords.escape(Bundler::VERSION)
+        command << " && #{command_prefix} bundle update --bundler=#{bundler_version}"
+        command << " && #{command_prefix} bundle lock --add-checksums"
+        command
+      end
+
+      def bundler_command_prefix(env)
         command = +"env"
         UNBUNDLED_ENV_KEYS.each do |key|
           command << " -u #{key}"
@@ -201,19 +224,6 @@ module Kettle
         env.each do |key, value|
           command << " #{key}=#{Shellwords.escape(value)}"
         end
-        command << " bundle lock"
-        # Bundler accepts each platform option once followed by a list. Repeating
-        # either option silently keeps only the final occurrence with Bundler 4.
-        command << " --remove-platform #{removed_platforms.sort.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless removed_platforms.empty?
-        command << " --add-platform #{platforms.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless platforms.empty?
-        command << " --update"
-        command << " #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
-        # Bundler preserves BUNDLED WITH during a normal lockfile update.
-        # Release lockfiles must record the Bundler that performed the final
-        # reset, or the next release command can dirty them after the prep
-        # commit by reconciling to a newer installed Bundler.
-        command << " --bundler" if update_bundler
-        command << " --add-checksums"
         command
       end
 
@@ -254,7 +264,10 @@ module Kettle
       end
 
       def normalization_needed?(path)
-        has_local_path_remote?(path) || !empty_registry_checksums(path).empty? || !unreleased_workspace_registry_specs(path).empty?
+        has_local_path_remote?(path) ||
+          !empty_registry_checksums(path).empty? ||
+          !unreleased_workspace_registry_specs(path).empty? ||
+          bundled_with_checksum_mismatch?(path)
       end
 
       def diagnostics(path)
@@ -268,6 +281,9 @@ module Kettle
         unreleased_workspace_registry_specs(path).each do |name, version, line_number|
           diagnostics << "#{display_path(path)} locks local workspace gem #{name} #{version} as a registry gem, but that version is not resolvable from the configured gem source at line #{line_number}"
         end
+        if bundled_with_checksum_mismatch?(path)
+          diagnostics.push("#{display_path(path)} BUNDLED WITH #{bundled_with_version(path)} has no matching Bundler checksum")
+        end
         diagnostics
       end
 
@@ -459,6 +475,33 @@ module Kettle
         end
       end
 
+      # A release reset updates both `BUNDLED WITH` and CHECKSUMS. When a
+      # nested tool leaked its Bundler into a member lockfile, a later cleanup
+      # can otherwise replace only the checksum entry and leave an impossible
+      # lockfile behind. Only flag a mismatch when the lockfile already tracks
+      # Bundler in CHECKSUMS, preserving older lockfiles that lack that entry.
+      def bundled_with_checksum_mismatch?(path)
+        version = bundled_with_version(path)
+        return false if version.empty?
+
+        checksums = self.class.checksum_entries_from_source(File.read(path))
+        return false unless checksums&.keys&.any? { |name, _checksum_version| name == "bundler" }
+
+        !checksums.key?(["bundler", version])
+      end
+
+      def bundled_with_version(path)
+        lines = File.readlines(path)
+        marker = lines.index { |line| line.strip == "BUNDLED WITH" }
+        return "" unless marker
+
+        lines[marker.succ..-1].each do |line|
+          version = line.strip
+          return version unless version.empty?
+        end
+        ""
+      end
+
       def path_source_gems(path)
         lockfile_parser(path).specs.each_with_object(Set.new) do |spec, gems|
           source = spec.source

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.33"
+      VERSION = "3.0.34"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.33
+  version: 3.0.34
 platform: ruby
 authors:
 - Peter H. Boling
@@ -100,7 +100,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.11
+        version: 0.1.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -110,7 +110,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.11
+        version: 0.1.12
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.33
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.33/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.34
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.34/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.33
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.34
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev