kettle-dev 3.0.7 → 3.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3fdb8abe3a10685ec3e0fc37d17a0c0b5f85ed834ba85c8863e34e0bd64e5f9
-  data.tar.gz: 6261b1b044c0c301c219f5c2c9a0d2e6260b5b231784d49e75fc9e3ae12f536a
+  metadata.gz: 7124072093bb694c91e9f06b63821090cb992e1a8747f3f83e212a6b927dc25c
+  data.tar.gz: 861518ad52298f44bc8f76b9d6f4dbb5e9c11c80c4d97bf2c087d6e0ea20d90c
 SHA512:
-  metadata.gz: 2a33c7c722b54f372053469108187e4aab0fb0135633870fc78f33364d85e37c7ef41bf3db95e5a0d571881f8aba735262ff11327a57ba62964dbe66c5007808
-  data.tar.gz: 05f5b29d1459e646224fad07bfe1ac0c0987e594a68c829014311ac4ef02ebc52fbdf922e7c23f14f56ca92feedd87a2bce055fb5e809ff1cf10a49fd32e7eac
+  metadata.gz: 0f823bf26a24fcfcd3b52179dd960f9226c985a9cfc2d6962364dac67d329e6aa21e876f1bcf97a43e2e66158707d11325a56bb1d41d1327fdf4ecac977c4bce
+  data.tar.gz: 356bc62c3d680808bd5f89a73427dbfaac36157b29dabbe59bc584b37bc8a2aeaa0d62fd2d9198a32f1e0f8b3dc068b722e00214ae9b26a6e053bc60305c295b

checksums.yaml.gz.sig

@@ -1,2 +1,2 @@
-����;"x�X\0�ť��.���$��$Ϲ���/�TX�3��G]D0<�k�^5��QFvr� �"�R-|���ڴ�\�q�g1_e�)�d�b��8 #
-+-<#�D#��?:^K�u6y����<E�\�/����+�	�k�y��Ou�:�}���{`.�y���Kt��J�wpbk�r,դ�.1�^$�ʬk���e���p��k&�s/z�~�'>6*j��7�	���)���}��T��R�d)�y�/Ij������JV�P���U�����~r�����
.b!�|F�����'q�QӠ��س|q��ȗy��Ԇƨ����_�X��An���w��}&�8_������h�e�F��)W(� ��},dΫnuX���X
��
+('�ƿk@�;#tl:�����@������d��o�2ߒ����1���|�\����H��#?�#�%U�їT����l�p�h/��S��Pr3��CS>=��S+���c<�
+E��!��@[�eg��}'#�_�?�y{�>�

data/CHANGELOG.md

@@ -30,6 +30,17 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.8] - 2026-08-23
+
+- TAG: [v3.0.8][3.0.8t]
+- COVERAGE: 91.36% -- 5679/6216 lines in 47 files
+- BRANCH COVERAGE: 76.24% -- 2169/2845 branches in 47 files
+- 50.62% documented
+
+### Fixed
+
+- Release lockfile normalization now resolves in isolated gem paths, preventing unreleased locally installed versions from entering release lockfiles.
+
 ## [3.0.7] - 2026-08-15
 
 - TAG: [v3.0.7][3.0.7t]
@@ -3494,7 +3505,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.7...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.8...HEAD
+[3.0.8]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.7...v3.0.8
+[3.0.8t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.8
 [3.0.7]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.6...v3.0.7
 [3.0.7t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.7
 [3.0.6]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.5...v3.0.6

data/README.md

@@ -993,7 +993,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.207-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.216-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -4,6 +4,7 @@ require "set"
 require "shellwords"
 require "fileutils"
 require "open3"
+require "tmpdir"
 require "bundler"
 
 require_relative "bundler_env_guard"
@@ -60,15 +61,23 @@ module Kettle
           return
         end
 
-        command = reset_command(path: path, gemfile: gemfile, full_update: full_update, platforms: platforms)
-        if full_update || has_local_path_remote?(path)
-          rebuild_lockfile(path) { command_runner.call(command) }
-        else
-          command_runner.call(command)
+        with_isolated_gem_paths do |gem_home|
+          command = reset_command(
+            path: path,
+            gemfile: gemfile,
+            full_update: full_update,
+            platforms: platforms,
+            isolated_gem_home: gem_home
+          )
+          if full_update || has_local_path_remote?(path)
+            rebuild_lockfile(path) { command_runner.call(command) }
+          else
+            command_runner.call(command)
+          end
         end
       end
 
-      def reset_command(path:, gemfile:, full_update: false, platforms: nil)
+      def reset_command(path:, gemfile:, full_update: false, platforms: nil, isolated_gem_home: nil)
         update_gems = (full_update || has_local_path_remote?(path)) ? [] : reset_update_gems(path)
         platforms ||= reset_platforms(path)
         removed_platforms = full_update ? [] : lockfile_platforms(path) - platforms
@@ -76,6 +85,10 @@ module Kettle
           "BUNDLE_GEMFILE" => gemfile,
           "BUNDLE_LOCKFILE" => path
         )
+        if isolated_gem_home
+          env["GEM_HOME"] = isolated_gem_home
+          env["GEM_PATH"] = isolated_gem_home
+        end
         command = +"env"
         UNBUNDLED_ENV_KEYS.each do |key|
           command << " -u #{key}"
@@ -319,6 +332,12 @@ module Kettle
 
       attr_reader :root, :command_runner
 
+      def with_isolated_gem_paths
+        base = File.join(root, "tmp", "kettle-reset")
+        FileUtils.mkdir_p(base)
+        Dir.mktmpdir("gem-home-", base) { |gem_home| yield(gem_home) }
+      end
+
       def lockfile_parser(path)
         # Bundler validates checksum digest syntax while parsing, but this class
         # only needs Bundler's source model here. Keep checksum diagnostics in

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.7"
+      VERSION = "3.0.8"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.7
+  version: 3.0.8
 platform: ruby
 authors:
 - Peter H. Boling
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.7
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.7/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.8
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.8/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.7
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.8
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev