kettle-family 1.2.6 → 1.2.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87022fba999d5343044afcf1c679be7b53f49648ce71ff7aebfe29044ee6064a
-  data.tar.gz: 775df5e0ce6843e9013fbe7a4cc17ea2608322aae8139f9116f51a456051a5b8
+  metadata.gz: 29d07c7927fc1e4369d1deaf88fe88855c533f1f2794f012a5452705df3c332c
+  data.tar.gz: 24eece688e92ec4253be48cf041d6e97ae3457f3668215dbc1edb82c13160eb0
 SHA512:
-  metadata.gz: 258275ea92c47f043220780188c6967427e700bf66f7e8675700ac39d4ffb4a7da775a809a587babfa839f32778bc81e4b525f2f33f839648cf11be1be1b239c
-  data.tar.gz: ec9fd4d7a541edd9f82b4bb9e57510563f264b5893734814c27a6eae24f3af4ca05fbd80baa1986de388ab6a4b83daa4bbfafae3117bf748693fe50a2261a2d3
+  metadata.gz: d47c545b53878e0fa85111529a912263f829293ec111d7d929936d84dde80b9e9504fe123674c3b903bd360ab73d889cc88dbc65a5fd4f9ff07bed50a1f00637
+  data.tar.gz: 7198da5864c986c0e5b8a94b07e67fa5153588fb179f87d073972baa5b51b97f6814d576cc20d1565acaf068a0310c695d3eec06c0264c706fb2802aae345a79

data/CHANGELOG.md

@@ -30,6 +30,36 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.8] - 2026-07-29
+
+- TAG: [v1.2.8][1.2.8t]
+- COVERAGE: 93.98% -- 3652/3886 lines in 27 files
+- BRANCH COVERAGE: 76.43% -- 1394/1824 branches in 27 files
+- 28.01% documented
+
+### Fixed
+
+- `kettle-family bup` and `bupb` now disable family local-path envs even when
+  `release.env` already sets those keys to false, avoiding leaked monorepo roots
+  such as `STRUCTUREDMERGE_DEV=/path/to/family/root` during bundle updates.
+- Family local-path env injection now defaults to `members_root` when no
+  explicit `family.local_path_root` is configured, matching monorepo families
+  whose sibling gems live under a subdirectory such as `gems/`.
+
+## [1.2.7] - 2026-07-29
+
+- TAG: [v1.2.7][1.2.7t]
+- COVERAGE: 93.98% -- 3650/3884 lines in 27 files
+- BRANCH COVERAGE: 76.43% -- 1394/1824 branches in 27 files
+- 28.01% documented
+
+### Fixed
+
+- `kettle-family bup`, `bupb`, and release lockfile handling now treat truthy
+  `*_DEV` and `*_LOCAL` environment values as local path dependency mode, so
+  family local path envs such as `STRUCTUREDMERGE_DEV=true` are disabled for
+  release-style bundle refreshes.
+
 ## [1.2.6] - 2026-07-29
 
 - TAG: [v1.2.6][1.2.6t]
@@ -1276,7 +1306,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.6...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.8...HEAD
+[1.2.8]: https://github.com/kettle-dev/kettle-family/compare/v1.2.7...v1.2.8
+[1.2.8t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.8
+[1.2.7]: https://github.com/kettle-dev/kettle-family/compare/v1.2.6...v1.2.7
+[1.2.7t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.7
 [1.2.6]: https://github.com/kettle-dev/kettle-family/compare/v1.2.5...v1.2.6
 [1.2.6t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.6
 [1.2.5]: https://github.com/kettle-dev/kettle-family/compare/v1.2.4...v1.2.5

data/README.md

@@ -814,7 +814,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.882-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.886-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/config.rb

@@ -52,7 +52,7 @@ module Kettle
 
       def family_local_path_root
         configured = fetch_path("family", "local_path_root")
-        configured ? expand_config_relative_path(configured) : root
+        configured ? expand_config_relative_path(configured) : members_root
       end
 
       def family_local_path_env

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.6"
+      VERSION = "1.2.8"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -1945,7 +1945,8 @@ module Kettle
       def release_allowed_local_path_roots
         release_local_path_env_sources.filter_map do |key, value|
           next unless key.end_with?("_LOCAL", "_DEV")
-          next if value.to_s.empty? || value.to_s.casecmp("false").zero?
+          next unless local_path_env_value?(value)
+          next unless value.to_s.strip.start_with?("/", "./", "../", "~")
 
           value
         end
@@ -1953,7 +1954,7 @@ module Kettle
 
       def release_lockfile_local_path_env_overrides(member = nil)
         explicit = config.release_disable_local_path_env.to_h { |key| [key.to_s, "false"] }
-        derived = release_local_path_env_sources.each_with_object({}) do |(key, value), memo|
+        derived = release_local_path_env_detection_sources.each_with_object({}) do |(key, value), memo|
           key = key.to_s
           next unless key.end_with?("_LOCAL", "_DEV")
           next unless local_path_env_value?(value)
@@ -2022,9 +2023,16 @@ module Kettle
           .merge(env_overrides)
       end
 
+      def release_local_path_env_detection_sources
+        ENV.to_h
+          .merge(config.family_local_path_env)
+          .merge(env_overrides)
+      end
+
       def local_path_env_value?(value)
         text = value.to_s.strip
         return false if text.empty? || text.casecmp("false").zero?
+        return true if %w[true yes 1 on enabled].include?(text.downcase)
         return true if text.start_with?("/", "./", "../", "~")
 
         text.include?(File::SEPARATOR)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.6
+  version: 1.2.8
 platform: ruby
 authors:
 - Peter H. Boling
@@ -341,10 +341,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.6
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.6/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.8
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.8/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.6
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.8
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family