kettle-family 1.2.7 → 1.2.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 19b26885149b9d09b09827174cd7da61443ce3be6eb87aebbf31c2d742d169f8
-  data.tar.gz: d3f3f4d99d7206c755dd8c96b92849056f85bf25b43e261322ee9d90c2ac6021
+  metadata.gz: 29d07c7927fc1e4369d1deaf88fe88855c533f1f2794f012a5452705df3c332c
+  data.tar.gz: 24eece688e92ec4253be48cf041d6e97ae3457f3668215dbc1edb82c13160eb0
 SHA512:
-  metadata.gz: 967f83669fc06f840e9aafdfbf3ee93257371e1e5b18097e6d2740247fad82f09c1f64930b1a7558456a41f2f3991172ec6a4cfb6d00c797929172ac72486ca3
-  data.tar.gz: 2e65f50bfd16933521b93dfd8b3d84ef3c3faa9cb7e40725c917e83f4e53d833bbc09f2f2b15708c4a93f9a384edb5f24b1bbdf4b05013f4c4d19879382b9ba4
+  metadata.gz: d47c545b53878e0fa85111529a912263f829293ec111d7d929936d84dde80b9e9504fe123674c3b903bd360ab73d889cc88dbc65a5fd4f9ff07bed50a1f00637
+  data.tar.gz: 7198da5864c986c0e5b8a94b07e67fa5153588fb179f87d073972baa5b51b97f6814d576cc20d1565acaf068a0310c695d3eec06c0264c706fb2802aae345a79

data/CHANGELOG.md

@@ -30,6 +30,22 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.8] - 2026-07-29
+
+- TAG: [v1.2.8][1.2.8t]
+- COVERAGE: 93.98% -- 3652/3886 lines in 27 files
+- BRANCH COVERAGE: 76.43% -- 1394/1824 branches in 27 files
+- 28.01% documented
+
+### Fixed
+
+- `kettle-family bup` and `bupb` now disable family local-path envs even when
+  `release.env` already sets those keys to false, avoiding leaked monorepo roots
+  such as `STRUCTUREDMERGE_DEV=/path/to/family/root` during bundle updates.
+- Family local-path env injection now defaults to `members_root` when no
+  explicit `family.local_path_root` is configured, matching monorepo families
+  whose sibling gems live under a subdirectory such as `gems/`.
+
 ## [1.2.7] - 2026-07-29
 
 - TAG: [v1.2.7][1.2.7t]
@@ -1290,7 +1306,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.7...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.8...HEAD
+[1.2.8]: https://github.com/kettle-dev/kettle-family/compare/v1.2.7...v1.2.8
+[1.2.8t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.8
 [1.2.7]: https://github.com/kettle-dev/kettle-family/compare/v1.2.6...v1.2.7
 [1.2.7t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.7
 [1.2.6]: https://github.com/kettle-dev/kettle-family/compare/v1.2.5...v1.2.6

data/README.md

@@ -814,7 +814,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.884-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.886-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/config.rb

@@ -52,7 +52,7 @@ module Kettle
 
       def family_local_path_root
         configured = fetch_path("family", "local_path_root")
-        configured ? expand_config_relative_path(configured) : root
+        configured ? expand_config_relative_path(configured) : members_root
       end
 
       def family_local_path_env

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.7"
+      VERSION = "1.2.8"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -1954,7 +1954,7 @@ module Kettle
 
       def release_lockfile_local_path_env_overrides(member = nil)
         explicit = config.release_disable_local_path_env.to_h { |key| [key.to_s, "false"] }
-        derived = release_local_path_env_sources.each_with_object({}) do |(key, value), memo|
+        derived = release_local_path_env_detection_sources.each_with_object({}) do |(key, value), memo|
           key = key.to_s
           next unless key.end_with?("_LOCAL", "_DEV")
           next unless local_path_env_value?(value)
@@ -2023,6 +2023,12 @@ module Kettle
           .merge(env_overrides)
       end
 
+      def release_local_path_env_detection_sources
+        ENV.to_h
+          .merge(config.family_local_path_env)
+          .merge(env_overrides)
+      end
+
       def local_path_env_value?(value)
         text = value.to_s.strip
         return false if text.empty? || text.casecmp("false").zero?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.7
+  version: 1.2.8
 platform: ruby
 authors:
 - Peter H. Boling
@@ -341,10 +341,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.7
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.7/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.8
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.8/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.7
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.8
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family