rubygems-update 3.3.26 → 3.4.1

data/bundler/lib/bundler/definition.rb

@@ -16,7 +16,6 @@ module Bundler
       :locked_deps,
       :locked_gems,
       :platforms,
-      :requires,
       :ruby_version,
       :lockfile,
       :gemfiles
@@ -146,11 +145,11 @@ module Bundler
       @dependency_changes = converge_dependencies
       @local_changes = converge_locals
 
-      @requires = compute_requires
+      @incomplete_lockfile = check_missing_lockfile_specs
     end
 
     def gem_version_promoter
-      @gem_version_promoter ||= GemVersionPromoter.new(@originally_locked_specs, @unlock[:gems])
+      @gem_version_promoter ||= GemVersionPromoter.new
     end
 
     def resolve_only_locally!
@@ -264,10 +263,10 @@ module Bundler
         @locked_specs
       elsif !unlocking? && nothing_changed?
         if deleted_deps.any?
-          Bundler.ui.debug("Some dependencies were deleted, using a subset of the resolution from the lockfile")
+          Bundler.ui.debug "Some dependencies were deleted, using a subset of the resolution from the lockfile"
           SpecSet.new(filter_specs(@locked_specs, @dependencies - deleted_deps))
         else
-          Bundler.ui.debug("Found no changes, using resolution from the lockfile")
+          Bundler.ui.debug "Found no changes, using resolution from the lockfile"
           if @locked_gems.may_include_redundant_platform_specific_gems?
             SpecSet.new(filter_specs(@locked_specs, @dependencies))
           else
@@ -275,8 +274,8 @@ module Bundler
           end
         end
       else
-        Bundler.ui.debug("Found changes from the lockfile, re-resolving dependencies because #{change_reason}")
-        resolver.start(expanded_dependencies)
+        Bundler.ui.debug "Found changes from the lockfile, re-resolving dependencies because #{change_reason}"
+        start_resolution
       end
     end
 
@@ -295,11 +294,11 @@ module Bundler
 
       # Convert to \r\n if the existing lock has them
       # i.e., Windows with `git config core.autocrlf=true`
-      contents.gsub!(/\n/, "\r\n") if @lockfile_contents.match("\r\n")
+      contents.gsub!(/\n/, "\r\n") if @lockfile_contents.match?("\r\n")
 
       if @locked_bundler_version
         locked_major = @locked_bundler_version.segments.first
-        current_major = Gem::Version.create(Bundler::VERSION).segments.first
+        current_major = Bundler.gem_version.segments.first
 
         updating_major = locked_major < current_major
       end
@@ -461,7 +460,7 @@ module Bundler
     private :sources
 
     def nothing_changed?
-      !@source_changes && !@dependency_changes && !@new_platform && !@path_changes && !@local_changes
+      !@source_changes && !@dependency_changes && !@new_platform && !@path_changes && !@local_changes && !@incomplete_lockfile
     end
 
     def unlocking?
@@ -474,7 +473,7 @@ module Bundler
       @resolver ||= begin
         last_resolve = converge_locked_specs
         remove_ruby_from_platforms_if_necessary!(current_dependencies)
-        Resolver.new(source_requirements, last_resolve, gem_version_promoter, additional_base_requirements_for_resolve(last_resolve), platforms)
+        Resolver.new(source_requirements, last_resolve, gem_version_promoter, additional_base_requirements_for_resolve(last_resolve))
       end
     end
 
@@ -482,6 +481,23 @@ module Bundler
       @expanded_dependencies ||= dependencies + metadata_dependencies
     end
 
+    def resolution_packages
+      @resolution_packages ||= begin
+        packages = Hash.new do |h, k|
+          h[k] = Resolver::Package.new(k, @platforms, @originally_locked_specs, @unlock[:gems])
+        end
+
+        expanded_dependencies.each do |dep|
+          name = dep.name
+          platforms = dep.gem_platforms(@platforms)
+
+          packages[name] = Resolver::Package.new(name, platforms, @originally_locked_specs, @unlock[:gems], :dependency => dep)
+        end
+
+        packages
+      end
+    end
+
     def filter_specs(specs, deps)
       SpecSet.new(specs).for(deps, false, platforms)
     end
@@ -507,21 +523,36 @@ module Bundler
         raise GemNotFound, "Could not find #{missing_specs_list.join(" nor ")}"
       end
 
+      incomplete_specs = specs.incomplete_specs
       loop do
-        incomplete_specs = specs.incomplete_specs
         break if incomplete_specs.empty?
 
         Bundler.ui.debug("The lockfile does not have all gems needed for the current platform though, Bundler will still re-resolve dependencies")
-        @resolve = resolver.start(expanded_dependencies, :exclude_specs => incomplete_specs)
+        @resolve = start_resolution(:exclude_specs => incomplete_specs)
         specs = resolve.materialize(dependencies)
+
+        still_incomplete_specs = specs.incomplete_specs
+
+        if still_incomplete_specs == incomplete_specs
+          package = resolution_packages[incomplete_specs.first.name]
+          resolver.raise_not_found! package
+        end
+
+        incomplete_specs = still_incomplete_specs
       end
 
-      bundler = sources.metadata_source.specs.search(Gem::Dependency.new("bundler", VERSION)).last
+      bundler = sources.metadata_source.specs.search(["bundler", Bundler.gem_version]).last
       specs["bundler"] = bundler
 
       specs
     end
 
+    def start_resolution(exclude_specs: [])
+      result = resolver.start(expanded_dependencies, resolution_packages, :exclude_specs => exclude_specs)
+
+      SpecSet.new(SpecSet.new(result).for(dependencies, false, @platforms))
+    end
+
     def precompute_source_requirements_for_indirect_dependencies?
       @remote && sources.non_global_rubygems_sources.all?(&:dependency_api_available?) && !sources.aggregate_global_source?
     end
@@ -574,6 +605,7 @@ module Bundler
         [@new_platform, "you added a new platform to your gemfile"],
         [@path_changes, "the gemspecs for path gems changed"],
         [@local_changes, "the gemspecs for git local gems changed"],
+        [@incomplete_lockfile, "your lock file is missing some gems"],
       ].select(&:first).map(&:last).join(", ")
     end
 
@@ -628,6 +660,14 @@ module Bundler
       !sources_with_changes.each {|source| @unlock[:sources] << source.name }.empty?
     end
 
+    def check_missing_lockfile_specs
+      all_locked_specs = @locked_specs.map(&:name) << "bundler"
+
+      @locked_specs.any? do |s|
+        s.dependencies.any? {|dep| !all_locked_specs.include?(dep.name) }
+      end
+    end
+
     def converge_paths
       sources.path_sources.any? do |source|
         specs_changed?(source)
@@ -766,12 +806,13 @@ module Bundler
           end
 
           new_spec = new_specs[s].first
-
-          # If the spec is no longer in the path source, unlock it. This
-          # commonly happens if the version changed in the gemspec
-          next unless new_spec
-
-          s.dependencies.replace(new_spec.dependencies)
+          if new_spec
+            s.dependencies.replace(new_spec.dependencies)
+          else
+            # If the spec is no longer in the path source, unlock it. This
+            # commonly happens if the version changed in the gemspec
+            @unlock[:gems] << s.name
+          end
         end
 
         if dep.nil? && requested_dependencies.find {|d| s.name == d.name }
@@ -839,17 +880,6 @@ module Bundler
       current == proposed
     end
 
-    def compute_requires
-      dependencies.reduce({}) do |requires, dep|
-        next requires unless dep.should_include?
-        requires[dep.name] = Array(dep.autorequire || dep.name).map do |file|
-          # Allow `require: true` as an alias for `require: <name>`
-          file == true ? dep.name : file
-        end
-        requires
-      end
-    end
-
     def additional_base_requirements_for_resolve(last_resolve)
       return [] unless @locked_gems && unlocking? && !sources.expired_sources?(@locked_gems.sources)
       converge_specs(@originally_locked_specs - last_resolve).map do |locked_spec|

data/bundler/lib/bundler/dependency.rb

@@ -7,20 +7,20 @@ require_relative "rubygems_ext"
 module Bundler
   class Dependency < Gem::Dependency
     attr_reader :autorequire
-    attr_reader :groups, :platforms, :gemfile, :path, :git, :github, :branch, :ref, :force_ruby_platform
+    attr_reader :groups, :platforms, :gemfile, :path, :git, :github, :branch, :ref
 
     ALL_RUBY_VERSIONS = ((18..27).to_a + (30..31).to_a).freeze
     PLATFORM_MAP = {
-      :ruby        => [Gem::Platform::RUBY, ALL_RUBY_VERSIONS],
-      :mri         => [Gem::Platform::RUBY, ALL_RUBY_VERSIONS],
-      :rbx         => [Gem::Platform::RUBY],
+      :ruby => [Gem::Platform::RUBY, ALL_RUBY_VERSIONS],
+      :mri => [Gem::Platform::RUBY, ALL_RUBY_VERSIONS],
+      :rbx => [Gem::Platform::RUBY],
       :truffleruby => [Gem::Platform::RUBY],
-      :jruby       => [Gem::Platform::JAVA, [18, 19]],
-      :windows     => [Gem::Platform::WINDOWS, ALL_RUBY_VERSIONS],
-      :mswin       => [Gem::Platform::MSWIN,     ALL_RUBY_VERSIONS],
-      :mswin64     => [Gem::Platform::MSWIN64,   ALL_RUBY_VERSIONS - [18]],
-      :mingw       => [Gem::Platform::MINGW,     ALL_RUBY_VERSIONS],
-      :x64_mingw   => [Gem::Platform::X64_MINGW, ALL_RUBY_VERSIONS - [18, 19]],
+      :jruby => [Gem::Platform::JAVA, [18, 19]],
+      :windows => [Gem::Platform::WINDOWS, ALL_RUBY_VERSIONS],
+      :mswin => [Gem::Platform::MSWIN,     ALL_RUBY_VERSIONS],
+      :mswin64 => [Gem::Platform::MSWIN64, ALL_RUBY_VERSIONS - [18]],
+      :mingw => [Gem::Platform::MINGW, ALL_RUBY_VERSIONS],
+      :x64_mingw => [Gem::Platform::X64_MINGW, ALL_RUBY_VERSIONS - [18, 19]],
     }.each_with_object({}) do |(platform, spec), hash|
       hash[platform] = spec[0]
       spec[1]&.each {|version| hash[:"#{platform}_#{version}"] = spec[0] }
@@ -42,7 +42,7 @@ module Bundler
       @env            = options["env"]
       @should_include = options.fetch("should_include", true)
       @gemfile        = options["gemfile"]
-      @force_ruby_platform = options["force_ruby_platform"]
+      @force_ruby_platform = options["force_ruby_platform"] if options.key?("force_ruby_platform")
 
       @autorequire = Array(options["require"] || []) if options.key?("require")
     end
@@ -50,6 +50,7 @@ module Bundler
     # Returns the platforms this dependency is valid for, in the same order as
     # passed in the `valid_platforms` parameter
     def gem_platforms(valid_platforms)
+      return [Gem::Platform::RUBY] if force_ruby_platform
       return valid_platforms if @platforms.empty?
 
       valid_platforms.select {|p| expanded_platforms.include?(GemHelpers.generic(p)) }

data/bundler/lib/bundler/digest.rb

@@ -43,7 +43,7 @@ module Bundler
               f = (b ^ c ^ d)
               k = 0xCA62C1D6
             end
-            t = SHA1_MASK & (SHA1_MASK & rotate(a, 5) + f + e + k + w[i])
+            t = SHA1_MASK & rotate(a, 5) + f + e + k + w[i]
             a, b, c, d, e = t, a, SHA1_MASK & rotate(b, 30), c, d # rubocop:disable Style/ParallelAssignment
           end
           mutated = [a, b, c, d, e]

data/bundler/lib/bundler/dsl.rb

@@ -324,7 +324,7 @@ module Bundler
       if name.is_a?(Symbol)
         raise GemfileError, %(You need to specify gem names as Strings. Use 'gem "#{name}"' instead)
       end
-      if name =~ /\s/
+      if /\s/.match?(name)
         raise GemfileError, %('#{name}' is not a valid gem name because it contains whitespace)
       end
       raise GemfileError, %(an empty gem name is not valid) if name.empty?

data/bundler/lib/bundler/env.rb

@@ -75,7 +75,7 @@ module Bundler
     end
 
     def self.git_version
-      Bundler::Source::Git::GitProxy.new(nil, nil, nil).full_version
+      Bundler::Source::Git::GitProxy.new(nil, nil).full_version
     rescue Bundler::Source::Git::GitNotInstalledError
       "not installed"
     end

data/bundler/lib/bundler/environment_preserver.rb

@@ -7,6 +7,7 @@ module Bundler
       BUNDLE_BIN_PATH
       BUNDLE_GEMFILE
       BUNDLER_VERSION
+      BUNDLER_SETUP
       GEM_HOME
       GEM_PATH
       MANPATH

data/bundler/lib/bundler/errors.rb

@@ -21,16 +21,7 @@ module Bundler
   class InstallError < BundlerError; status_code(5); end
 
   # Internal error, should be rescued
-  class VersionConflict < BundlerError
-    attr_reader :conflicts
-
-    def initialize(conflicts, msg = nil)
-      super(msg)
-      @conflicts = conflicts
-    end
-
-    status_code(6)
-  end
+  class SolveFailure < BundlerError; status_code(6); end
 
   class GemNotFound < BundlerError; status_code(7); end
   class InstallHookError < BundlerError; status_code(8); end
@@ -55,7 +46,6 @@ module Bundler
   class CyclicDependencyError < BundlerError; status_code(21); end
   class GemfileLockNotFound < BundlerError; status_code(22); end
   class PluginError < BundlerError; status_code(29); end
-  class SudoNotPermittedError < BundlerError; status_code(30); end
   class ThreadCreationError < BundlerError; status_code(33); end
   class APIResponseMismatchError < BundlerError; status_code(34); end
   class APIResponseInvalidDependenciesError < BundlerError; status_code(35); end

data/bundler/lib/bundler/fetcher/compact_index.rb

@@ -12,17 +12,15 @@ module Bundler
         method = instance_method(method_name)
         undef_method(method_name)
         define_method(method_name) do |*args, &blk|
-          begin
-            method.bind(self).call(*args, &blk)
-          rescue NetworkDownError, CompactIndexClient::Updater::MisMatchedChecksumError => e
-            raise HTTPError, e.message
-          rescue AuthenticationRequiredError
-            # Fail since we got a 401 from the server.
-            raise
-          rescue HTTPError => e
-            Bundler.ui.trace(e)
-            nil
-          end
+          method.bind(self).call(*args, &blk)
+        rescue NetworkDownError, CompactIndexClient::Updater::MisMatchedChecksumError => e
+          raise HTTPError, e.message
+        rescue AuthenticationRequiredError
+          # Fail since we got a 401 from the server.
+          raise
+        rescue HTTPError => e
+          Bundler.ui.trace(e)
+          nil
         end
       end
 

data/bundler/lib/bundler/fetcher/dependency.rb

@@ -55,7 +55,7 @@ module Bundler
         gem_list = []
         gem_names.each_slice(Source::Rubygems::API_REQUEST_SIZE) do |names|
           marshalled_deps = downloader.fetch(dependency_api_uri(names)).body
-          gem_list.concat(Bundler.load_marshal(marshalled_deps))
+          gem_list.concat(Bundler.safe_load_marshal(marshalled_deps))
         end
         gem_list
       end

data/bundler/lib/bundler/fetcher/downloader.rb

@@ -61,14 +61,11 @@ module Bundler
           req.basic_auth(user, password)
         end
         connection.request(uri, req)
-      rescue NoMethodError => e
-        raise unless ["undefined method", "use_ssl="].all? {|snippet| e.message.include? snippet }
-        raise LoadError.new("cannot load such file -- openssl")
       rescue OpenSSL::SSL::SSLError
         raise CertificateFailureError.new(uri)
       rescue *HTTP_ERRORS => e
         Bundler.ui.trace e
-        if e.is_a?(SocketError) || e.message =~ /host down:/
+        if e.is_a?(SocketError) || e.message.to_s.include?("host down:")
           raise NetworkDownError, "Could not reach host #{uri.host}. Check your network " \
             "connection and try again."
         else
@@ -80,7 +77,7 @@ module Bundler
       private
 
       def validate_uri_scheme!(uri)
-        return if uri.scheme =~ /\Ahttps?\z/
+        return if /\Ahttps?\z/.match?(uri.scheme)
         raise InvalidOption,
           "The request uri `#{uri}` has an invalid scheme (`#{uri.scheme}`). " \
           "Did you mean `http` or `https`?"

data/bundler/lib/bundler/fetcher.rb

@@ -29,9 +29,7 @@ module Bundler
           " is a chance you are experiencing a man-in-the-middle attack, but" \
           " most likely your system doesn't have the CA certificates needed" \
           " for verification. For information about OpenSSL certificates, see" \
-          " https://railsapps.github.io/openssl-certificate-verify-failed.html." \
-          " To connect without using SSL, edit your Gemfile" \
-          " sources and change 'https' to 'http'."
+          " https://railsapps.github.io/openssl-certificate-verify-failed.html."
       end
     end
 
@@ -39,9 +37,7 @@ module Bundler
     class SSLError < HTTPError
       def initialize(msg = nil)
         super msg || "Could not load OpenSSL.\n" \
-            "You must recompile Ruby with OpenSSL support or change the sources in your " \
-            "Gemfile from 'https' to 'http'. Instructions for compiling with OpenSSL " \
-            "using RVM are available at rvm.io/packages/openssl."
+            "You must recompile Ruby with OpenSSL support."
       end
     end
 

data/bundler/lib/bundler/force_platform.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Bundler
+  module ForcePlatform
+    private
+
+    # The `:force_ruby_platform` value used by dependencies for resolution, and
+    # by locked specifications for materialization is `false` by default, except
+    # for TruffleRuby. TruffleRuby generally needs to force the RUBY platform
+    # variant unless the name is explicitly allowlisted.
+
+    def default_force_ruby_platform
+      return false unless RUBY_ENGINE == "truffleruby"
+
+      !Gem::Platform::REUSE_AS_BINARY_ON_TRUFFLERUBY.include?(name)
+    end
+  end
+end

data/bundler/lib/bundler/friendly_errors.rb

@@ -36,9 +36,6 @@ module Bundler
         end
       when Thor::Error
         Bundler.ui.error error.message
-      when LoadError
-        raise error unless error.message =~ /cannot load such file -- openssl|openssl.so|libcrypto.so/
-        Bundler.ui.error "\nCould not load OpenSSL. #{error.class}: #{error}\n#{error.backtrace.join("\n  ")}"
       when Interrupt
         Bundler.ui.error "\nQuitting..."
         Bundler.ui.trace error

data/bundler/lib/bundler/gem_version_promoter.rb

@@ -7,14 +7,13 @@ module Bundler
   # available dependency versions as found in its index, before returning it to
   # to the resolution engine to select the best version.
   class GemVersionPromoter
-    DEBUG = ENV["BUNDLER_DEBUG_RESOLVER"] || ENV["DEBUG_RESOLVER"]
-
-    attr_reader :level, :locked_specs, :unlock_gems
+    attr_reader :level
+    attr_accessor :pre
 
     # By default, strict is false, meaning every available version of a gem
     # is returned from sort_versions. The order gives preference to the
     # requested level (:patch, :minor, :major) but in complicated requirement
-    # cases some gems will by necessity by promoted past the requested level,
+    # cases some gems will by necessity be promoted past the requested level,
     # or even reverted to older versions.
     #
     # If strict is set to true, the results from sort_versions will be
@@ -24,24 +23,13 @@ module Bundler
     # existing in the referenced source.
     attr_accessor :strict
 
-    attr_accessor :prerelease_specified
-
-    # Given a list of locked_specs and a list of gems to unlock creates a
-    # GemVersionPromoter instance.
+    # Creates a GemVersionPromoter instance.
     #
-    # @param locked_specs [SpecSet] All current locked specs. Unlike Definition
-    #   where this list is empty if all gems are being updated, this should
-    #   always be populated for all gems so this class can properly function.
-    # @param unlock_gems [String] List of gem names being unlocked. If empty,
-    #   all gems will be considered unlocked.
     # @return [GemVersionPromoter]
-    def initialize(locked_specs = SpecSet.new([]), unlock_gems = [])
+    def initialize
       @level = :major
       @strict = false
-      @locked_specs = locked_specs
-      @unlock_gems = unlock_gems
-      @sort_versions = {}
-      @prerelease_specified = {}
+      @pre = false
     end
 
     # @param value [Symbol] One of three Symbols: :major, :minor or :patch.
@@ -55,34 +43,19 @@ module Bundler
       @level = v
     end
 
-    # Given a Dependency and an Array of Specifications of available versions for a
-    # gem, this method will return the Array of Specifications sorted (and possibly
-    # truncated if strict is true) in an order to give preference to the current
-    # level (:major, :minor or :patch) when resolution is deciding what versions
-    # best resolve all dependencies in the bundle.
-    # @param dep [Dependency] The Dependency of the gem.
-    # @param spec_groups [Specification] An array of Specifications for the same gem
-    #    named in the @dep param.
+    # Given a Resolver::Package and an Array of Specifications of available
+    # versions for a gem, this method will return the Array of Specifications
+    # sorted (and possibly truncated if strict is true) in an order to give
+    # preference to the current level (:major, :minor or :patch) when resolution
+    # is deciding what versions best resolve all dependencies in the bundle.
+    # @param package [Resolver::Package] The package being resolved.
+    # @param specs [Specification] An array of Specifications for the package.
     # @return [Specification] A new instance of the Specification Array sorted and
     #    possibly filtered.
-    def sort_versions(dep, spec_groups)
-      @sort_versions[dep] ||= begin
-        gem_name = dep.name
-
-        # An Array per version returned, different entries for different platforms.
-        # We only need the version here so it's ok to hard code this to the first instance.
-        locked_spec = locked_specs[gem_name].first
+    def sort_versions(package, specs)
+      specs = filter_dep_specs(specs, package) if strict
 
-        if strict
-          filter_dep_specs(spec_groups, locked_spec)
-        else
-          sort_dep_specs(spec_groups, locked_spec)
-        end
-      end
-    end
-
-    def reset
-      @sort_versions = {}
+      sort_dep_specs(specs, package)
     end
 
     # @return [bool] Convenience method for testing value of level variable.
@@ -95,79 +68,72 @@ module Bundler
       level == :minor
     end
 
+    # @return [bool] Convenience method for testing value of pre variable.
+    def pre?
+      pre == true
+    end
+
     private
 
-    def filter_dep_specs(spec_groups, locked_spec)
-      res = spec_groups.select do |spec_group|
-        if locked_spec && !major?
-          gsv = spec_group.version
-          lsv = locked_spec.version
+    def filter_dep_specs(specs, package)
+      locked_version = package.locked_version
+      return specs if locked_version.nil? || major?
 
-          must_match = minor? ? [0] : [0, 1]
+      specs.select do |spec|
+        gsv = spec.version
 
-          matches = must_match.map {|idx| gsv.segments[idx] == lsv.segments[idx] }
-          matches.uniq == [true] ? (gsv >= lsv) : false
-        else
-          true
-        end
-      end
+        must_match = minor? ? [0] : [0, 1]
 
-      sort_dep_specs(res, locked_spec)
+        all_match = must_match.all? {|idx| gsv.segments[idx] == locked_version.segments[idx] }
+        all_match && gsv >= locked_version
+      end
     end
 
-    def sort_dep_specs(spec_groups, locked_spec)
-      @locked_version = locked_spec&.version
-      @gem_name = locked_spec&.name
-
-      result = spec_groups.sort do |a, b|
-        @a_ver = a.version
-        @b_ver = b.version
+    def sort_dep_specs(specs, package)
+      locked_version = package.locked_version
 
-        unless @gem_name && @prerelease_specified[@gem_name]
-          a_pre = @a_ver.prerelease?
-          b_pre = @b_ver.prerelease?
+      result = specs.sort do |a, b|
+        unless locked_version && (package.prerelease_specified? || pre?)
+          a_pre = a.prerelease?
+          b_pre = b.prerelease?
 
           next -1 if a_pre && !b_pre
           next  1 if b_pre && !a_pre
         end
 
         if major?
-          @a_ver <=> @b_ver
-        elsif either_version_older_than_locked
-          @a_ver <=> @b_ver
-        elsif segments_do_not_match(:major)
-          @b_ver <=> @a_ver
-        elsif !minor? && segments_do_not_match(:minor)
-          @b_ver <=> @a_ver
+          a <=> b
+        elsif either_version_older_than_locked?(a, b, locked_version)
+          a <=> b
+        elsif segments_do_not_match?(a, b, :major)
+          b <=> a
+        elsif !minor? && segments_do_not_match?(a, b, :minor)
+          b <=> a
         else
-          @a_ver <=> @b_ver
+          a <=> b
         end
       end
-      post_sort(result)
+      post_sort(result, package.unlock?, locked_version)
     end
 
-    def either_version_older_than_locked
-      @locked_version && (@a_ver < @locked_version || @b_ver < @locked_version)
+    def either_version_older_than_locked?(a, b, locked_version)
+      locked_version && (a.version < locked_version || b.version < locked_version)
     end
 
-    def segments_do_not_match(level)
+    def segments_do_not_match?(a, b, level)
       index = [:major, :minor].index(level)
-      @a_ver.segments[index] != @b_ver.segments[index]
-    end
-
-    def unlocking_gem?
-      unlock_gems.empty? || (@gem_name && unlock_gems.include?(@gem_name))
+      a.segments[index] != b.segments[index]
     end
 
     # Specific version moves can't always reliably be done during sorting
     # as not all elements are compared against each other.
-    def post_sort(result)
+    def post_sort(result, unlock, locked_version)
       # default :major behavior in Bundler does not do this
       return result if major?
-      if unlocking_gem? || @locked_version.nil?
+      if unlock || locked_version.nil?
         result
       else
-        move_version_to_end(result, @locked_version)
+        move_version_to_end(result, locked_version)
       end
     end
 

data/bundler/lib/bundler/graph.rb

@@ -114,10 +114,10 @@ module Bundler
         @groups.each do |group|
           g.add_nodes(
             group, {
-              :style     => "filled",
+              :style => "filled",
               :fillcolor => "#B9B9D5",
-              :shape     => "box3d",
-              :fontsize  => 16,
+              :shape => "box3d",
+              :fontsize => 16,
             }.merge(@node_options[group])
           )
         end