rubygems-update 3.5.6 → 3.5.16

data/bundler/lib/bundler/resolver.rb

@@ -50,26 +50,26 @@ module Bundler
         specs[name] = matches.sort_by {|s| [s.version, s.platform.to_s] }
       end
 
+      @all_versions = Hash.new do |candidates, package|
+        candidates[package] = all_versions_for(package)
+      end
+
       @sorted_versions = Hash.new do |candidates, package|
-        candidates[package] = if package.root?
-          [root_version]
-        else
-          all_versions_for(package).sort
-        end
+        candidates[package] = filtered_versions_for(package).sort
       end
 
+      @sorted_versions[root] = [root_version]
+
       root_dependencies = prepare_dependencies(@requirements, @packages)
 
       @cached_dependencies = Hash.new do |dependencies, package|
-        dependencies[package] = if package.root?
-          { root_version => root_dependencies }
-        else
-          Hash.new do |versions, version|
-            versions[version] = to_dependency_hash(version.dependencies.reject {|d| d.name == package.name }, @packages)
-          end
+        dependencies[package] = Hash.new do |versions, version|
+          versions[version] = to_dependency_hash(version.dependencies.reject {|d| d.name == package.name }, @packages)
         end
       end
 
+      @cached_dependencies[root] = { root_version => root_dependencies }
+
       logger = Bundler::UI::Shell.new
       logger.level = debug? ? "debug" : "warn"
 
@@ -79,7 +79,8 @@ module Bundler
     def solve_versions(root:, logger:)
       solver = PubGrub::VersionSolver.new(source: self, root: root, logger: logger)
       result = solver.solve
-      result.map {|package, version| version.to_specs(package) }.flatten.uniq
+      resolved_specs = result.map {|package, version| version.to_specs(package) }.flatten
+      resolved_specs |= @base.specs_compatible_with(SpecSet.new(resolved_specs))
     rescue PubGrub::SolveFailure => e
       incompatibility = e.incompatibility
 
@@ -156,9 +157,15 @@ module Bundler
     end
 
     def versions_for(package, range=VersionRange.any)
-      versions = range.select_versions(@sorted_versions[package])
+      versions = select_sorted_versions(package, range)
 
-      sort_versions(package, versions)
+      # Conditional avoids (among other things) calling
+      # sort_versions_by_preferred with the root package
+      if versions.size > 1
+        sort_versions_by_preferred(package, versions)
+      else
+        versions
+      end
     end
 
     def no_versions_incompatibility_for(package, unsatisfied_term)
@@ -247,8 +254,8 @@ module Bundler
       locked_requirement = base_requirements[name]
       results = filter_matching_specs(results, locked_requirement) if locked_requirement
 
-      versions = results.group_by(&:version).reduce([]) do |groups, (version, specs)|
-        platform_specs = package.platforms.map {|platform| select_best_platform_match(specs, platform) }
+      results.group_by(&:version).reduce([]) do |groups, (version, specs)|
+        platform_specs = package.platform_specs(specs)
 
         # If package is a top-level dependency,
         #   candidate is only valid if there are matching versions for all resolution platforms.
@@ -263,19 +270,25 @@ module Bundler
           next groups if platform_specs.all?(&:empty?)
         end
 
-        platform_specs.flatten!
-
         ruby_specs = select_best_platform_match(specs, Gem::Platform::RUBY)
-        groups << Resolver::Candidate.new(version, specs: ruby_specs) if ruby_specs.any?
+        ruby_group = Resolver::SpecGroup.new(ruby_specs)
 
-        next groups if platform_specs == ruby_specs || package.force_ruby_platform?
+        unless ruby_group.empty?
+          platform_specs.each do |specs|
+            ruby_group.merge(Resolver::SpecGroup.new(specs))
+          end
 
-        groups << Resolver::Candidate.new(version, specs: platform_specs)
+          groups << Resolver::Candidate.new(version, group: ruby_group, priority: -1)
+          next groups if package.force_ruby_platform?
+        end
+
+        platform_group = Resolver::SpecGroup.new(platform_specs.flatten.uniq)
+        next groups if platform_group == ruby_group
+
+        groups << Resolver::Candidate.new(version, group: platform_group, priority: 1)
 
         groups
       end
-
-      sort_versions(package, versions)
     end
 
     def source_for(name)
@@ -334,6 +347,21 @@ module Bundler
 
     private
 
+    def filtered_versions_for(package)
+      @gem_version_promoter.filter_versions(package, @all_versions[package])
+    end
+
+    def raise_all_versions_filtered_out!(package)
+      level = @gem_version_promoter.level
+      name = package.name
+      locked_version = package.locked_version
+      requirement = package.dependency
+
+      raise GemNotFound,
+        "#{name} is locked to #{locked_version}, while Gemfile is requesting #{requirement}. " \
+        "--strict --#{level} was specified, but there are no #{level} level upgrades from #{locked_version} satisfying #{requirement}, so version solving has failed"
+    end
+
     def filter_matching_specs(specs, requirements)
       Array(requirements).flat_map do |requirement|
         specs.select {| spec| requirement_satisfied_by?(requirement, spec) }
@@ -357,12 +385,8 @@ module Bundler
       requirement.satisfied_by?(spec.version) || spec.source.is_a?(Source::Gemspec)
     end
 
-    def sort_versions(package, versions)
-      if versions.size > 1
-        @gem_version_promoter.sort_versions(package, versions).reverse
-      else
-        versions
-      end
+    def sort_versions_by_preferred(package, versions)
+      @gem_version_promoter.sort_versions(package, versions)
     end
 
     def repository_for(package)
@@ -379,12 +403,19 @@ module Bundler
 
         next [dep_package, dep_constraint] if name == "bundler"
 
-        versions = versions_for(dep_package, dep_constraint.range)
+        dep_range = dep_constraint.range
+        versions = select_sorted_versions(dep_package, dep_range)
         if versions.empty? && dep_package.ignores_prereleases?
+          @all_versions.delete(dep_package)
           @sorted_versions.delete(dep_package)
           dep_package.consider_prereleases!
-          versions = versions_for(dep_package, dep_constraint.range)
+          versions = select_sorted_versions(dep_package, dep_range)
+        end
+
+        if versions.empty? && select_all_versions(dep_package, dep_range).any?
+          raise_all_versions_filtered_out!(dep_package)
         end
+
         next [dep_package, dep_constraint] unless versions.empty?
 
         next unless dep_package.current_platform?
@@ -393,6 +424,14 @@ module Bundler
       end.compact.to_h
     end
 
+    def select_sorted_versions(package, range)
+      range.select_versions(@sorted_versions[package])
+    end
+
+    def select_all_versions(package, range)
+      range.select_versions(@all_versions[package])
+    end
+
     def other_specs_matching_message(specs, requirement)
       message = String.new("The source contains the following gems matching '#{requirement}':\n")
       message << specs.map {|s| "  * #{s.full_name}" }.join("\n")
@@ -401,8 +440,8 @@ module Bundler
 
     def requirement_to_range(requirement)
       ranges = requirement.requirements.map do |(op, version)|
-        ver = Resolver::Candidate.new(version).generic!
-        platform_ver = Resolver::Candidate.new(version).platform_specific!
+        ver = Resolver::Candidate.new(version, priority: -1)
+        platform_ver = Resolver::Candidate.new(version, priority: 1)
 
         case op
         when "~>"

data/bundler/lib/bundler/rubygems_ext.rb

@@ -1,11 +1,7 @@
 # frozen_string_literal: true
 
-require "pathname"
-
 require "rubygems" unless defined?(Gem)
 
-require "rubygems/specification"
-
 # We can't let `Gem::Source` be autoloaded in the `Gem::Specification#source`
 # redefinition below, so we need to load it upfront. The reason is that if
 # Bundler monkeypatches are loaded before RubyGems activates an executable (for
@@ -17,10 +13,6 @@ require "rubygems/specification"
 # `Gem::Source` from the redefined `Gem::Specification#source`.
 require "rubygems/source"
 
-require_relative "match_metadata"
-require_relative "force_platform"
-require_relative "match_platform"
-
 # Cherry-pick fixes to `Gem.ruby_version` to be useful for modern Bundler
 # versions and ignore patchlevels
 # (https://github.com/rubygems/rubygems/pull/5472,
@@ -31,7 +23,52 @@ unless Gem.ruby_version.to_s == RUBY_VERSION || RUBY_PATCHLEVEL == -1
 end
 
 module Gem
+  # Can be removed once RubyGems 3.5.11 support is dropped
+  unless Gem.respond_to?(:freebsd_platform?)
+    def self.freebsd_platform?
+      RbConfig::CONFIG["host_os"].to_s.include?("bsd")
+    end
+  end
+
+  # Can be removed once RubyGems 3.5.14 support is dropped
+  unless Gem.respond_to?(:open_file_with_flock)
+    def self.open_file_with_flock(path, &block)
+      flags = File.exist?(path) ? "r+" : "a+"
+
+      File.open(path, flags) do |io|
+        begin
+          io.flock(File::LOCK_EX)
+        rescue Errno::ENOSYS, Errno::ENOTSUP
+        end
+        yield io
+      rescue Errno::ENOLCK # NFS
+        if Thread.main != Thread.current
+          raise
+        else
+          File.open(path, flags, &block)
+        end
+      end
+    end
+  end
+
+  require "rubygems/specification"
+
+  # Can be removed once RubyGems 3.5.14 support is dropped
+  VALIDATES_FOR_RESOLUTION = Specification.new.respond_to?(:validate_for_resolution).freeze
+
+  # Can be removed once RubyGems 3.3.15 support is dropped
+  FLATTENS_REQUIRED_PATHS = Specification.new.respond_to?(:flatten_require_paths).freeze
+
   class Specification
+    # Can be removed once RubyGems 3.5.15 support is dropped
+    correct_array_attributes = @@default_value.select {|_k,v| v.is_a?(Array) }.keys
+    unless @@array_attributes == correct_array_attributes
+      @@array_attributes = correct_array_attributes # rubocop:disable Style/ClassVars
+    end
+
+    require_relative "match_metadata"
+    require_relative "match_platform"
+
     include ::Bundler::MatchMetadata
     include ::Bundler::MatchPlatform
 
@@ -48,7 +85,7 @@ module Gem
 
     def full_gem_path
       if source.respond_to?(:root)
-        Pathname.new(loaded_from).dirname.expand_path(source.root).to_s
+        File.expand_path(File.dirname(loaded_from), source.root)
       else
         rg_full_gem_path
       end
@@ -127,6 +164,33 @@ module Gem
       !default_gem? && !File.directory?(full_gem_path)
     end
 
+    unless VALIDATES_FOR_RESOLUTION
+      def validate_for_resolution
+        SpecificationPolicy.new(self).validate_for_resolution
+      end
+    end
+
+    unless FLATTENS_REQUIRED_PATHS
+      def flatten_require_paths
+        return unless raw_require_paths.first.is_a?(Array)
+
+        warn "#{name} #{version} includes a gemspec with `require_paths` set to an array of arrays. Newer versions of this gem might've already fixed this"
+        raw_require_paths.flatten!
+      end
+
+      class << self
+        module RequirePathFlattener
+          def from_yaml(input)
+            spec = super(input)
+            spec.flatten_require_paths
+            spec
+          end
+        end
+
+        prepend RequirePathFlattener
+      end
+    end
+
     private
 
     def dependencies_to_gemfile(dependencies, group = nil)
@@ -146,7 +210,31 @@ module Gem
     end
   end
 
+  unless VALIDATES_FOR_RESOLUTION
+    class SpecificationPolicy
+      def validate_for_resolution
+        validate_required!
+      end
+    end
+  end
+
+  module BetterPermissionError
+    def data
+      super
+    rescue Errno::EACCES
+      raise Bundler::PermissionError.new(loaded_from, :read)
+    end
+  end
+
+  require "rubygems/stub_specification"
+
+  class StubSpecification
+    prepend BetterPermissionError
+  end
+
   class Dependency
+    require_relative "force_platform"
+
     include ::Bundler::ForcePlatform
 
     attr_accessor :source, :groups
@@ -221,7 +309,7 @@ module Gem
 
         # cpu
         ([nil,"universal"].include?(@cpu) || [nil, "universal"].include?(other.cpu) || @cpu == other.cpu ||
-        (@cpu == "arm" && other.cpu.start_with?("arm"))) &&
+        (@cpu == "arm" && other.cpu.start_with?("armv"))) &&
 
           # os
           @os == other.os &&

data/bundler/lib/bundler/rubygems_gem_installer.rb

@@ -29,7 +29,10 @@ module Bundler
       write_build_info_file
       run_post_build_hooks
 
-      generate_bin
+      SharedHelpers.filesystem_access(bin_dir, :write) do
+        generate_bin
+      end
+
       generate_plugins
 
       write_spec
@@ -45,7 +48,17 @@ module Bundler
       spec
     end
 
-    def pre_install_checks
+    if Bundler.rubygems.provides?("< 3.5")
+      def pre_install_checks
+        super
+      rescue Gem::FilePermissionError
+        # Ignore permission checks in RubyGems. Instead, go on, and try to write
+        # for real. We properly handle permission errors when they happen.
+        nil
+      end
+    end
+
+    def ensure_writable_dir(dir)
       super
     rescue Gem::FilePermissionError
       # Ignore permission checks in RubyGems. Instead, go on, and try to write
@@ -68,6 +81,26 @@ module Bundler
       end
     end
 
+    if Bundler.rubygems.provides?("< 3.5.15")
+      def generate_bin_script(filename, bindir)
+        bin_script_path = File.join bindir, formatted_program_filename(filename)
+
+        Gem.open_file_with_flock("#{bin_script_path}.lock") do
+          require "fileutils"
+          FileUtils.rm_f bin_script_path # prior install may have been --no-wrappers
+
+          File.open(bin_script_path, "wb", 0o755) do |file|
+            file.write app_script_text(filename)
+            file.chmod(options[:prog_mode] || 0o755)
+          end
+        end
+
+        verbose bin_script_path
+
+        generate_windows_script filename, bindir
+      end
+    end
+
     def build_extensions
       extension_cache_path = options[:bundler_extension_cache_path]
       extension_dir = spec.extension_dir

data/bundler/lib/bundler/rubygems_integration.rb

@@ -48,7 +48,7 @@ module Bundler
     end
 
     def validate(spec)
-      Bundler.ui.silence { spec.validate(false) }
+      Bundler.ui.silence { spec.validate_for_resolution }
     rescue Gem::InvalidSpecificationException => e
       error_message = "The gemspec at #{spec.loaded_from} is not valid. Please fix this gemspec.\n" \
         "The validation error was '#{e.message}'\n"
@@ -204,7 +204,7 @@ module Bundler
 
       [::Kernel.singleton_class, ::Kernel].each do |kernel_class|
         redefine_method(kernel_class, :gem) do |dep, *reqs|
-          if executables&.include?(File.basename(caller.first.split(":").first))
+          if executables&.include?(File.basename(caller_locations(1, 1).first.path))
             break
           end
 
@@ -469,11 +469,25 @@ module Bundler
     end
 
     def all_specs
+      SharedHelpers.major_deprecation 2, "Bundler.rubygems.all_specs has been removed in favor of Bundler.rubygems.installed_specs"
+
       Gem::Specification.stubs.map do |stub|
         StubSpecification.from_stub(stub)
       end
     end
 
+    def installed_specs
+      Gem::Specification.stubs.reject(&:default_gem?).map do |stub|
+        StubSpecification.from_stub(stub)
+      end
+    end
+
+    def default_specs
+      Gem::Specification.default_stubs.map do |stub|
+        StubSpecification.from_stub(stub)
+      end
+    end
+
     def find_bundler(version)
       find_name("bundler").find {|s| s.version.to_s == version }
     end

data/bundler/lib/bundler/runtime.rb

@@ -10,7 +10,7 @@ module Bundler
     end
 
     def setup(*groups)
-      @definition.ensure_equivalent_gemfile_and_lockfile if Bundler.frozen_bundle?
+      @definition.ensure_equivalent_gemfile_and_lockfile
 
       # Has to happen first
       clean_load_path

data/bundler/lib/bundler/self_manager.rb

@@ -70,8 +70,23 @@ module Bundler
       configured_gem_home = ENV["GEM_HOME"]
       configured_gem_path = ENV["GEM_PATH"]
 
-      cmd = [$PROGRAM_NAME, *ARGV]
-      cmd.unshift(Gem.ruby) unless File.executable?($PROGRAM_NAME)
+      # Bundler specs need some stuff to be required before Bundler starts
+      # running, for example, for faking the compact index API. However, these
+      # flags are lost when we reexec to a different version of Bundler. In the
+      # future, we may be able to properly reconstruct the original Ruby
+      # invocation (see https://bugs.ruby-lang.org/issues/6648), but for now
+      # there's no way to do it, so we need to be explicit about how to re-exec.
+      # This may be a feature end users request at some point, but maybe by that
+      # time, we have builtin tools to do. So for now, we use an undocumented
+      # ENV variable only for our specs.
+      bundler_spec_original_cmd = ENV["BUNDLER_SPEC_ORIGINAL_CMD"]
+      if bundler_spec_original_cmd
+        require "shellwords"
+        cmd = [*Shellwords.shellsplit(bundler_spec_original_cmd), *ARGV]
+      else
+        cmd = [$PROGRAM_NAME, *ARGV]
+        cmd.unshift(Gem.ruby) unless File.executable?($PROGRAM_NAME)
+      end
 
       Bundler.with_original_env do
         Kernel.exec(
@@ -92,6 +107,7 @@ module Bundler
     def autoswitching_applies?
       ENV["BUNDLER_VERSION"].nil? &&
         Bundler.rubygems.supports_bundler_trampolining? &&
+        ruby_can_restart_with_same_arguments? &&
         SharedHelpers.in_bundle? &&
         lockfile_version
     end
@@ -151,6 +167,10 @@ module Bundler
       !version.to_s.end_with?(".dev")
     end
 
+    def ruby_can_restart_with_same_arguments?
+      $PROGRAM_NAME != "-e"
+    end
+
     def updating?
       "update".start_with?(ARGV.first || " ") && ARGV[1..-1].any? {|a| a.start_with?("--bundler") }
     end

data/bundler/lib/bundler/settings.rb

@@ -7,7 +7,6 @@ module Bundler
     autoload :Validator, File.expand_path("settings/validator", __dir__)
 
     BOOL_KEYS = %w[
-      allow_deployment_source_credential_changes
       allow_offline_install
       auto_clean_without_path
       auto_install
@@ -104,6 +103,7 @@ module Bundler
     def initialize(root = nil)
       @root            = root
       @local_config    = load_config(local_config_file)
+      @local_root      = root || Pathname.new(".bundle").expand_path
 
       @env_config      = ENV.to_h
       @env_config.select! {|key, _value| key.start_with?("BUNDLE_") }
@@ -143,7 +143,7 @@ module Bundler
     end
 
     def set_local(key, value)
-      local_config_file || raise(GemfileNotFound, "Could not locate Gemfile")
+      local_config_file = @local_root.join("config")
 
       set_key(key, value, @local_config, local_config_file)
     end
@@ -492,16 +492,23 @@ module Bundler
         valid_file = file.exist? && !file.size.zero?
         return {} unless valid_file
         serializer_class.load(file.read).inject({}) do |config, (k, v)|
-          if k.include?("-")
-            Bundler.ui.warn "Your #{file} config includes `#{k}`, which contains the dash character (`-`).\n" \
-              "This is deprecated, because configuration through `ENV` should be possible, but `ENV` keys cannot include dashes.\n" \
-              "Please edit #{file} and replace any dashes in configuration keys with a triple underscore (`___`)."
+          k = k.dup
+          k << "/" if /https?:/i.match?(k) && !k.end_with?("/", "__#{FALLBACK_TIMEOUT_URI_OPTION.upcase}")
+          k.gsub!(".", "__")
 
-            # string hash keys are frozen
-            k = k.gsub("-", "___")
+          unless k.start_with?("#")
+            if k.include?("-")
+              Bundler.ui.warn "Your #{file} config includes `#{k}`, which contains the dash character (`-`).\n" \
+                "This is deprecated, because configuration through `ENV` should be possible, but `ENV` keys cannot include dashes.\n" \
+                "Please edit #{file} and replace any dashes in configuration keys with a triple underscore (`___`)."
+
+              # string hash keys are frozen
+              k = k.gsub("-", "___")
+            end
+
+            config[k] = v
           end
 
-          config[k] = v
           config
         end
       end
@@ -516,26 +523,25 @@ module Bundler
       YAMLSerializer
     end
 
-    PER_URI_OPTIONS = %w[
-      fallback_timeout
-    ].freeze
+    FALLBACK_TIMEOUT_URI_OPTION = "fallback_timeout"
 
     NORMALIZE_URI_OPTIONS_PATTERN =
       /
         \A
         (\w+\.)? # optional prefix key
         (https?.*?) # URI
-        (\.#{Regexp.union(PER_URI_OPTIONS)})? # optional suffix key
+        (\.#{FALLBACK_TIMEOUT_URI_OPTION})? # optional suffix key
         \z
       /ix
 
     def self.key_for(key)
-      key = normalize_uri(key).to_s if key.is_a?(String) && key.start_with?("http", "mirror.http")
-      key = key_to_s(key).gsub(".", "__")
+      key = key_to_s(key)
+      key = normalize_uri(key) if key.start_with?("http", "mirror.http")
+      key = key.gsub(".", "__")
       key.gsub!("-", "___")
       key.upcase!
 
-      key.prepend("BUNDLE_")
+      key.gsub(/\A([ #]*)/, '\1BUNDLE_')
     end
 
     # TODO: duplicates Rubygems#normalize_uri

data/bundler/lib/bundler/setup.rb

@@ -5,6 +5,12 @@ require_relative "shared_helpers"
 if Bundler::SharedHelpers.in_bundle?
   require_relative "../bundler"
 
+  # autoswitch to locked Bundler version if available
+  Bundler.auto_switch
+
+  # try to auto_install first before we get to the `Bundler.ui.silence`, so user knows what is happening
+  Bundler.auto_install
+
   if STDOUT.tty? || ENV["BUNDLER_FORCE_TTY"]
     begin
       Bundler.ui.silence { Bundler.setup }

data/bundler/lib/bundler/shared_helpers.rb

@@ -1,14 +1,16 @@
 # frozen_string_literal: true
 
-require "pathname"
-require "rbconfig"
-
 require_relative "version"
-require_relative "constants"
 require_relative "rubygems_integration"
 require_relative "current_ruby"
 
+autoload :Pathname, "pathname"
+
 module Bundler
+  autoload :WINDOWS, File.expand_path("constants", __dir__)
+  autoload :FREEBSD, File.expand_path("constants", __dir__)
+  autoload :NULL, File.expand_path("constants", __dir__)
+
   module SharedHelpers
     def root
       gemfile = find_gemfile

data/bundler/lib/bundler/source/git/git_proxy.rb

@@ -182,6 +182,14 @@ module Bundler
             if err.include?("Could not find remote branch")
               raise MissingGitRevisionError.new(command_with_no_credentials, nil, explicit_ref, credential_filtered_uri)
             else
+              idx = command.index("--depth")
+              if idx
+                command.delete_at(idx)
+                command.delete_at(idx)
+                command_with_no_credentials = check_allowed(command)
+
+                err += "Retrying without --depth argument."
+              end
               raise GitCommandError.new(command_with_no_credentials, path, err)
             end
           end

data/bundler/lib/bundler/source/git.rb

@@ -32,6 +32,20 @@ module Bundler
         @local      = false
       end
 
+      def remote!
+        return if @allow_remote
+
+        @local_specs = nil
+        @allow_remote = true
+      end
+
+      def cached!
+        return if @allow_cached
+
+        @local_specs = nil
+        @allow_cached = true
+      end
+
       def self.from_lock(options)
         new(options.merge("uri" => options.delete("remote")))
       end

data/bundler/lib/bundler/source/metadata.rb

@@ -11,6 +11,8 @@ module Bundler
           end
 
           if local_spec = Gem.loaded_specs["bundler"]
+            raise CorruptBundlerInstallError.new(local_spec) if local_spec.version.to_s != Bundler::VERSION
+
             idx << local_spec
           else
             idx << Gem::Specification.new do |s|