rubygems-update 4.0.16 → 4.0.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aebfb272578fbad19c368078f6ffda6bdd58efeb1dc8e88a5b5a427e0acd87aa
-  data.tar.gz: 2f644c0c209a61d2e958720eff22877e3a48956b8aef92d78ee1f4e872e42c2c
+  metadata.gz: bf600fcd45beb7a21ff7e319301fa12ebb2fb74e800a11eb0ec49edd79e290ad
+  data.tar.gz: 53a095fcf4f29c4e06adf5f5759ffd3f7d481b15553a549bc0d7dc6abc74c087
 SHA512:
-  metadata.gz: e28f143143e460bf1dd04e184e202723cccc1f686602b012585a662e52f334b8eec464f4d094378a83a630d4ffcc8e398d46f7b03cf0fdac06a57ac364dd3070
-  data.tar.gz: e8ba8134f48a8fbf5319e4bd4f238ad9bb51cc31f734a7bde9d84c3ebee67fa5426b023f91ed6f0d34c36c151e82518fcfb4715cda9c566a253cdd61178758ab
+  metadata.gz: 412444397c9bb743e7a573e6838a0e5a5f4c5140bb1878eb11c0fe906c349d047c6d6ddeb0fe74b0da2560e4061359a8fbaa3ffab88b129e0df096406801d145
+  data.tar.gz: fe0f8c100c204f73322acd599498e9fa71669e0286a1dc6ef7b576f94c98303d4d9a44117239a6bf6667191623f6d634b0f45424aa48fecd54092aff1c9480ae

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 4.0.18 / 2026-08-05
+
+### Enhancements:
+
+* Check the resolved parent directory before extracting old format gems. Pull request [#9755](https://github.com/ruby/rubygems/pull/9755) by hsbt
+* Installs bundler 4.0.18 as a default gem.
+
+### Bug fixes:
+
+* Call Kernel.format explicitly in Gem::Deprecate wrapper. Pull request [#9714](https://github.com/ruby/rubygems/pull/9714) by hsbt
+
+### Documentation:
+
+* Point bundler.io URLs at guides.rubygems.org. Pull request [#9737](https://github.com/ruby/rubygems/pull/9737) by hsbt
+
+## 4.0.17 / 2026-07-22
+
+### Enhancements:
+
+* Validate spec name before writing to the spec cache. Pull request [#9690](https://github.com/ruby/rubygems/pull/9690) by hsbt
+* Installs bundler 4.0.17 as a default gem.
+
+### Bug fixes:
+
+* Unquote Gem.ruby when spawning it as a separate argv element. Pull request [#9695](https://github.com/ruby/rubygems/pull/9695) by hsbt
+* Escape glob metacharacters in install paths when globbing. Pull request [#9687](https://github.com/ruby/rubygems/pull/9687) by hsbt
+* Preserve Windows editor paths in gem open and bundle open. Pull request [#9694](https://github.com/ruby/rubygems/pull/9694) by hsbt
+* Preserve Windows paths in MAKE and rake environment variables. Pull request [#9693](https://github.com/ruby/rubygems/pull/9693) by hsbt
+* Fix `bundle` binstub broken by `gem update --system` on Homebrew ruby. Pull request [#9688](https://github.com/ruby/rubygems/pull/9688) by hsbt
+
 ## 4.0.16 / 2026-07-10
 
 ### Enhancements:

data/bundler/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 4.0.18 / 2026-08-05
+
+### Enhancements:
+
+* Don't mask install errors when no Gemfile can be located. Pull request [#9757](https://github.com/ruby/rubygems/pull/9757) by hsbt
+* Warn when duplicate source declarations conflict on cooldown. Pull request [#9736](https://github.com/ruby/rubygems/pull/9736) by hsbt
+* Redact URI userinfo from settings names in Bundler User-Agent. Pull request [#9716](https://github.com/ruby/rubygems/pull/9716) by hsbt
+* Validate gem name before building compact index cache paths. Pull request [#9717](https://github.com/ruby/rubygems/pull/9717) by hsbt
+
+### Bug fixes:
+
+* Fail `bundle check` when frozen mode needs lockfile changes. Pull request [#9715](https://github.com/ruby/rubygems/pull/9715) by hsbt
+* Skip empty checksum values in compact index metadata. Pull request [#9713](https://github.com/ruby/rubygems/pull/9713) by hsbt
+
+### Security:
+
+* Add --cooldown flag to bundle lock and bundle cache. Pull request [#9725](https://github.com/ruby/rubygems/pull/9725) by hsbt
+
+### Documentation:
+
+* Point bundler.io URLs at guides.rubygems.org. Pull request [#9737](https://github.com/ruby/rubygems/pull/9737) by hsbt
+* Document Bundler checksum behavior for default gems. Pull request [#9735](https://github.com/ruby/rubygems/pull/9735) by p-linnane
+* List missing subcommands in bundle(1) UTILITIES section. Pull request [#9721](https://github.com/ruby/rubygems/pull/9721) by hsbt
+* Document pessimistic operator and eval_gemfile in gemfile(5). Pull request [#9719](https://github.com/ruby/rubygems/pull/9719) by hsbt
+
+## 4.0.17 / 2026-07-22
+
+### Enhancements:
+
+* Open compact index cache in binary mode when appending. Pull request [#9679](https://github.com/ruby/rubygems/pull/9679) by hsbt
+
+### Bug fixes:
+
+* Unquote Gem.ruby when spawning it as a separate argv element. Pull request [#9695](https://github.com/ruby/rubygems/pull/9695) by hsbt
+* Escape glob metacharacters in install paths when globbing. Pull request [#9687](https://github.com/ruby/rubygems/pull/9687) by hsbt
+* Avoid space-containing absolute path in RUBYOPT. Pull request [#9696](https://github.com/ruby/rubygems/pull/9696) by hsbt
+* Preserve the locked Bundler checksum when the gem isn't cached. Pull request [#9658](https://github.com/ruby/rubygems/pull/9658) by rwstauner
+
+### Documentation:
+
+* Point Bundler gemspec metadata at the moved docs. Pull request [#9648](https://github.com/ruby/rubygems/pull/9648) by hsbt
+
 ## 4.0.16 / 2026-07-10
 
 ### Enhancements:

data/bundler/lib/bundler/build_metadata.rb

@@ -5,7 +5,7 @@ module Bundler
   module BuildMetadata
     # begin ivars
     @built_at = nil
-    @git_commit_sha = "fc18079dba".freeze
+    @git_commit_sha = "7e934435ff".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/bundler/lib/bundler/cli/check.rb

@@ -12,6 +12,7 @@ module Bundler
       Bundler.settings.set_command_option_if_given :path, options[:path]
 
       definition = Bundler.definition
+      definition.ensure_equivalent_gemfile_and_lockfile
       definition.validate_runtime!
 
       begin
@@ -28,9 +29,6 @@ module Bundler
         not_installed.each {|s| Bundler.ui.error " * #{s.name} (#{s.version})" }
         Bundler.ui.warn "Install missing gems with `bundle install`"
         exit 1
-      elsif !Bundler.default_lockfile.file? && Bundler.frozen_bundle?
-        Bundler.ui.error "This bundle has been frozen, but there is no #{SharedHelpers.relative_lockfile_path} present"
-        exit 1
       else
         definition.lock(true) unless options[:"dry-run"]
         Bundler.ui.info "The Gemfile's dependencies are satisfied"

data/bundler/lib/bundler/cli/issue.rb

@@ -13,10 +13,10 @@ module Bundler
         https://github.com/ruby/rubygems/blob/master/doc/bundler/TROUBLESHOOTING.md
 
         2. Instructions for common Bundler uses can be found on the documentation
-        site: https://bundler.io/
+        site: https://guides.rubygems.org/
 
         3. Information about each Bundler command can be found in the Bundler
-        man pages: https://bundler.io/man/bundle.1.html
+        man pages: https://guides.rubygems.org/command-reference/bundle/
 
         Hopefully the troubleshooting steps above resolved your problem!  If things
         still aren't working the way you expect them to, please let us know so

data/bundler/lib/bundler/cli/lock.rb

@@ -16,6 +16,9 @@ module Bundler
 
       check_for_conflicting_options
 
+      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
+      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+
       print = options[:print]
       previous_output_stream = Bundler.ui.output_stream
       Bundler.ui.output_stream = :stderr if print

data/bundler/lib/bundler/cli/open.rb

@@ -18,12 +18,22 @@ module Bundler
         Bundler.ui.info "Unable to open #{name} because it's a default gem, so the directory it would normally be installed to does not exist."
       else
         root_path = spec.full_gem_path
-        require "shellwords"
-        command = Shellwords.split(editor) << File.join([root_path, path].compact)
+        command = editor_command(editor) << File.join([root_path, path].compact)
         Bundler.with_original_env do
           system(*command, { chdir: root_path })
         end || Bundler.ui.info("Could not run '#{command.join(" ")}'")
       end
     end
+
+    def editor_command(editor)
+      # On Windows an editor is often configured with a full path such as
+      # C:\Program Files\Microsoft VS Code\Code.exe, which shell splitting
+      # would corrupt. Take a value that names an existing file as a
+      # single word.
+      return [editor] if Gem.win_platform? && File.file?(editor)
+
+      require "shellwords"
+      Shellwords.split(editor)
+    end
   end
 end

data/bundler/lib/bundler/cli.rb

@@ -461,6 +461,7 @@ module Bundler
     method_option "path", type: :string, banner: "Specify a different path than the system default, namely, $BUNDLE_PATH or $GEM_HOME (removed)."
     method_option "quiet", type: :boolean, banner: "Only output warnings and errors."
     method_option "frozen", type: :boolean, banner: "Do not allow the Gemfile.lock to be updated after this bundle cache operation's install (removed)"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     long_desc <<-D
       The cache command will copy the .gem files for every gem in the bundle into the
       directory ./vendor/cache. If you then check that directory into your source
@@ -642,6 +643,7 @@ module Bundler
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
     method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"
       Lock.new(options).run

data/bundler/lib/bundler/compact_index_client/cache.rb

@@ -50,6 +50,7 @@ module Bundler
 
       def info_path(name)
         name = name.to_s
+        validate_name!(name)
         # TODO: converge this into the info_root by hashing all filenames like info_etag_path
         if /[^a-z0-9_-]/.match?(name)
           name += "-#{SharedHelpers.digest(:MD5).hexdigest(name).downcase}"
@@ -61,9 +62,19 @@ module Bundler
 
       def info_etag_path(name)
         name = name.to_s
+        validate_name!(name)
         @info_etag_root.join("#{name}-#{SharedHelpers.digest(:MD5).hexdigest(name).downcase}")
       end
 
+      # Gem names come from the remote index and are not otherwise
+      # validated, so refuse anything that would escape the cache
+      # directory when used as a path component.
+      def validate_name!(name)
+        return if File.basename(name) == name
+
+        raise SecurityError, "malformed gem name: #{name.inspect}"
+      end
+
       def mkdir(name)
         directory.join(name).tap do |dir|
           SharedHelpers.filesystem_access(dir) do

data/bundler/lib/bundler/compact_index_client/cache_file.rb

@@ -103,7 +103,7 @@ module Bundler
       # Returns false without appending when no digests since appending is too error prone to do without digests.
       def append(data)
         return false unless digests?
-        open("a") {|f| f.write data }
+        open("ab") {|f| f.write data }
         verify && commit
       end
 

data/bundler/lib/bundler/endpoint_specification.rb

@@ -153,8 +153,13 @@ module Bundler
         next unless v
         case k.to_s
         when "checksum"
+          # Some registries send empty checksum values, treat them as if the
+          # checksum was not included at all
+          checksum = v.last
+          next unless checksum
+
           begin
-            @checksum = Checksum.from_api(v.last, @spec_fetcher.uri)
+            @checksum = Checksum.from_api(checksum, @spec_fetcher.uri)
           rescue ArgumentError => e
             raise ArgumentError, "Invalid checksum for #{full_name}: #{e.message}"
           end

data/bundler/lib/bundler/fetcher.rb

@@ -215,7 +215,13 @@ module Bundler
           agent << " #{ruby.engine}/#{ruby.versions_string(engine_version)}"
         end
 
-        agent << " options/#{Bundler.settings.all.join(",")}"
+        # Some settings keys embed a URI (e.g. `mirror.<uri>`) whose userinfo can
+        # carry credentials. Strip the userinfo before advertising the setting
+        # names so we don't leak secrets to every gem source we talk to.
+        options = Bundler.settings.all.map do |key|
+          key.include?("://") ? key.gsub(%r{//[^/@]+@}, "//") : key
+        end
+        agent << " options/#{options.join(",")}"
 
         agent << " ci/#{cis.join(",")}" if cis.any?
 

data/bundler/lib/bundler/installer/parallel_installer.rb

@@ -255,7 +255,15 @@ module Bundler
 
     def require_tree_for_spec(spec)
       tree = @spec_set.what_required(spec)
-      t = String.new("In #{File.basename(SharedHelpers.default_gemfile)}:\n")
+      gemfile_name = begin
+        File.basename(SharedHelpers.default_gemfile)
+      rescue GemfileNotFound
+        # This runs while reporting an install error. When no Gemfile can be
+        # located (e.g. Bundler used as a library), raising here would mask
+        # the original error, so fall back to a generic header instead.
+        "Gemfile"
+      end
+      t = String.new("In #{gemfile_name}:\n")
       tree.each_with_index do |s, depth|
         t << "  " * depth.succ << s.name
         unless tree.last == s

data/bundler/lib/bundler/lockfile_generator.rb

@@ -103,17 +103,40 @@ module Bundler
     end
 
     def bundler_checksum
+      # `.dev` versions and `SKIP_BUNDLER_CHECKSUM` are deliberate opt-outs (used
+      # by Bundler/RubyGems' own development and release tasks): never record a
+      # checksum for Bundler itself in those cases.
       return [] if Bundler.gem_version.to_s.end_with?(".dev") || ENV["SKIP_BUNDLER_CHECKSUM"]
 
       bundler_spec = definition.sources.metadata_source.specs.search(["bundler", Bundler.gem_version]).last
-      return [] unless File.exist?(bundler_spec.cache_file)
 
-      require "rubygems/package"
+      # Record a fresh checksum from the locally cached gem when it's available.
+      # When it isn't (e.g. a fresh checkout/CI that never downloaded the bundler
+      # gem), fall back to whatever checksum is already locked rather than
+      # dropping it, so the entry stays consistent across environments.
+      if File.exist?(bundler_spec.cache_file)
+        require "rubygems/package"
+
+        package = Gem::Package.new(bundler_spec.cache_file)
+        definition.sources.metadata_source.checksum_store.register(bundler_spec, Checksum.from_gem_package(package))
+      elsif bundled_with_changing?
+        # We can't compute a fresh checksum (the bundler gem isn't cached) and the
+        # BUNDLED WITH version is changing. Keeping the previously locked checksum
+        # would leave a `bundler (<old version>) sha256=...` entry that no longer
+        # matches the new BUNDLED WITH version, so drop it instead.
+        return []
+      end
 
-      package = Gem::Package.new(bundler_spec.cache_file)
-      definition.sources.metadata_source.checksum_store.register(bundler_spec, Checksum.from_gem_package(package))
+      return [] if definition.sources.metadata_source.checksum_store.missing?(bundler_spec)
 
       [definition.sources.metadata_source.checksum_store.to_lock(bundler_spec)]
     end
+
+    def bundled_with_changing?
+      locked_gems = definition.locked_gems
+      return false unless locked_gems
+
+      locked_gems.bundler_version != definition.bundler_version_to_lock
+    end
   end
 end

data/bundler/lib/bundler/man/bundle-add.1

@@ -76,4 +76,4 @@ You can assign the gem to more than one group\.
 \fBbundle add rails \-\-group "development, test"\fR
 .IP "" 0
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR, bundle\-remove(1) \fIbundle\-remove\.1\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR, bundle\-remove(1) \fIbundle\-remove\.1\.html\fR

data/bundler/lib/bundler/man/bundle-add.1.ronn

@@ -88,5 +88,5 @@ Adds the named gem to the [`Gemfile(5)`][Gemfile(5)] and run `bundle install`.
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html),
+[Gemfile(5)](https://guides.rubygems.org/gemfile/),
 [bundle-remove(1)](bundle-remove.1.html)

data/bundler/lib/bundler/man/bundle-cache.1

@@ -17,6 +17,9 @@ Include gems for all platforms present in the lockfile, not only the current one
 \fB\-\-cache\-path=CACHE\-PATH\fR
 Specify a different cache path than the default (vendor/cache)\.
 .TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving before caching\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
+.TP
 \fB\-\-gemfile=GEMFILE\fR
 Use the specified gemfile instead of Gemfile\.
 .TP

data/bundler/lib/bundler/man/bundle-cache.1.ronn

@@ -21,6 +21,12 @@ use the gems in the cache in preference to the ones on `rubygems.org`.
 * `--cache-path=CACHE-PATH`:
   Specify a different cache path than the default (vendor/cache).
 
+* `--cooldown=<number>`:
+  Only consider gem versions published at least <number> days ago when
+  resolving before caching. Pass `0` to disable cooldown for this run,
+  overriding any per-source or global configuration. See `cooldown` in
+  bundle-config(1).
+
 * `--gemfile=GEMFILE`:
   Use the specified gemfile instead of Gemfile.
 

data/bundler/lib/bundler/man/bundle-config.1

@@ -139,7 +139,7 @@ Cooldown filtering depends on the gem server providing a per\-version \fBcreated
 .IP "\(bu" 4
 \fBlockfile\fR (\fBBUNDLE_LOCKFILE\fR): The path to the lockfile that bundler should use\. By default, Bundler adds \fB\.lock\fR to the end of the \fBgemfile\fR entry\. Can be set to \fBfalse\fR in the Gemfile to disable lockfile creation entirely (see gemfile(5))\.
 .IP "\(bu" 4
-\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\.
+\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\. Bundler's own checksum is only included when its \fB\.gem\fR file is cached, which may not be the case when Bundler is installed as a default gem\.
 .IP "\(bu" 4
 \fBno_install\fR (\fBBUNDLE_NO_INSTALL\fR): Whether \fBbundle package\fR should skip installing gems\.
 .IP "\(bu" 4

data/bundler/lib/bundler/man/bundle-config.1.ronn

@@ -230,6 +230,8 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
    Gemfile to disable lockfile creation entirely (see gemfile(5)).
 * `lockfile_checksums` (`BUNDLE_LOCKFILE_CHECKSUMS`):
    Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources. Defaults to true.
+   Bundler's own checksum is only included when its `.gem` file is cached, which
+   may not be the case when Bundler is installed as a default gem.
 * `no_install` (`BUNDLE_NO_INSTALL`):
    Whether `bundle package` should skip installing gems.
 * `no_prune` (`BUNDLE_NO_PRUNE`):

data/bundler/lib/bundler/man/bundle-console.1

@@ -8,7 +8,7 @@
 .SH "DESCRIPTION"
 Starts an interactive Ruby console session in the context of the current bundle\.
 .P
-If no \fBGROUP\fR is specified, all gems in the \fBdefault\fR group in the Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR are preliminarily loaded\.
+If no \fBGROUP\fR is specified, all gems in the \fBdefault\fR group in the Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR are preliminarily loaded\.
 .P
 If \fBGROUP\fR is specified, all gems in the given group in the Gemfile in addition to the gems in \fBdefault\fR group are loaded\. Even if the given group does not exist in the Gemfile, IRB console starts without any warning or error\.
 .P
@@ -30,4 +30,4 @@ Resolving dependencies\|\.\|\.\|\.
 [1] pry(main)>
 .fi
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR

data/bundler/lib/bundler/man/bundle-console.1.ronn

@@ -9,7 +9,7 @@ bundle-console(1) -- Open an IRB session with the bundle pre-loaded
 
 Starts an interactive Ruby console session in the context of the current bundle.
 
-If no `GROUP` is specified, all gems in the `default` group in the [Gemfile(5)](https://bundler.io/man/gemfile.5.html) are
+If no `GROUP` is specified, all gems in the `default` group in the [Gemfile(5)](https://guides.rubygems.org/gemfile/) are
 preliminarily loaded.
 
 If `GROUP` is specified, all gems in the given group in the Gemfile in addition
@@ -36,4 +36,4 @@ the shell from the following:
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html)
+[Gemfile(5)](https://guides.rubygems.org/gemfile/)

data/bundler/lib/bundler/man/bundle-init.1

@@ -17,4 +17,4 @@ Use the specified name for the gemfile instead of \fBGemfile\fR
 .SH "FILES"
 Included in the default [\fBGemfile(5)\fR][Gemfile(5)] generated is the line \fB# frozen_string_literal: true\fR\. This is a magic comment supported for the first time in Ruby 2\.3\. The presence of this line results in all string literals in the file being implicitly frozen\.
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR

data/bundler/lib/bundler/man/bundle-init.1.ronn

@@ -29,4 +29,4 @@ results in all string literals in the file being implicitly frozen.
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html)
+[Gemfile(5)](https://guides.rubygems.org/gemfile/)

data/bundler/lib/bundler/man/bundle-lock.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-lock\fR \- Creates / Updates a lockfile without installing
 .SH "SYNOPSIS"
-\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative]
+\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative] [\-\-cooldown=NUMBER]
 .SH "DESCRIPTION"
 Lock the gems specified in Gemfile\.
 .SH "OPTIONS"
@@ -59,6 +59,9 @@ If updating, do not allow any gem to be updated past latest \-\-patch | \-\-mino
 .TP
 \fB\-\-conservative\fR
 If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated\.
+.TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
 .SH "UPDATING ALL GEMS"
 If you run \fBbundle lock\fR with \fB\-\-update\fR option without list of gems, bundler will ignore any previously installed gems and resolve all dependencies again based on the latest versions of all gems available in the sources\.
 .SH "UPDATING A LIST OF GEMS"

data/bundler/lib/bundler/man/bundle-lock.1.ronn

@@ -20,6 +20,7 @@ bundle-lock(1) -- Creates / Updates a lockfile without installing
               [--pre]
               [--strict]
               [--conservative]
+              [--cooldown=NUMBER]
 
 ## DESCRIPTION
 
@@ -84,6 +85,11 @@ Lock the gems specified in Gemfile.
 * `--conservative`:
   If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated.
 
+* `--cooldown=<number>`:
+  Only consider gem versions published at least <number> days ago when
+  resolving. Pass `0` to disable cooldown for this run, overriding any
+  per-source or global configuration. See `cooldown` in bundle-config(1).
+
 ## UPDATING ALL GEMS
 
 If you run `bundle lock` with `--update` option without list of gems, bundler will

data/bundler/lib/bundler/man/bundle-plugin.1

@@ -71,6 +71,6 @@ Describe subcommands or one specific subcommand\.
 No options\.
 .SH "SEE ALSO"
 .IP "\(bu" 4
-How to write a Bundler plugin \fIhttps://bundler\.io/guides/bundler_plugins\.html\fR
+How to write a Bundler plugin \fIhttps://guides\.rubygems\.org/bundler_plugins/\fR
 .IP "" 0
 

data/bundler/lib/bundler/man/bundle-plugin.1.ronn

@@ -81,4 +81,4 @@ No options.
 
 ## SEE ALSO
 
-* [How to write a Bundler plugin](https://bundler.io/guides/bundler_plugins.html)
+* [How to write a Bundler plugin](https://guides.rubygems.org/bundler_plugins/)

data/bundler/lib/bundler/man/bundle.1

@@ -8,7 +8,7 @@
 .SH "DESCRIPTION"
 Bundler manages an \fBapplication's dependencies\fR through its entire life across many machines systematically and repeatably\.
 .P
-See the bundler website \fIhttps://bundler\.io\fR for information on getting started, and Gemfile(5) for more information on the \fBGemfile\fR format\.
+See the RubyGems guides \fIhttps://guides\.rubygems\.org/\fR for information on getting started, and Gemfile(5) for more information on the \fBGemfile\fR format\.
 .SH "OPTIONS"
 .TP
 \fB\-\-no\-color\fR
@@ -54,6 +54,18 @@ Determine whether the requirements for your application are installed and availa
 \fBbundle show(1)\fR \fIbundle\-show\.1\.html\fR
 Show the source location of a particular gem in the bundle
 .TP
+\fBbundle info(1)\fR \fIbundle\-info\.1\.html\fR
+Show information for the given gem in your bundle
+.TP
+\fBbundle list(1)\fR \fIbundle\-list\.1\.html\fR
+List all the gems in the bundle
+.TP
+\fBbundle licenses(1)\fR \fIbundle\-licenses\.1\.html\fR
+Print the license of all gems in the bundle
+.TP
+\fBbundle fund(1)\fR \fIbundle\-fund\.1\.html\fR
+Lists information about gems seeking funding assistance
+.TP
 \fBbundle outdated(1)\fR \fIbundle\-outdated\.1\.html\fR
 Show all of the outdated gems in the current bundle
 .TP
@@ -78,9 +90,18 @@ Display platform compatibility information
 \fBbundle clean(1)\fR \fIbundle\-clean\.1\.html\fR
 Clean up unused gems in your Bundler directory
 .TP
+\fBbundle pristine(1)\fR \fIbundle\-pristine\.1\.html\fR
+Restores installed gems to their pristine condition
+.TP
 \fBbundle doctor(1)\fR \fIbundle\-doctor\.1\.html\fR
 Display warnings about common problems
 .TP
+\fBbundle env(1)\fR \fIbundle\-env\.1\.html\fR
+Print information about the environment Bundler is running under
+.TP
+\fBbundle issue(1)\fR \fIbundle\-issue\.1\.html\fR
+Get help reporting Bundler issues
+.TP
 \fBbundle remove(1)\fR \fIbundle\-remove\.1\.html\fR
 Removes gems from the Gemfile
 .TP

data/bundler/lib/bundler/man/bundle.1.ronn

@@ -10,7 +10,7 @@ bundle(1) -- Ruby Dependency Management
 Bundler manages an `application's dependencies` through its entire life
 across many machines systematically and repeatably.
 
-See [the bundler website](https://bundler.io) for information on getting
+See [the RubyGems guides](https://guides.rubygems.org/) for information on getting
 started, and Gemfile(5) for more information on the `Gemfile` format.
 
 ## OPTIONS
@@ -64,6 +64,18 @@ We divide `bundle` subcommands into primary commands and utilities:
 * [`bundle show(1)`](bundle-show.1.html):
   Show the source location of a particular gem in the bundle
 
+* [`bundle info(1)`](bundle-info.1.html):
+  Show information for the given gem in your bundle
+
+* [`bundle list(1)`](bundle-list.1.html):
+  List all the gems in the bundle
+
+* [`bundle licenses(1)`](bundle-licenses.1.html):
+  Print the license of all gems in the bundle
+
+* [`bundle fund(1)`](bundle-fund.1.html):
+  Lists information about gems seeking funding assistance
+
 * [`bundle outdated(1)`](bundle-outdated.1.html):
   Show all of the outdated gems in the current bundle
 
@@ -88,9 +100,18 @@ We divide `bundle` subcommands into primary commands and utilities:
 * [`bundle clean(1)`](bundle-clean.1.html):
   Clean up unused gems in your Bundler directory
 
+* [`bundle pristine(1)`](bundle-pristine.1.html):
+  Restores installed gems to their pristine condition
+
 * [`bundle doctor(1)`](bundle-doctor.1.html):
   Display warnings about common problems
 
+* [`bundle env(1)`](bundle-env.1.html):
+  Print information about the environment Bundler is running under
+
+* [`bundle issue(1)`](bundle-issue.1.html):
+  Get help reporting Bundler issues
+
 * [`bundle remove(1)`](bundle-remove.1.html):
   Removes gems from the Gemfile
 

data/bundler/lib/bundler/man/gemfile.5

@@ -107,6 +107,8 @@ gem "nokogiri", ">= 1\.4\.2"
 gem "RedCloth", ">= 4\.1\.0", "< 4\.2\.0"
 .fi
 .IP "" 0
+.P
+Most version specifiers, like \fB>= 1\.0\fR, are self\-explanatory\. The pessimistic specifier \fB~>\fR constrains both a lower and an upper bound: \fB~> 2\.0\.3\fR is identical to \fB>= 2\.0\.3\fR and \fB< 2\.1\fR, and \fB~> 2\.1\fR is identical to \fB>= 2\.1\fR and \fB< 3\.0\fR\. A pessimistic specifier with a prerelease component, like \fB~> 2\.2\.beta\fR, will match prerelease versions like \fB2\.2\.beta\.12\fR\. \fB~> 0\fR is identical to \fB>= 0\.0\fR and \fB< 1\.0\fR\.
 .SS "REQUIRE AS"
 Each \fIgem\fR \fBMAY\fR specify files that should be used when autorequiring via \fBBundler\.require\fR\. You may pass an array with multiple files or \fBtrue\fR if the file you want \fBrequired\fR has the same name as \fIgem\fR or \fBfalse\fR to prevent any file from being autorequired\.
 .IP "" 4
@@ -164,7 +166,7 @@ bundle config set \-\-local without development test
 .P
 Also, calling \fBBundler\.setup\fR with no parameters, or calling \fBrequire "bundler/setup"\fR will setup all groups except for the ones you excluded via \fB\-\-without\fR (since they are not available)\.
 .P
-Note that on \fBbundle install\fR, bundler downloads and evaluates all gems, in order to create a single canonical list of all of the required gems and their dependencies\. This means that you cannot list different versions of the same gems in different groups\. For more details, see Understanding Bundler \fIhttps://bundler\.io/rationale\.html\fR\.
+Note that on \fBbundle install\fR, bundler downloads and evaluates all gems, in order to create a single canonical list of all of the required gems and their dependencies\. This means that you cannot list different versions of the same gems in different groups\. For more details, see Dependency management \fIhttps://guides\.rubygems\.org/dependency_management/\fR\.
 .SS "PLATFORMS"
 If a gem should only be used in a particular platform or set of platforms, you can specify them\. Platforms are essentially identical to groups, except that you do not need to use the \fB\-\-without\fR install\-time flag to exclude groups of gems for other platforms\.
 .P
@@ -460,6 +462,15 @@ The \fBgemspec\fR method adds any runtime dependencies as gem requirements in th
 The \fBgemspec\fR method supports optional \fB:path\fR, \fB:glob\fR, \fB:name\fR, and \fB:development_group\fR options, which control where bundler looks for the \fB\.gemspec\fR, the glob it uses to look for the gemspec (defaults to: \fB{,*,*/*}\.gemspec\fR), what named \fB\.gemspec\fR it uses (if more than one is present), and which group development dependencies are included in\.
 .P
 When a \fBgemspec\fR dependency encounters version conflicts during resolution, the local version under development will always be selected \-\- even if there are remote versions that better match other requirements for the \fBgemspec\fR gem\.
+.SH "EVAL_GEMFILE"
+A Gemfile \fBMAY\fR be split across multiple files\. The \fBeval_gemfile\fR method reads the contents of another file as if they appeared in the current Gemfile\. A relative path is resolved against the directory of the file containing the call\.
+.IP "" 4
+.nf
+eval_gemfile "another\.gemfile"
+.fi
+.IP "" 0
+.P
+This can be useful to run tests against multiple combinations of dependencies, or to load per\-developer gems from an untracked gemfile\.
 .SH "SOURCE PRIORITY"
 When attempting to locate a gem to satisfy a gem requirement, bundler uses the following priority order:
 .IP "1." 4