rubygems-update 4.0.17 → 4.0.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6781781dd2ce13c49c2771fe518b3b13116d37285c607368a0e719e538aadd82
-  data.tar.gz: 0f6eb6c051bf17b55057b7c2e30027dd2119acf2dcabeaab6b70834f5d6a59c6
+  metadata.gz: fea8148baa9550b989b52e1b5a5bdd0331ce3f3658acd4e6a8655b4aca669d05
+  data.tar.gz: d6873bcf37f0e87a7c35663e446b5a907a833d469270fce61e06e5c384b26b64
 SHA512:
-  metadata.gz: c31326c1bcd80727a77f559b5d6c6c0b51ae74529d3c8b31a0768afe798ec906788ad1b91934e5b63770442822e71a8067dddebaa262327cee3ab2e8c71e8dd7
-  data.tar.gz: 184787705ecd74c6c19fe5382a4103ad69e5179672d5de14c5a84e88170ac97b3ad02c2432ba0f139b337a634a96b5d6b70f6431d757a6c4ab3fbc22702fcc4d
+  metadata.gz: 959ce199999beef457228f6ca8ef0d74f6cd19cb433fe5fdf21ec42961df13b81b98209a21bb2c6c298521b201cf2f64161be7efd5a3ac92d155a6c0c17876d0
+  data.tar.gz: eb602763996a439e8f8598b14c08ead139b527a814e11c9acdae89c4c1556ede07fed87cdde079509b124510f5f3844e394ef74e69e3a532c1900b271d684b14

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 4.0.19 / 2026-08-20
+
+### Enhancements:
+
+* Reject SafeMarshal collection lengths longer than the remaining input. Pull request [#9756](https://github.com/ruby/rubygems/pull/9756) by hsbt
+* Installs bundler 4.0.19 as a default gem.
+
+### Bug fixes:
+
+* Fix gem uninstall --user-install crash when GEM_HOME does not exist. Pull request [#9749](https://github.com/ruby/rubygems/pull/9749) by hsbt
+
+### Documentation:
+
+* Document SPDX license handling for license= and licenses=. Pull request [#9766](https://github.com/ruby/rubygems/pull/9766) by hsbt
+
+## 4.0.18 / 2026-08-05
+
+### Enhancements:
+
+* Check the resolved parent directory before extracting old format gems. Pull request [#9755](https://github.com/ruby/rubygems/pull/9755) by hsbt
+* Installs bundler 4.0.18 as a default gem.
+
+### Bug fixes:
+
+* Call Kernel.format explicitly in Gem::Deprecate wrapper. Pull request [#9714](https://github.com/ruby/rubygems/pull/9714) by hsbt
+
+### Documentation:
+
+* Point bundler.io URLs at guides.rubygems.org. Pull request [#9737](https://github.com/ruby/rubygems/pull/9737) by hsbt
+
 ## 4.0.17 / 2026-07-22
 
 ### Enhancements:

data/bundler/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 4.0.19 / 2026-08-20
+
+### Enhancements:
+
+* Validate the platform field in Gem::Installer#verify_spec. Pull request [#9780](https://github.com/ruby/rubygems/pull/9780) by hsbt
+* Restrict UserDefined handling to explicit class set for Gem::SafeMashal. Pull request [#9770](https://github.com/ruby/rubygems/pull/9770) by jackorp
+* Filter git command output against the configured URI. Pull request [#9778](https://github.com/ruby/rubygems/pull/9778) by hsbt
+* Summarize cooldown-skipped versions at the end of install, update, and lock. Pull request [#9762](https://github.com/ruby/rubygems/pull/9762) by hsbt
+
+### Bug fixes:
+
+* Make repeated bundle lock options accumulate. Pull request [#9748](https://github.com/ruby/rubygems/pull/9748) by hsbt
+* Fail instead of warning when frozen mode can't update the lockfile. Pull request [#9750](https://github.com/ruby/rubygems/pull/9750) by hsbt
+* Fix wrong $LOAD_PATH for gems installed in the same process. Pull request [#9784](https://github.com/ruby/rubygems/pull/9784) by hsbt
+
+### Documentation:
+
+* Fix auto-clean default version in bundle config docs. Pull request [#9783](https://github.com/ruby/rubygems/pull/9783) by hsbt
+* Correct Bundler 5 default path documentation. Pull request [#9771](https://github.com/ruby/rubygems/pull/9771) by alloutflo
+
+## 4.0.18 / 2026-08-05
+
+### Enhancements:
+
+* Don't mask install errors when no Gemfile can be located. Pull request [#9757](https://github.com/ruby/rubygems/pull/9757) by hsbt
+* Warn when duplicate source declarations conflict on cooldown. Pull request [#9736](https://github.com/ruby/rubygems/pull/9736) by hsbt
+* Redact URI userinfo from settings names in Bundler User-Agent. Pull request [#9716](https://github.com/ruby/rubygems/pull/9716) by hsbt
+* Validate gem name before building compact index cache paths. Pull request [#9717](https://github.com/ruby/rubygems/pull/9717) by hsbt
+
+### Bug fixes:
+
+* Fail `bundle check` when frozen mode needs lockfile changes. Pull request [#9715](https://github.com/ruby/rubygems/pull/9715) by hsbt
+* Skip empty checksum values in compact index metadata. Pull request [#9713](https://github.com/ruby/rubygems/pull/9713) by hsbt
+
+### Security:
+
+* Add --cooldown flag to bundle lock and bundle cache. Pull request [#9725](https://github.com/ruby/rubygems/pull/9725) by hsbt
+
+### Documentation:
+
+* Point bundler.io URLs at guides.rubygems.org. Pull request [#9737](https://github.com/ruby/rubygems/pull/9737) by hsbt
+* Document Bundler checksum behavior for default gems. Pull request [#9735](https://github.com/ruby/rubygems/pull/9735) by p-linnane
+* List missing subcommands in bundle(1) UTILITIES section. Pull request [#9721](https://github.com/ruby/rubygems/pull/9721) by hsbt
+* Document pessimistic operator and eval_gemfile in gemfile(5). Pull request [#9719](https://github.com/ruby/rubygems/pull/9719) by hsbt
+
 ## 4.0.17 / 2026-07-22
 
 ### Enhancements:

data/bundler/lib/bundler/build_metadata.rb

@@ -5,7 +5,7 @@ module Bundler
   module BuildMetadata
     # begin ivars
     @built_at = nil
-    @git_commit_sha = "f80cbc4c44".freeze
+    @git_commit_sha = "2d0e3df43a".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/bundler/lib/bundler/cli/check.rb

@@ -12,6 +12,7 @@ module Bundler
       Bundler.settings.set_command_option_if_given :path, options[:path]
 
       definition = Bundler.definition
+      definition.ensure_equivalent_gemfile_and_lockfile
       definition.validate_runtime!
 
       begin
@@ -28,9 +29,6 @@ module Bundler
         not_installed.each {|s| Bundler.ui.error " * #{s.name} (#{s.version})" }
         Bundler.ui.warn "Install missing gems with `bundle install`"
         exit 1
-      elsif !Bundler.default_lockfile.file? && Bundler.frozen_bundle?
-        Bundler.ui.error "This bundle has been frozen, but there is no #{SharedHelpers.relative_lockfile_path} present"
-        exit 1
       else
         definition.lock(true) unless options[:"dry-run"]
         Bundler.ui.info "The Gemfile's dependencies are satisfied"

data/bundler/lib/bundler/cli/common.rb

@@ -20,6 +20,17 @@ module Bundler
       Bundler.ui.info msg
     end
 
+    def self.output_cooldown_skipped_summary(definition = Bundler.definition)
+      skipped = definition.cooldown_skipped
+      return if skipped.empty?
+
+      Bundler.ui.info "The following gem versions were skipped by the cooldown setting:"
+      skipped.each do |entry|
+        days = entry[:available_in_days]
+        Bundler.ui.info "  * #{entry[:name]} #{entry[:version]} (available in #{days} #{days == 1 ? "day" : "days"}), resolved #{entry[:resolved]} instead"
+      end
+    end
+
     def self.output_fund_metadata_summary
       return if Bundler.settings["ignore_funding_requests"]
       definition = Bundler.definition

data/bundler/lib/bundler/cli/install.rb

@@ -64,6 +64,7 @@ module Bundler
       end
 
       Bundler::CLI::Common.output_post_install_messages installer.post_install_messages
+      Bundler::CLI::Common.output_cooldown_skipped_summary(definition)
 
       if CLI::Common.clean_after_install?
         require_relative "clean"

data/bundler/lib/bundler/cli/issue.rb

@@ -13,10 +13,10 @@ module Bundler
         https://github.com/ruby/rubygems/blob/master/doc/bundler/TROUBLESHOOTING.md
 
         2. Instructions for common Bundler uses can be found on the documentation
-        site: https://bundler.io/
+        site: https://guides.rubygems.org/
 
         3. Information about each Bundler command can be found in the Bundler
-        man pages: https://bundler.io/man/bundle.1.html
+        man pages: https://guides.rubygems.org/command-reference/bundle/
 
         Hopefully the troubleshooting steps above resolved your problem!  If things
         still aren't working the way you expect them to, please let us know so

data/bundler/lib/bundler/cli/lock.rb

@@ -16,6 +16,9 @@ module Bundler
 
       check_for_conflicting_options
 
+      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
+      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+
       print = options[:print]
       previous_output_stream = Bundler.ui.output_stream
       Bundler.ui.output_stream = :stderr if print
@@ -23,6 +26,9 @@ module Bundler
       Bundler::Fetcher.disable_endpoint = options["full-index"]
 
       update = options[:update]
+      # --update is repeatable, so it parses as an array with one entry per
+      # occurrence, where a bare `--update` produces a `true` entry
+      update = update.include?(true) ? true : update.flatten if update.is_a?(Array)
       conservative = options[:conservative]
       bundler = options[:bundler]
 
@@ -41,12 +47,12 @@ module Bundler
 
         Bundler::CLI::Common.configure_gem_version_promoter(definition, options) if options[:update]
 
-        options["remove-platform"].each do |platform_string|
+        options["remove-platform"].flatten.each do |platform_string|
           platform = Gem::Platform.new(platform_string)
           definition.remove_platform(platform)
         end
 
-        options["add-platform"].each do |platform_string|
+        options["add-platform"].flatten.each do |platform_string|
           platform = Gem::Platform.new(platform_string)
           if platform.to_s == "unknown"
             Bundler.ui.error "The platform `#{platform_string}` is unknown to RubyGems and can't be added to the lockfile."
@@ -74,6 +80,8 @@ module Bundler
           puts "Writing lockfile to #{file}"
           definition.write_lock(file, false)
         end
+
+        Bundler::CLI::Common.output_cooldown_skipped_summary(definition)
       end
 
       Bundler.ui.output_stream = previous_output_stream

data/bundler/lib/bundler/cli/update.rb

@@ -118,6 +118,7 @@ module Bundler
       Bundler.ui.confirm "Bundle updated!"
       Bundler::CLI::Common.output_without_groups_message(:update)
       Bundler::CLI::Common.output_post_install_messages installer.post_install_messages
+      Bundler::CLI::Common.output_cooldown_skipped_summary
 
       Bundler::CLI::Common.output_fund_metadata_summary
     end

data/bundler/lib/bundler/cli.rb

@@ -461,6 +461,7 @@ module Bundler
     method_option "path", type: :string, banner: "Specify a different path than the system default, namely, $BUNDLE_PATH or $GEM_HOME (removed)."
     method_option "quiet", type: :boolean, banner: "Only output warnings and errors."
     method_option "frozen", type: :boolean, banner: "Do not allow the Gemfile.lock to be updated after this bundle cache operation's install (removed)"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     long_desc <<-D
       The cache command will copy the .gem files for every gem in the bundle into the
       directory ./vendor/cache. If you then check that directory into your source
@@ -625,15 +626,15 @@ module Bundler
     end
 
     desc "lock", "Creates a lockfile without installing"
-    method_option "update", type: :array, lazy_default: true, banner: "ignore the existing lockfile, update all gems by default, or update list of given gems"
+    method_option "update", type: :array, lazy_default: true, repeatable: true, banner: "ignore the existing lockfile, update all gems by default, or update list of given gems"
     method_option "local", type: :boolean, default: false, banner: "do not attempt to fetch remote gemspecs and use the local gem cache only"
     method_option "print", type: :boolean, default: false, banner: "print the lockfile to STDOUT instead of writing to the file system"
     method_option "gemfile", type: :string, banner: "Use the specified gemfile instead of Gemfile"
     method_option "lockfile", type: :string, default: nil, banner: "the path the lockfile should be written to"
     method_option "full-index", type: :boolean, default: false, banner: "Fall back to using the single-file index of all gems"
     method_option "add-checksums", type: :boolean, default: false, banner: "Adds checksums to the lockfile"
-    method_option "add-platform", type: :array, default: [], banner: "Add a new platform to the lockfile"
-    method_option "remove-platform", type: :array, default: [], banner: "Remove a platform from the lockfile"
+    method_option "add-platform", type: :array, default: [], repeatable: true, banner: "Add a new platform to the lockfile"
+    method_option "remove-platform", type: :array, default: [], repeatable: true, banner: "Remove a platform from the lockfile"
     method_option "normalize-platforms", type: :boolean, default: false, banner: "Normalize lockfile platforms"
     method_option "patch", type: :boolean, banner: "If updating, prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "If updating, prefer updating only to next minor version"
@@ -642,6 +643,7 @@ module Bundler
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
     method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"
       Lock.new(options).run

data/bundler/lib/bundler/compact_index_client/cache.rb

@@ -50,6 +50,7 @@ module Bundler
 
       def info_path(name)
         name = name.to_s
+        validate_name!(name)
         # TODO: converge this into the info_root by hashing all filenames like info_etag_path
         if /[^a-z0-9_-]/.match?(name)
           name += "-#{SharedHelpers.digest(:MD5).hexdigest(name).downcase}"
@@ -61,9 +62,19 @@ module Bundler
 
       def info_etag_path(name)
         name = name.to_s
+        validate_name!(name)
         @info_etag_root.join("#{name}-#{SharedHelpers.digest(:MD5).hexdigest(name).downcase}")
       end
 
+      # Gem names come from the remote index and are not otherwise
+      # validated, so refuse anything that would escape the cache
+      # directory when used as a path component.
+      def validate_name!(name)
+        return if File.basename(name) == name
+
+        raise SecurityError, "malformed gem name: #{name.inspect}"
+      end
+
       def mkdir(name)
         directory.join(name).tap do |dir|
           SharedHelpers.filesystem_access(dir) do

data/bundler/lib/bundler/definition.rb

@@ -366,6 +366,12 @@ module Bundler
       sources.git_sources.filter_map {|s| File.realpath(s.path) if File.exist?(s.path) }
     end
 
+    # Versions excluded by cooldown during the last resolution, one entry per
+    # gem with the newest skipped version. Empty when no resolution ran.
+    def cooldown_skipped
+      @cooldown_skipped || []
+    end
+
     def groups
       dependencies.flat_map(&:groups).uniq
     end
@@ -404,7 +410,7 @@ module Bundler
         updating_major = locked_major < current_major
       end
 
-      preserve_unknown_sections ||= !updating_major && (Bundler.frozen_bundle? || !(unlocking? || @unlocking_bundler))
+      preserve_unknown_sections ||= Bundler.frozen_bundle? || (!updating_major && !(unlocking? || @unlocking_bundler))
 
       if File.exist?(file) && lockfiles_equal?(@lockfile_contents, contents, preserve_unknown_sections)
         return if Bundler.frozen_bundle?
@@ -413,8 +419,10 @@ module Bundler
       end
 
       if Bundler.frozen_bundle?
-        Bundler.ui.error "Cannot write a changed lockfile while frozen."
-        return
+        msg = lockfile_changes_summary("frozen mode is set") ||
+              "Your lockfile needs to be updated, but it can't be because frozen mode is set.\n\n" \
+              "Run `bundle install` elsewhere and add the updated #{SharedHelpers.relative_lockfile_path} to version control."
+        raise ProductionError, msg
       end
 
       # Convert to \r\n if the existing lock has them, i.e., Windows with
@@ -770,6 +778,8 @@ module Bundler
 
       result = SpecSet.new(resolver.start)
 
+      @cooldown_skipped = resolver.cooldown_skipped
+
       @resolved_bundler_version = result.find {|spec| spec.name == "bundler" }&.version
 
       @new_platforms.each do |platform|

data/bundler/lib/bundler/endpoint_specification.rb

@@ -50,6 +50,19 @@ module Bundler
       end
     end
 
+    # `require_paths` is overridden above, but `full_require_paths` (and so
+    # `load_paths`) is computed from `raw_require_paths`, which would otherwise
+    # report the default `lib` for every gem
+    def raw_require_paths
+      if @remote_specification
+        @remote_specification.raw_require_paths
+      elsif _local_specification
+        _local_specification.raw_require_paths
+      else
+        super
+      end
+    end
+
     # needed for inline
     def load_paths
       # remote specs aren't installed, and can't have load_paths
@@ -153,8 +166,13 @@ module Bundler
         next unless v
         case k.to_s
         when "checksum"
+          # Some registries send empty checksum values, treat them as if the
+          # checksum was not included at all
+          checksum = v.last
+          next unless checksum
+
           begin
-            @checksum = Checksum.from_api(v.last, @spec_fetcher.uri)
+            @checksum = Checksum.from_api(checksum, @spec_fetcher.uri)
           rescue ArgumentError => e
             raise ArgumentError, "Invalid checksum for #{full_name}: #{e.message}"
           end

data/bundler/lib/bundler/fetcher.rb

@@ -215,7 +215,13 @@ module Bundler
           agent << " #{ruby.engine}/#{ruby.versions_string(engine_version)}"
         end
 
-        agent << " options/#{Bundler.settings.all.join(",")}"
+        # Some settings keys embed a URI (e.g. `mirror.<uri>`) whose userinfo can
+        # carry credentials. Strip the userinfo before advertising the setting
+        # names so we don't leak secrets to every gem source we talk to.
+        options = Bundler.settings.all.map do |key|
+          key.include?("://") ? key.gsub(%r{//[^/@]+@}, "//") : key
+        end
+        agent << " options/#{options.join(",")}"
 
         agent << " ci/#{cis.join(",")}" if cis.any?
 

data/bundler/lib/bundler/installer/parallel_installer.rb

@@ -255,7 +255,15 @@ module Bundler
 
     def require_tree_for_spec(spec)
       tree = @spec_set.what_required(spec)
-      t = String.new("In #{File.basename(SharedHelpers.default_gemfile)}:\n")
+      gemfile_name = begin
+        File.basename(SharedHelpers.default_gemfile)
+      rescue GemfileNotFound
+        # This runs while reporting an install error. When no Gemfile can be
+        # located (e.g. Bundler used as a library), raising here would mask
+        # the original error, so fall back to a generic header instead.
+        "Gemfile"
+      end
+      t = String.new("In #{gemfile_name}:\n")
       tree.each_with_index do |s, depth|
         t << "  " * depth.succ << s.name
         unless tree.last == s

data/bundler/lib/bundler/installer.rb

@@ -83,6 +83,12 @@ module Bundler
         install(options)
 
         Gem::Specification.reset # invalidate gem specification cache so that installed gems are immediately available
+        # Drop the source caches too, since releasing resolution memory dropped
+        # the source indexes. A resolution happening after this point would
+        # otherwise rebuild them around a snapshot of installed gems taken
+        # before the install, and materialize against remote specs that don't
+        # know where the gems they stand for ended up.
+        @definition.sources.clear_cache
 
         lock
         Standalone.new(options[:standalone], @definition).generate if options[:standalone]

data/bundler/lib/bundler/lockfile_generator.rb

@@ -103,6 +103,11 @@ module Bundler
     end
 
     def bundler_checksum
+      # In frozen mode the lockfile can't change, so reproduce whatever bundler
+      # entry is already locked instead of recording one for the running bundler
+      # version, which may legitimately differ from the locked one.
+      return locked_bundler_checksum if Bundler.frozen_bundle?
+
       # `.dev` versions and `SKIP_BUNDLER_CHECKSUM` are deliberate opt-outs (used
       # by Bundler/RubyGems' own development and release tasks): never record a
       # checksum for Bundler itself in those cases.
@@ -138,5 +143,16 @@ module Bundler
 
       locked_gems.bundler_version != definition.bundler_version_to_lock
     end
+
+    def locked_bundler_checksum
+      locked_version = definition.locked_gems&.bundler_version
+      return [] unless locked_version
+
+      metadata_source = definition.sources.metadata_source
+      locked_spec = LazySpecification.new("bundler", locked_version, Gem::Platform::RUBY, metadata_source)
+      return [] if metadata_source.checksum_store.missing?(locked_spec)
+
+      [metadata_source.checksum_store.to_lock(locked_spec)]
+    end
   end
 end

data/bundler/lib/bundler/man/bundle-add.1

@@ -76,4 +76,4 @@ You can assign the gem to more than one group\.
 \fBbundle add rails \-\-group "development, test"\fR
 .IP "" 0
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR, bundle\-remove(1) \fIbundle\-remove\.1\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR, bundle\-remove(1) \fIbundle\-remove\.1\.html\fR

data/bundler/lib/bundler/man/bundle-add.1.ronn

@@ -88,5 +88,5 @@ Adds the named gem to the [`Gemfile(5)`][Gemfile(5)] and run `bundle install`.
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html),
+[Gemfile(5)](https://guides.rubygems.org/gemfile/),
 [bundle-remove(1)](bundle-remove.1.html)

data/bundler/lib/bundler/man/bundle-cache.1

@@ -17,6 +17,9 @@ Include gems for all platforms present in the lockfile, not only the current one
 \fB\-\-cache\-path=CACHE\-PATH\fR
 Specify a different cache path than the default (vendor/cache)\.
 .TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving before caching\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
+.TP
 \fB\-\-gemfile=GEMFILE\fR
 Use the specified gemfile instead of Gemfile\.
 .TP

data/bundler/lib/bundler/man/bundle-cache.1.ronn

@@ -21,6 +21,12 @@ use the gems in the cache in preference to the ones on `rubygems.org`.
 * `--cache-path=CACHE-PATH`:
   Specify a different cache path than the default (vendor/cache).
 
+* `--cooldown=<number>`:
+  Only consider gem versions published at least <number> days ago when
+  resolving before caching. Pass `0` to disable cooldown for this run,
+  overriding any per-source or global configuration. See `cooldown` in
+  bundle-config(1).
+
 * `--gemfile=GEMFILE`:
   Use the specified gemfile instead of Gemfile.
 

data/bundler/lib/bundler/man/bundle-config.1

@@ -82,7 +82,7 @@ The following is a list of all configuration keys and their purpose\. You can le
 .IP "\(bu" 4
 \fBcache_path\fR (\fBBUNDLE_CACHE_PATH\fR): The directory that bundler will place cached gems in when running \fBbundle package\fR, and that bundler will look in when installing gems\. Defaults to \fBvendor/cache\fR\.
 .IP "\(bu" 4
-\fBclean\fR (\fBBUNDLE_CLEAN\fR): Whether Bundler should run \fBbundle clean\fR automatically after \fBbundle install\fR\. Defaults to \fBtrue\fR in Bundler 4, as long as \fBpath\fR is not explicitly configured\.
+\fBclean\fR (\fBBUNDLE_CLEAN\fR): Whether Bundler should run \fBbundle clean\fR automatically after \fBbundle install\fR\. Defaults to \fBtrue\fR in Bundler 5, as long as \fBpath\fR is not explicitly configured\.
 .IP "\(bu" 4
 \fBconsole\fR (\fBBUNDLE_CONSOLE\fR): The console that \fBbundle console\fR starts\. Defaults to \fBirb\fR\.
 .IP "\(bu" 4
@@ -139,7 +139,7 @@ Cooldown filtering depends on the gem server providing a per\-version \fBcreated
 .IP "\(bu" 4
 \fBlockfile\fR (\fBBUNDLE_LOCKFILE\fR): The path to the lockfile that bundler should use\. By default, Bundler adds \fB\.lock\fR to the end of the \fBgemfile\fR entry\. Can be set to \fBfalse\fR in the Gemfile to disable lockfile creation entirely (see gemfile(5))\.
 .IP "\(bu" 4
-\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\.
+\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\. Bundler's own checksum is only included when its \fB\.gem\fR file is cached, which may not be the case when Bundler is installed as a default gem\.
 .IP "\(bu" 4
 \fBno_install\fR (\fBBUNDLE_NO_INSTALL\fR): Whether \fBbundle package\fR should skip installing gems\.
 .IP "\(bu" 4
@@ -147,7 +147,7 @@ Cooldown filtering depends on the gem server providing a per\-version \fBcreated
 .IP "\(bu" 4
 \fBonly\fR (\fBBUNDLE_ONLY\fR): A space\-separated list of groups to install only gems of the specified groups\. Please check carefully if you want to install also gems without a group, because they get put inside \fBdefault\fR group\. For example \fBonly test:default\fR will install all gems specified in test group and without one\.
 .IP "\(bu" 4
-\fBpath\fR (\fBBUNDLE_PATH\fR): The location on disk where all gems in your bundle will be located regardless of \fB$GEM_HOME\fR or \fB$GEM_PATH\fR values\. Bundle gems not found in this location will be installed by \fBbundle install\fR\. When not set, Bundler install by default to a \fB\.bundle\fR directory relative to repository root in Bundler 4, and to the default system path (\fBGem\.dir\fR) before Bundler 4\. That means that before Bundler 4, Bundler shares this location with Rubygems, and \fBgem install \|\.\|\.\|\.\fR will have gems installed in the same location and therefore, gems installed without \fBpath\fR set will show up by calling \fBgem list\fR\. This will not be the case in Bundler 4\.
+\fBpath\fR (\fBBUNDLE_PATH\fR): The location on disk where all gems in your bundle will be located regardless of \fB$GEM_HOME\fR or \fB$GEM_PATH\fR values\. Bundle gems not found in this location will be installed by \fBbundle install\fR\. When not set, Bundler install by default to a \fB\.bundle\fR directory relative to repository root in Bundler 5, and to the default system path (\fBGem\.dir\fR) before Bundler 5\. That means that before Bundler 5, Bundler shares this location with Rubygems, and \fBgem install \|\.\|\.\|\.\fR will have gems installed in the same location and therefore, gems installed without \fBpath\fR set will show up by calling \fBgem list\fR\. This will not be the case in Bundler 5\.
 .IP "\(bu" 4
 \fBpath\.system\fR (\fBBUNDLE_PATH__SYSTEM\fR): Whether Bundler will install gems into the default system path (\fBGem\.dir\fR)\.
 .IP "\(bu" 4

data/bundler/lib/bundler/man/bundle-config.1.ronn

@@ -133,7 +133,7 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
    Defaults to `vendor/cache`.
 * `clean` (`BUNDLE_CLEAN`):
    Whether Bundler should run `bundle clean` automatically after
-   `bundle install`. Defaults to `true` in Bundler 4, as long as `path` is not
+   `bundle install`. Defaults to `true` in Bundler 5, as long as `path` is not
    explicitly configured.
 * `console` (`BUNDLE_CONSOLE`):
    The console that `bundle console` starts. Defaults to `irb`.
@@ -230,6 +230,8 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
    Gemfile to disable lockfile creation entirely (see gemfile(5)).
 * `lockfile_checksums` (`BUNDLE_LOCKFILE_CHECKSUMS`):
    Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources. Defaults to true.
+   Bundler's own checksum is only included when its `.gem` file is cached, which
+   may not be the case when Bundler is installed as a default gem.
 * `no_install` (`BUNDLE_NO_INSTALL`):
    Whether `bundle package` should skip installing gems.
 * `no_prune` (`BUNDLE_NO_PRUNE`):
@@ -243,12 +245,12 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
    The location on disk where all gems in your bundle will be located regardless
    of `$GEM_HOME` or `$GEM_PATH` values. Bundle gems not found in this location
    will be installed by `bundle install`. When not set, Bundler install by
-   default to a `.bundle` directory relative to repository root in Bundler 4,
-   and to the default system path (`Gem.dir`) before Bundler 4. That means that
-   before Bundler 4, Bundler shares this location with Rubygems, and `gem
+   default to a `.bundle` directory relative to repository root in Bundler 5,
+   and to the default system path (`Gem.dir`) before Bundler 5. That means that
+   before Bundler 5, Bundler shares this location with Rubygems, and `gem
    install ...` will have gems installed in the same location and therefore,
    gems installed without `path` set will show up by calling `gem list`. This
-   will not be the case in Bundler 4.
+   will not be the case in Bundler 5.
 * `path.system` (`BUNDLE_PATH__SYSTEM`):
    Whether Bundler will install gems into the default system path (`Gem.dir`).
 * `plugins` (`BUNDLE_PLUGINS`):

data/bundler/lib/bundler/man/bundle-console.1

@@ -8,7 +8,7 @@
 .SH "DESCRIPTION"
 Starts an interactive Ruby console session in the context of the current bundle\.
 .P
-If no \fBGROUP\fR is specified, all gems in the \fBdefault\fR group in the Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR are preliminarily loaded\.
+If no \fBGROUP\fR is specified, all gems in the \fBdefault\fR group in the Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR are preliminarily loaded\.
 .P
 If \fBGROUP\fR is specified, all gems in the given group in the Gemfile in addition to the gems in \fBdefault\fR group are loaded\. Even if the given group does not exist in the Gemfile, IRB console starts without any warning or error\.
 .P
@@ -30,4 +30,4 @@ Resolving dependencies\|\.\|\.\|\.
 [1] pry(main)>
 .fi
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR

data/bundler/lib/bundler/man/bundle-console.1.ronn

@@ -9,7 +9,7 @@ bundle-console(1) -- Open an IRB session with the bundle pre-loaded
 
 Starts an interactive Ruby console session in the context of the current bundle.
 
-If no `GROUP` is specified, all gems in the `default` group in the [Gemfile(5)](https://bundler.io/man/gemfile.5.html) are
+If no `GROUP` is specified, all gems in the `default` group in the [Gemfile(5)](https://guides.rubygems.org/gemfile/) are
 preliminarily loaded.
 
 If `GROUP` is specified, all gems in the given group in the Gemfile in addition
@@ -36,4 +36,4 @@ the shell from the following:
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html)
+[Gemfile(5)](https://guides.rubygems.org/gemfile/)

data/bundler/lib/bundler/man/bundle-init.1

@@ -17,4 +17,4 @@ Use the specified name for the gemfile instead of \fBGemfile\fR
 .SH "FILES"
 Included in the default [\fBGemfile(5)\fR][Gemfile(5)] generated is the line \fB# frozen_string_literal: true\fR\. This is a magic comment supported for the first time in Ruby 2\.3\. The presence of this line results in all string literals in the file being implicitly frozen\.
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR

data/bundler/lib/bundler/man/bundle-init.1.ronn

@@ -29,4 +29,4 @@ results in all string literals in the file being implicitly frozen.
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html)
+[Gemfile(5)](https://guides.rubygems.org/gemfile/)

data/bundler/lib/bundler/man/bundle-lock.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-lock\fR \- Creates / Updates a lockfile without installing
 .SH "SYNOPSIS"
-\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative]
+\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative] [\-\-cooldown=NUMBER]
 .SH "DESCRIPTION"
 Lock the gems specified in Gemfile\.
 .SH "OPTIONS"
@@ -59,6 +59,9 @@ If updating, do not allow any gem to be updated past latest \-\-patch | \-\-mino
 .TP
 \fB\-\-conservative\fR
 If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated\.
+.TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
 .SH "UPDATING ALL GEMS"
 If you run \fBbundle lock\fR with \fB\-\-update\fR option without list of gems, bundler will ignore any previously installed gems and resolve all dependencies again based on the latest versions of all gems available in the sources\.
 .SH "UPDATING A LIST OF GEMS"