rubygems-update 4.0.21 → 4.0.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2ba10366f24f2128455224d595b4f144427d183daa7e729fa030baa5145abdf
-  data.tar.gz: 4e918f6f931c6979330094869a027604f951c0848a66e2677e2fdd5fec8e6453
+  metadata.gz: 749ce900ad671da4cc10f224bc056fd01abb570ad1ea631796dad9f33025b538
+  data.tar.gz: 71a19e66013da25a69f73e12f96251f8615463e9f805fbd4be14003ff7f2395a
 SHA512:
-  metadata.gz: f4a911ffd341da70726247e72f242d4c9f8eb2ca4dfe366b0b60628e26f497505ad1e497516c4e1d472a04fd19bf5d67a8a83ad38f9a89b48bf8eca82df077c6
-  data.tar.gz: 02f63cf60c57dfceb1e49ef7997273d23ffe449de39ade9c2b85f81803e1ed5e092d99fc98569943d8b9c794a60360f9ff3027dda3a055ecc8f78dd380446421
+  metadata.gz: 0e2f312ea9515fbabdd056db9d9233f8557243c4060cb8ebb15e1394c55624b6d23eaadfd40a512baca8ea70ec1dd1c5e521744d532ce3ef3c256d7e133356ed
+  data.tar.gz: d961561440e32ad0f6768f2db8a2a73a098df218219c13b3d66dd3b7c013fb7c75fe71ffb8a9ecd52901525e239ef92fb28a897ea317ef337034525029afa070

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 4.0.22 / 2026-09-30
+
+### Enhancements:
+
+* Add --source option to gem exec command. Pull request [#9765](https://github.com/ruby/rubygems/pull/9765) by Akshay Birajdar and Akshay Birajdar
+* Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
+* Validate the version field in Gem::Installer#verify_spec. Pull request [#9890](https://github.com/ruby/rubygems/pull/9890) by Hiroshi SHIBATA
+* Installs bundler 4.0.22 as a default gem.
+
+### Bug fixes:
+
+* Remove the build_info file on uninstall and stop gem build from logging unknown extensions. Pull request [#9894](https://github.com/ruby/rubygems/pull/9894) by Hiroshi SHIBATA
+
 ## 4.0.21 / 2026-09-16
 
 ### Enhancements:

data/bundler/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 4.0.22 / 2026-09-30
+
+### Enhancements:
+
+* Report the effective platform in `bundle platform`. Pull request [#9898](https://github.com/ruby/rubygems/pull/9898) by Islam Elsayed
+* Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
+* Update Magnus version in Rust extension gem template. Pull request [#9904](https://github.com/ruby/rubygems/pull/9904) by Mat Sadler and Hiroshi SHIBATA
+
+### Bug fixes:
+
+* Stop `Bundler.bin_path` creating the directory it reports. Pull request [#9887](https://github.com/ruby/rubygems/pull/9887) by Islam Elsayed and Hiroshi SHIBATA
+* Look up `bundler-<command>` executables only in PATH. Pull request [#9874](https://github.com/ruby/rubygems/pull/9874) by Hiroshi SHIBATA
+
+### Documentation:
+
+* Describe `--major` as preferring the latest major version. Pull request [#9891](https://github.com/ruby/rubygems/pull/9891) by Hiroshi SHIBATA
+
 ## 4.0.21 / 2026-09-16
 
 ### Enhancements:

data/bundler/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-09-16".freeze
-    @git_commit_sha = "a15d54ed692".freeze
+    @built_at = "2026-09-30".freeze
+    @git_commit_sha = "ff2bd50".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/bundler/lib/bundler/cli/platform.rb

@@ -25,7 +25,7 @@ module Bundler
       else
         platforms = Bundler.definition.platforms.map {|p| "* #{p}" }
 
-        output << "Your platform is: #{Gem::Platform.local}"
+        output << platform_info
         output << "Your app has gems that work on these platforms:\n#{platforms.join("\n")}"
 
         if ruby_version
@@ -44,5 +44,19 @@ module Bundler
 
       Bundler.ui.info output.join("\n\n")
     end
+
+    private
+
+    def platform_info
+      info = "Your platform is: #{Gem::Platform.local}"
+      return info if Bundler.local_platform == Gem::Platform.local
+
+      info + "\nHowever, your effective platform is: #{Bundler.local_platform} " \
+        "(because force_ruby_platform is #{force_ruby_platform_origin})"
+    end
+
+    def force_ruby_platform_origin
+      Bundler.settings.pretty_values_for(:force_ruby_platform).first.sub(/\ASet /, "set ")
+    end
   end
 end

data/bundler/lib/bundler/cli.rb

@@ -177,7 +177,7 @@ module Bundler
         else
           puts File.read("#{man_path}/#{File.basename(man_page)}.ronn")
         end
-      elsif command_path = Bundler.which("bundler-#{cli}")
+      elsif command_path = self.class.bundler_command_path(cli)
         Kernel.exec(command_path, "--help")
       else
         super
@@ -189,11 +189,23 @@ module Bundler
         return Bundler::Plugin.exec_command(command, ARGV[1..-1])
       end
 
-      return super unless command_path = Bundler.which("bundler-#{command}")
+      return super unless command_path = bundler_command_path(command)
 
       Kernel.exec(command_path, *ARGV[1..-1])
     end
 
+    # Only PATH is searched, unlike Bundler.which, which also finds a file in
+    # the current directory and returns a bare name that Kernel.exec cannot run.
+    def self.bundler_command_path(command)
+      ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |path|
+        path = path[1..-2] if path.start_with?('"') && path.end_with?('"')
+        command_path = Bundler.find_executable(File.expand_path("bundler-#{command}", path))
+        return command_path if command_path
+      end
+
+      nil
+    end
+
     desc "init [OPTIONS]", "Generates a Gemfile into the current working directory"
     long_desc <<-D
       Init generates a default Gemfile in the current working directory. When adding a
@@ -320,7 +332,7 @@ module Bundler
     method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "Always choose the highest allowed version when updating gems, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "Do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "Use bundle install conservative update behavior and do not allow shared dependencies to be updated."
@@ -431,7 +443,7 @@ module Bundler
     method_option "filter-strict", type: :boolean, aliases: "--strict", banner: "Only list newer versions allowed by your Gemfile requirements"
     method_option "update-strict", type: :boolean, banner: "Strict conservative resolution, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "filter-major", type: :boolean, banner: "Only list major newer versions"
     method_option "filter-minor", type: :boolean, banner: "Only list minor newer versions"
@@ -638,7 +650,7 @@ module Bundler
     method_option "normalize-platforms", type: :boolean, default: false, banner: "Normalize lockfile platforms"
     method_option "patch", type: :boolean, banner: "If updating, prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "If updating, prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "If updating, prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "If updating, prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "If updating, always choose the highest allowed version, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"

data/bundler/lib/bundler/fetcher/downloader.rb

@@ -51,7 +51,7 @@ module Bundler
           if https?(uri) && !https?(new_uri)
             raise HTTPError, "Redirecting to a non-https URI is not allowed: #{URICredentialsFilter.credential_filtered_uri(new_uri)}"
           end
-          if new_uri.host == uri.host
+          if [new_uri.scheme, new_uri.host, new_uri.port] == [uri.scheme, uri.host, uri.port]
             new_uri.user = uri.user
             new_uri.password = uri.password
           end

data/bundler/lib/bundler/installer.rb

@@ -127,6 +127,8 @@ module Bundler
       template_path = File.expand_path("templates/Executable", __dir__)
       template = File.read(template_path)
 
+      Bundler.mkdir_p(bin_path)
+
       exists = []
       spec.executables.each do |executable|
         binstub_path = "#{bin_path}/#{executable}"
@@ -173,6 +175,8 @@ module Bundler
       ruby_command = Thor::Util.ruby_command
       ruby_command = ruby_command
 
+      Bundler.mkdir_p(bin_path)
+
       spec.executables.each do |executable|
         next if executable == "bundle"
         executable_path = Pathname(spec.full_gem_path).join(spec.bindir, executable).relative_path_from(bin_path)

data/bundler/lib/bundler/man/bundle-lock.1

@@ -49,7 +49,7 @@ If updating, prefer updating only to next patch version\.
 If updating, prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-If updating, prefer updating to next major version (default)\.
+If updating, prefer updating to latest major version (default)\.
 .TP
 \fB\-\-pre\fR
 If updating, always choose the highest allowed version, regardless of prerelease status\.

data/bundler/lib/bundler/man/bundle-lock.1.ronn

@@ -75,7 +75,7 @@ Lock the gems specified in Gemfile.
   If updating, prefer updating only to next minor version.
 
 * `--major`:
-  If updating, prefer updating to next major version (default).
+  If updating, prefer updating to latest major version (default).
 
 * `--pre`:
   If updating, always choose the highest allowed version, regardless of prerelease status.

data/bundler/lib/bundler/man/bundle-outdated.1

@@ -37,7 +37,7 @@ List gems organized by groups\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-patch\fR
 Prefer updating only to next patch version\.

data/bundler/lib/bundler/man/bundle-outdated.1.ronn

@@ -55,7 +55,7 @@ are up to date, Bundler will exit with a status of 0. Otherwise, it will exit 1.
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--patch`:
   Prefer updating only to next patch version.

data/bundler/lib/bundler/man/bundle-update.1

@@ -54,7 +54,7 @@ Prefer updating only to next patch version\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-pre\fR
 Always choose the highest allowed version, regardless of prerelease status\.
@@ -175,7 +175,7 @@ Prefer updating only to next patch version\.
 Prefer updating only to next minor version\.
 .TP
 \fB\-\-major\fR
-Prefer updating to next major version (default)\.
+Prefer updating to latest major version (default)\.
 .TP
 \fB\-\-strict\fR
 Do not allow any gem to be updated past latest \fB\-\-patch\fR | \fB\-\-minor\fR | \fB\-\-major\fR\.

data/bundler/lib/bundler/man/bundle-update.1.ronn

@@ -83,7 +83,7 @@ gem.
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--pre`:
   Always choose the highest allowed version, regardless of prerelease status.
@@ -238,7 +238,7 @@ versions are resolved. One of the following options can be used: `--patch`,
   Prefer updating only to next minor version.
 
 * `--major`:
-  Prefer updating to next major version (default).
+  Prefer updating to latest major version (default).
 
 * `--strict`:
   Do not allow any gem to be updated past latest `--patch` | `--minor` | `--major`.

data/bundler/lib/bundler/templates/newgem/ext/newgem/Cargo.toml.tt

@@ -12,7 +12,7 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-magnus = { version = "0.8.2" }
+magnus = { version = "0.9" }
 rb-sys = { version = "0.9", features = ["stable-api-compiled-fallback"] }
 
 [build-dependencies]

data/bundler/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.21".freeze
+  VERSION = "4.0.22".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

data/bundler/lib/bundler.rb

@@ -119,9 +119,7 @@ module Bundler
     def bin_path
       @bin_path ||= begin
         path = Bundler.settings[:bin] || "bin"
-        path = Pathname.new(path).expand_path(root).expand_path
-        mkdir_p(path)
-        path
+        Pathname.new(path).expand_path(root).expand_path
       end
     end
 

data/lib/rubygems/commands/exec_command.rb

@@ -3,17 +3,20 @@
 require_relative "../command"
 require_relative "../dependency_installer"
 require_relative "../gem_runner"
+require_relative "../local_remote_options"
 require_relative "../package"
 require_relative "../version_option"
 
 class Gem::Commands::ExecCommand < Gem::Command
   include Gem::VersionOption
+  include Gem::LocalRemoteOptions
 
   def initialize
     super "exec", "Run a command from a gem", {
       version: Gem::Requirement.default,
     }
 
+    add_source_option
     add_version_option
     add_prerelease_option "to be installed"
 

data/lib/rubygems/ext/builder.rb

@@ -204,7 +204,8 @@ class Gem::Ext::Builder
     when /Cargo.toml/ then
       Gem::Ext::CargoBuilder.new
     else
-      build_error("No builder for extension '#{extension}'")
+      # Also called to validate a specification, which must not leave a build log.
+      raise Gem::Ext::BuildError, "No builder for extension '#{extension}'"
     end
   end
 
@@ -229,7 +230,11 @@ EOF
   def build_extension(extension, dest_path) # :nodoc:
     results = []
 
-    builder = builder_for(extension)
+    begin
+      builder = builder_for(extension)
+    rescue Gem::Ext::BuildError => e
+      build_error(e.message)
+    end
 
     extension_dir =
       File.expand_path File.join(@gem_dir, File.dirname(extension))

data/lib/rubygems/gemcutter_utilities/webauthn_listener.rb

@@ -50,6 +50,13 @@ module Gem::GemcutterUtilities
         socket = server.accept
         request_line = socket.gets
 
+        # Browsers open connections speculatively and close them again without
+        # ever sending a request, so wait for the one that carries the code.
+        unless request_line
+          socket.close
+          next
+        end
+
         method, req_uri, _protocol = request_line.split(" ")
         req_uri = Gem::URI.parse(req_uri)
 
@@ -75,6 +82,8 @@ module Gem::GemcutterUtilities
           responder.send(MethodNotAllowedResponse.for(host))
           raise Gem::WebauthnVerificationError, "Invalid HTTP method #{method.upcase} received."
         end
+      rescue Errno::ECONNABORTED, Errno::ECONNRESET
+        socket&.close
       end
     end
 

data/lib/rubygems/installer.rb

@@ -684,6 +684,10 @@ class Gem::Installer
       raise Gem::InstallError, "#{spec} has an invalid name"
     end
 
+    unless /\A#{Gem::Version::VERSION_PATTERN}\z/.match?(spec.version.to_s)
+      raise Gem::InstallError, "#{spec} has an invalid version"
+    end
+
     if spec.raw_require_paths.any? {|path| path =~ /\R/ }
       raise Gem::InstallError, "#{spec} has an invalid require_paths"
     end

data/lib/rubygems/uninstaller.rb

@@ -272,6 +272,7 @@ class Gem::Uninstaller
 
     safe_delete { rm_r full_gem_path, exclusions: exclusions }
     safe_delete { FileUtils.rm_r spec.extension_dir }
+    safe_delete { FileUtils.rm_f spec.build_info_file }
 
     old_platform_name = spec.original_name
 

data/lib/rubygems.rb

@@ -9,7 +9,7 @@
 require "rbconfig"
 
 module Gem
-  VERSION = "4.0.21"
+  VERSION = "4.0.22"
 end
 
 require_relative "rubygems/defaults"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubygems-update
 version: !ruby/object:Gem::Version
-  version: 4.0.21
+  version: 4.0.22
 platform: ruby
 authors:
 - Jim Weirich