rubygems-update 4.0.21 → 4.1.0.beta1

data/{bundler/lib → lib}/bundler/man/bundle-update.1.ronn

@@ -53,9 +53,7 @@ gem.
   Update the locked version of Ruby to the current version of Ruby.
 
 * `--bundler[=BUNDLER]`:
-  Update the locked version of bundler. BUNDLER can be a version such as
-  `4.0.20`, or a requirement such as `"> 0.a"`. With no argument, update to the
-  latest released version, which never selects a prerelease.
+  Update the locked version of bundler to the invoked bundler version.
 
 * `--force`, `--redownload`:
   Force reinstalling every gem, even if already installed.
@@ -96,8 +94,8 @@ gem.
 
 * `--cooldown=<number>`:
   Only consider gem versions published at least <number> days ago when
-  resolving. Pass `0` to disable cooldown for this run, overriding any
-  per-source or global configuration. Combine with `--conservative` to
+  resolving. Pass `0` to disable cooldown for this run, overriding every
+  other cooldown setting, RubyGems' own included. Combine with `--conservative` to
   minimize transitive churn when bypassing cooldown for an urgent
   update. See `cooldown` in bundle-config(1).
 

data/{bundler/lib → lib}/bundler/man/bundle-version.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-VERSION" "1" "April 2026" ""
+.TH "BUNDLE\-VERSION" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-version\fR \- Prints Bundler version information
 .SH "SYNOPSIS"

data/{bundler/lib → lib}/bundler/man/bundle.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE" "1" "April 2026" ""
+.TH "BUNDLE" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\fR \- Ruby Dependency Management
 .SH "SYNOPSIS"

data/{bundler/lib → lib}/bundler/man/gemfile.5

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "GEMFILE" "5" "April 2026" ""
+.TH "GEMFILE" "5" "May 2026" ""
 .SH "NAME"
 \fBGemfile\fR \- A format for describing gem dependencies for Ruby programs
 .SH "SYNOPSIS"
@@ -471,6 +471,50 @@ eval_gemfile "another\.gemfile"
 .IP "" 0
 .P
 This can be useful to run tests against multiple combinations of dependencies, or to load per\-developer gems from an untracked gemfile\.
+.SH "OVERRIDE"
+The \fBoverride\fR directive rewrites a constraint on another gem before resolution runs\. It targets the common case where an upstream gem's published metadata is too narrow on the current project's machine \-\- a stale upper bound, an unwanted floor, or a transitive pin that has to be lifted\.
+.IP "" 4
+.nf
+override <target>, <field>: <operation>
+.fi
+.IP "" 0
+.P
+\fB<target>\fR is a gem name string or \fB:all\fR\. \fB<field>\fR is one of \fBversion:\fR, \fBrequired_ruby_version:\fR, or \fBrequired_rubygems_version:\fR\. \fB<operation>\fR is one of:
+.IP "\(bu" 4
+a version requirement string (e\.g\. \fB">= 8\.0"\fR), which \fBreplaces\fR the target's requirement absolutely\. The original requirement, both direct and transitive, is discarded in favour of the override\.
+.IP "\(bu" 4
+\fB:ignore_upper\fR, which removes upper\-bound operators (\fB<\fR and \fB<=\fR) from the existing requirement and folds \fB~>\fR into its lower bound (\fB~> 1\.5\fR becomes \fB>= 1\.5\fR)\. Other operators, including \fB!=\fR, are preserved\.
+.IP "\(bu" 4
+\fBnil\fR, which collapses the requirement to \fB>= 0\fR (no constraint at all)\.
+.IP "" 0
+.P
+\fB:all\fR only applies to \fBrequired_ruby_version:\fR and \fBrequired_rubygems_version:\fR\. A per\-gem override on the same field takes precedence over an \fB:all\fR override\. \fB:all + version:\fR is rejected: version requirements only make sense per gem\.
+.P
+Multiple \fBoverride\fR calls for distinct targets are allowed; declaring the same \fBtarget\fR and \fBfield\fR twice is an error\.
+.IP "" 4
+.nf
+source "https://rubygems\.org"
+
+# Force every reference to "rails" \-\- direct or transitive \-\- to >= 8\.0\.
+override "rails", version: ">= 8\.0"
+
+# Strip the upper bound on nokogiri\.
+override "nokogiri", version: :ignore_upper
+
+# Drop the version pin on legacy entirely\.
+override "legacy", version: nil
+
+# Loosen every gem's required_ruby_version upper bound\.
+override :all, required_ruby_version: :ignore_upper
+
+# Override one specific gem's required_rubygems_version\.
+override "tricky", required_rubygems_version: nil
+
+gem "rails", "~> 7\.0"
+.fi
+.IP "" 0
+.P
+The override only affects resolution and the install\-time Ruby/RubyGems compatibility checks; \fBGemfile\.lock\fR continues to reflect the resolved versions, not the rewritten requirements\. When resolution still fails, Bundler appends the active overrides (with their Gemfile location) to the error message so it is clear which override shaped the constraint set\.
 .SH "SOURCE PRIORITY"
 When attempting to locate a gem to satisfy a gem requirement, bundler uses the following priority order:
 .IP "1." 4

data/{bundler/lib → lib}/bundler/man/gemfile.5.ronn

@@ -562,6 +562,59 @@ call.
 This can be useful to run tests against multiple combinations of dependencies,
 or to load per-developer gems from an untracked gemfile.
 
+## OVERRIDE
+
+The `override` directive rewrites a constraint on another gem before
+resolution runs. It targets the common case where an upstream gem's
+published metadata is too narrow on the current project's machine -- a stale
+upper bound, an unwanted floor, or a transitive pin that has to be lifted.
+
+    override <target>, <field>: <operation>
+
+`<target>` is a gem name string or `:all`. `<field>` is one of `version:`,
+`required_ruby_version:`, or `required_rubygems_version:`. `<operation>` is
+one of:
+
+  * a version requirement string (e.g. `">= 8.0"`), which **replaces** the
+    target's requirement absolutely. The original requirement, both direct
+    and transitive, is discarded in favour of the override.
+  * `:ignore_upper`, which removes upper-bound operators (`<` and `<=`) from
+    the existing requirement and folds `~>` into its lower bound (`~> 1.5`
+    becomes `>= 1.5`). Other operators, including `!=`, are preserved.
+  * `nil`, which collapses the requirement to `>= 0` (no constraint at all).
+
+`:all` only applies to `required_ruby_version:` and `required_rubygems_version:`.
+A per-gem override on the same field takes precedence over an `:all` override.
+`:all + version:` is rejected: version requirements only make sense per gem.
+
+Multiple `override` calls for distinct targets are allowed; declaring the
+same `target` and `field` twice is an error.
+
+    source "https://rubygems.org"
+
+    # Force every reference to "rails" -- direct or transitive -- to >= 8.0.
+    override "rails", version: ">= 8.0"
+
+    # Strip the upper bound on nokogiri.
+    override "nokogiri", version: :ignore_upper
+
+    # Drop the version pin on legacy entirely.
+    override "legacy", version: nil
+
+    # Loosen every gem's required_ruby_version upper bound.
+    override :all, required_ruby_version: :ignore_upper
+
+    # Override one specific gem's required_rubygems_version.
+    override "tricky", required_rubygems_version: nil
+
+    gem "rails", "~> 7.0"
+
+The override only affects resolution and the install-time Ruby/RubyGems
+compatibility checks; `Gemfile.lock` continues to reflect the resolved
+versions, not the rewritten requirements. When resolution still fails,
+Bundler appends the active overrides (with their Gemfile location) to the
+error message so it is clear which override shaped the constraint set.
+
 ## SOURCE PRIORITY
 
 When attempting to locate a gem to satisfy a gem requirement,

data/lib/bundler/match_metadata.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Bundler
+  module MatchMetadata
+    def matches_current_metadata?
+      matches_current_ruby? && matches_current_rubygems?
+    end
+
+    def matches_current_ruby?
+      @required_ruby_version.satisfied_by?(Gem.ruby_version)
+    end
+
+    def matches_current_rubygems?
+      @required_rubygems_version.satisfied_by?(Gem.rubygems_version)
+    end
+
+    def matches_current_metadata_with_overrides?(overrides)
+      matches_current_ruby_with_overrides?(overrides) && matches_current_rubygems_with_overrides?(overrides)
+    end
+
+    def matches_current_ruby_with_overrides?(overrides)
+      effective_required_version(@required_ruby_version, :required_ruby_version, overrides).satisfied_by?(Gem.ruby_version)
+    end
+
+    def matches_current_rubygems_with_overrides?(overrides)
+      effective_required_version(@required_rubygems_version, :required_rubygems_version, overrides).satisfied_by?(Gem.rubygems_version)
+    end
+
+    def expanded_dependencies
+      runtime_dependencies + [
+        metadata_dependency("Ruby", @required_ruby_version),
+        metadata_dependency("RubyGems", @required_rubygems_version),
+      ].compact
+    end
+
+    def metadata_dependency(name, requirement)
+      return if requirement.nil? || requirement.none?
+
+      Gem::Dependency.new("#{name}\0", requirement)
+    end
+
+    private
+
+    def effective_required_version(requirement, field, overrides)
+      return requirement if overrides.nil? || overrides.empty?
+      override = Override.find_for(overrides, name, field)
+      override ? override.apply_to(requirement) : requirement
+    end
+  end
+end

data/{bundler/lib → lib}/bundler/match_platform.rb

@@ -2,6 +2,10 @@
 
 module Bundler
   module MatchPlatform
+    def content_address
+      nil
+    end
+
     def installable_on_platform?(target_platform) # :nodoc:
       return true if [Gem::Platform::RUBY, nil, target_platform].include?(platform)
       return true if Gem::Platform.new(platform) === target_platform
@@ -11,13 +15,32 @@ module Bundler
 
     def self.select_best_platform_match(specs, platform, force_ruby: false, prefer_locked: false)
       matching = select_all_platform_match(specs, platform, force_ruby: force_ruby, prefer_locked: prefer_locked)
+      matching = prefer_content_addressable(matching)
 
       Gem::Platform.sort_and_filter_best_platform_match(matching, platform)
     end
 
-    def self.select_best_local_platform_match(specs, force_ruby: false)
+    def self.select_all_content_address_match(specs, content_address)
+      return specs unless Gem::ContentAddress.match?(content_address)
+
+      specs.select {|spec| spec.content_address == content_address }
+    end
+
+    def self.prefer_content_addressable(matching)
+      addressable, non_addressable = matching.partition {|s| Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false) }
+      return matching if addressable.empty?
+
+      compatible = addressable.select(&:matches_current_metadata?)
+      return compatible if compatible.any?
+
+      non_addressable.any? ? non_addressable : matching
+    end
+
+    def self.select_best_local_platform_match(specs, force_ruby: false, locked_platforms: nil)
       local = Bundler.local_platform
-      matching = select_all_platform_match(specs, local, force_ruby: force_ruby).filter_map(&:materialized_for_installation)
+      matching = select_all_platform_match(specs, local, force_ruby: force_ruby)
+      matching = matching.filter_map {|spec| spec.materialized_for_installation(locked_platforms) }
+      matching = prefer_content_addressable(matching)
 
       Gem::Platform.sort_best_platform_match(matching, local)
     end

data/lib/bundler/match_remote_metadata.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Bundler
+  module FetchMetadata
+    # A fallback is included because the original version of the specification
+    # API didn't include that field, so some marshalled specs in the index have it
+    # set to +nil+.
+    def matches_current_ruby?
+      ensure_required_ruby_version_loaded
+      super
+    end
+
+    def matches_current_rubygems?
+      ensure_required_rubygems_version_loaded
+      super
+    end
+
+    def matches_current_ruby_with_overrides?(overrides)
+      ensure_required_ruby_version_loaded
+      super
+    end
+
+    def matches_current_rubygems_with_overrides?(overrides)
+      ensure_required_rubygems_version_loaded
+      super
+    end
+
+    private
+
+    def ensure_required_ruby_version_loaded
+      @required_ruby_version ||= _remote_specification.required_ruby_version || Gem::Requirement.default # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+
+    def ensure_required_rubygems_version_loaded
+      @required_rubygems_version ||= _remote_specification.required_rubygems_version || Gem::Requirement.default # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+  end
+
+  module MatchRemoteMetadata
+    include MatchMetadata
+
+    prepend FetchMetadata
+  end
+end

data/{bundler/lib → lib}/bundler/materialization.rb

@@ -12,6 +12,7 @@ module Bundler
       @dep = dep
       @platform = platform
       @candidates = candidates
+      @locked_platforms = candidates&.map(&:platform)
     end
 
     def complete?
@@ -24,7 +25,7 @@ module Bundler
       elsif platform
         MatchPlatform.select_best_platform_match(@candidates, platform, force_ruby: dep.force_ruby_platform)
       else
-        MatchPlatform.select_best_local_platform_match(@candidates, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform)
+        MatchPlatform.select_best_local_platform_match(@candidates, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform, locked_platforms: @locked_platforms)
       end
     end
 

data/lib/bundler/override.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Bundler
+  class Override
+    UPPER_BOUND_OPERATORS = ["<", "<="].freeze
+
+    def self.find_for(overrides, name, field)
+      overrides.find {|o| o.target == name && o.field == field } ||
+        overrides.find {|o| o.target == :all && o.field == field }
+    end
+
+    # Attach the given overrides onto every LazySpecification in `specs` so
+    # downstream consumers (LazySpecification#choose_compatible, the install-
+    # time compatibility check, etc.) can read the override list off the spec
+    # itself. Non-LazySpec entries (StubSpecification, Gem::Specification, ...)
+    # are left untouched.
+    def self.attach(specs, overrides)
+      return if overrides.nil? || overrides.empty?
+      specs.each {|s| s.overrides = overrides if s.is_a?(LazySpecification) }
+    end
+
+    attr_reader :target, :field, :operation, :source_location
+
+    def initialize(target, field, operation, source_location: nil)
+      @target = target
+      @field = field
+      @operation = operation
+      @source_location = source_location
+    end
+
+    def source_location_label
+      return nil unless @source_location
+      "#{File.basename(@source_location.path)}:#{@source_location.lineno}"
+    end
+
+    def apply_to(requirement)
+      case operation
+      when nil
+        Gem::Requirement.default
+      when :ignore_upper
+        remove_upper_bounds(requirement)
+      when String
+        Gem::Requirement.new(operation)
+      else
+        raise ArgumentError, "unsupported override operation: #{operation.inspect}"
+      end
+    end
+
+    private
+
+    def remove_upper_bounds(requirement)
+      return Gem::Requirement.default if requirement.nil? || requirement.none?
+
+      preserved = requirement.requirements.filter_map do |op, version|
+        if UPPER_BOUND_OPERATORS.include?(op)
+          nil
+        elsif op == "~>"
+          [">=", version]
+        else
+          [op, version]
+        end
+      end
+
+      return Gem::Requirement.default if preserved.empty?
+
+      Gem::Requirement.new(preserved.map {|op, v| "#{op} #{v}" })
+    end
+  end
+end

data/{bundler/lib → lib}/bundler/plugin/dsl.rb

@@ -5,12 +5,11 @@ module Bundler
     # Dsl to parse the Gemfile looking for plugins to install
     class DSL < Bundler::Dsl
       class PluginGemfileError < PluginError; end
-      alias_method :_gem, :gem # To use for plugin installation as gem
 
       # So that we don't have to override all there methods to dummy ones
       # explicitly.
       # They will be handled by method_missing
-      [:gemspec, :gem, :install_if, :platforms, :env].each {|m| undef_method m }
+      [:gemspec, :install_if, :platforms, :env].each {|m| undef_method m }
 
       # This lists the plugins that was added automatically and not specified by
       # the user.
@@ -24,12 +23,11 @@ module Bundler
 
       def initialize
         super
-        @sources = Plugin::SourceList.new
         @inferred_plugins = [] # The source plugins inferred from :type
       end
 
-      def plugin(name, *args)
-        _gem(name, *args)
+      def gem(*args)
+        # Ignore regular dependencies when doing the plugins-only pre-parse
       end
 
       def method_missing(name, *args)

data/{bundler/lib → lib}/bundler/plugin/events.rb

@@ -30,6 +30,54 @@ module Bundler
         @events.key?(event)
       end
 
+      # @!parse
+      #   A hook called before the Gemfile is evaluated
+      #   Includes the Gemfile path and the Lockfile path
+      #   GEM_BEFORE_EVAL = "before-eval"
+      define :GEM_BEFORE_EVAL, "before-eval"
+
+      # @!parse
+      #   A hook called after the Gemfile is evaluated
+      #   Includes a Bundler::Definition
+      #   GEM_AFTER_EVAL = "after-eval"
+      define :GEM_AFTER_EVAL, "after-eval"
+
+      # @!parse
+      #   A hook called before any gems install
+      #   Includes an Array of Bundler::Dependency objects
+      #   GEM_BEFORE_INSTALL_ALL = "before-install-all"
+      define :GEM_BEFORE_INSTALL_ALL, "before-install-all"
+
+      # @!parse
+      #   A hook called before each individual gem is downloaded from a remote source.
+      #   Includes a spec-like object responding to the Gem::Specification API
+      #   (for example, a Bundler spec proxy such as Bundler::EndpointSpecification
+      #   or Bundler::RemoteSpecification). Does not fire when the gem is already
+      #   present at the initial download-cache check.
+      #   GEM_BEFORE_FETCH = "before-fetch"
+      define :GEM_BEFORE_FETCH, "before-fetch"
+
+      # @!parse
+      #   A hook called after each individual gem is downloaded from a remote source.
+      #   Includes a spec-like object responding to the Gem::Specification API
+      #   (for example, a Bundler spec proxy such as Bundler::EndpointSpecification
+      #   or Bundler::RemoteSpecification). Does not fire when the gem is already
+      #   present at the initial download-cache check.
+      #   GEM_AFTER_FETCH = "after-fetch"
+      define :GEM_AFTER_FETCH, "after-fetch"
+
+      # @!parse
+      #   A hook called before a git source is fetched or checked out.
+      #   Includes a Bundler::Source::Git reference.
+      #   GIT_BEFORE_FETCH = "before-git-fetch"
+      define :GIT_BEFORE_FETCH, "before-git-fetch"
+
+      # @!parse
+      #   A hook called after a git source is fetched or checked out.
+      #   Includes a Bundler::Source::Git reference.
+      #   GIT_AFTER_FETCH = "after-git-fetch"
+      define :GIT_AFTER_FETCH, "after-git-fetch"
+
       # @!parse
       #   A hook called before each individual gem is installed
       #   Includes a Bundler::ParallelInstaller::SpecInstallation.
@@ -45,18 +93,18 @@ module Bundler
       #   GEM_AFTER_INSTALL = "after-install"
       define :GEM_AFTER_INSTALL,  "after-install"
 
-      # @!parse
-      #   A hook called before any gems install
-      #   Includes an Array of Bundler::Dependency objects
-      #   GEM_BEFORE_INSTALL_ALL = "before-install-all"
-      define :GEM_BEFORE_INSTALL_ALL, "before-install-all"
-
       # @!parse
       #   A hook called after any gems install
       #   Includes an Array of Bundler::Dependency objects
       #   GEM_AFTER_INSTALL_ALL = "after-install-all"
       define :GEM_AFTER_INSTALL_ALL,  "after-install-all"
 
+      # @!parse
+      #   A hook called before any gems require
+      #   Includes an Array of Bundler::Dependency objects.
+      #   GEM_BEFORE_REQUIRE_ALL = "before-require-all"
+      define :GEM_BEFORE_REQUIRE_ALL, "before-require-all"
+
       # @!parse
       #   A hook called before each individual gem is required
       #   Includes a Bundler::Dependency.
@@ -69,17 +117,11 @@ module Bundler
       #   GEM_AFTER_REQUIRE = "after-require"
       define :GEM_AFTER_REQUIRE,  "after-require"
 
-      # @!parse
-      #   A hook called before any gems require
-      #   Includes an Array of Bundler::Dependency objects.
-      #   GEM_BEFORE_REQUIRE_ALL = "before-require-all"
-      define :GEM_BEFORE_REQUIRE_ALL, "before-require-all"
-
       # @!parse
       #   A hook called after all gems required
       #   Includes an Array of Bundler::Dependency objects.
       #   GEM_AFTER_REQUIRE_ALL = "after-require-all"
-      define :GEM_AFTER_REQUIRE_ALL,  "after-require-all"
+      define :GEM_AFTER_REQUIRE_ALL, "after-require-all"
     end
   end
 end

data/{bundler/lib → lib}/bundler/plugin/index.rb

@@ -163,20 +163,28 @@ module Bundler
       # @param [Pathname] index file path
       # @param [Boolean] is the index file global index
       def load_index(index_file, global = false)
+        base = base_for_index(global)
+
         SharedHelpers.filesystem_access(index_file, :read) do |index_f|
           valid_file = index_f&.exist? && !index_f.size.zero?
           break unless valid_file
 
           data = index_f.read
 
-          require_relative "../yaml_serializer"
-          index = YAMLSerializer.load(data)
+          require "rubygems/yaml_serializer"
+          # Empty sections load as nil, e.g. from index files written by
+          # older Bundler versions, which dumped empty hashes as a bare key.
+          index = Gem::YAMLSerializer.load(data) || {}
+
+          escaping = escaping_plugins(index, base)
+          hooks = (index["hooks"] || {}).transform_values {|names| Array(names) - escaping }
 
-          @commands.merge!(index["commands"])
-          @hooks.merge!(index["hooks"])
-          @load_paths.merge!(index["load_paths"])
-          @plugin_paths.merge!(index["plugin_paths"])
-          @sources.merge!(index["sources"]) unless global
+          @commands.merge!(owned_by(index["commands"] || {}, escaping))
+          # An event whose plugins all escaped is left out rather than merged in empty.
+          @hooks.merge!(hooks.reject {|_, names| names.empty? })
+          @load_paths.merge!(named(transform_index_paths(index["load_paths"]) {|p| absolutize_path(p, base) }, escaping))
+          @plugin_paths.merge!(named(transform_index_paths(index["plugin_paths"]) {|p| absolutize_path(p, base) }, escaping))
+          @sources.merge!(owned_by(index["sources"] || {}, escaping)) unless global
         end
       end
 
@@ -184,20 +192,88 @@ module Bundler
       # instance variables in YAML format. (The instance variables are supposed
       # to be only String key value pairs)
       def save_index
+        base = base_for_index(false)
+
         index = {
           "commands" => @commands,
           "hooks" => @hooks,
-          "load_paths" => @load_paths,
-          "plugin_paths" => @plugin_paths,
+          "load_paths" => transform_index_paths(@load_paths) {|p| relativize_path(p, base) },
+          "plugin_paths" => transform_index_paths(@plugin_paths) {|p| relativize_path(p, base) },
           "sources" => @sources,
         }
 
-        require_relative "../yaml_serializer"
+        require "rubygems/yaml_serializer"
         SharedHelpers.filesystem_access(index_file) do |index_f|
           FileUtils.mkdir_p(index_f.dirname)
-          File.open(index_f, "w") {|f| f.puts YAMLSerializer.dump(index) }
+          File.open(index_f, "w") {|f| f.puts Gem::YAMLSerializer.dump(index) }
+        end
+      end
+
+      def base_for_index(global)
+        global ? Plugin.global_root : Plugin.root
+      end
+
+      # A relative path only means anything inside the root, so an entry that escapes is not one Bundler installed.
+      def escaping_plugins(index, base)
+        names = []
+
+        %w[load_paths plugin_paths].each do |key|
+          (index[key] || {}).each do |name, value|
+            escapes = Array(value).any? do |path|
+              !Pathname.new(path).absolute? && !contained_in?(absolutize_path(path, base), base)
+            end
+
+            names << name if escapes
+          end
+        end
+
+        names.uniq
+      end
+
+      # Expanded here, not by the caller: what gets stored stays joined, because
+      # #installed_in_plugin_root? matches it against Plugin.root as written.
+      def contained_in?(path, base)
+        path = File.expand_path(path)
+        base = File.expand_path(base)
+
+        path == base || path.start_with?("#{base}#{File::SEPARATOR}")
+      end
+
+      # commands and sources are keyed by what they provide, load_paths and plugin_paths by the plugin.
+      def owned_by(mapping, names)
+        mapping.reject {|_, plugin| names.include?(plugin) }
+      end
+
+      def named(mapping, names)
+        mapping.reject {|plugin, _| names.include?(plugin) }
+      end
+
+      def transform_index_paths(paths)
+        return {} unless paths
+
+        paths.transform_values do |value|
+          if value.is_a?(Array)
+            value.map {|path| yield path }
+          else
+            yield value
+          end
         end
       end
+
+      def relativize_path(path, base)
+        pathname = Pathname.new(path)
+        return path unless pathname.absolute?
+
+        return path unless contained_in?(pathname.to_s, base)
+
+        pathname.relative_path_from(Pathname.new(base)).to_s
+      end
+
+      def absolutize_path(path, base)
+        pathname = Pathname.new(path)
+        pathname = Pathname.new(base).join(pathname) unless pathname.absolute?
+        pathname.to_s
+      end
     end
   end
 end

data/{bundler/lib → lib}/bundler/plugin/installer/path.rb

@@ -5,7 +5,7 @@ module Bundler
     class Installer
       class Path < Bundler::Source::Path
         def root
-          SharedHelpers.in_bundle? ? Bundler.root : Plugin.root
+          Plugin.root
         end
 
         def eql?(other)