rubygems-update 4.0.21 → 4.1.0.beta1

data/README.md

@@ -30,6 +30,23 @@ response = Faraday.get('https://rubygems.org')
 
 For more information about how to use RubyGems, see our RubyGems basics guide at [guides.rubygems.org](https://guides.rubygems.org/rubygems-basics/)
 
+## Bundler
+
+Bundler makes sure Ruby applications run the same code on every machine. It is developed in this repository and ships with Ruby.
+
+It does this by managing the gems that the application depends on. Given a list of gems, it can automatically download and install those gems, as well as any other gems needed by the gems that are listed. Before installing gems, it checks the versions of every gem to make sure that they are compatible, and can all be loaded at the same time. After the gems have been installed, Bundler can help you update some or all of them when new versions become available. Finally, it records the exact versions that have been installed, so that others can install the exact same gems.
+
+For example, these commands will allow you to use Bundler to manage the `rspec` gem for your application:
+
+```bash
+bundle init
+bundle add rspec
+bundle install
+bundle exec rspec
+```
+
+For more information about how to use Bundler, see the guides at [guides.rubygems.org](https://guides.rubygems.org/)
+
 ## Requirements
 
 * RubyGems supports Ruby 3.0 or later.
@@ -69,9 +86,7 @@ See [UPGRADING](doc/UPGRADING.md) for more details and alternative instructions.
 
 ## Release policy
 
-RubyGems and Bundler are released in sync, although they do not share their
-major version number. It is planned that also their major version numbers will
-be sync'ed in the future.
+RubyGems and Bundler share a version number and are released together.
 
 The release policy is somewhat similar to the release policy of Ruby itself:
 
@@ -102,15 +117,20 @@ for letting the RubyGems team know about bugs or problems you're having is
 
 ### Bundler Compatibility
 
-See https://bundler.io/compatibility for known issues.
+See https://guides.rubygems.org/bundler-compatibility/ for known issues.
 
 ### Supporting
 
-RubyGems is managed by [Ruby Central](https://rubycentral.org), a non-profit organization that supports the Ruby community through projects like this one, as well as [RubyConf](https://rubyconf.org), [RailsConf](https://railsconf.org), and [RubyGems.org](https://rubygems.org). You can support Ruby Central by attending or [sponsoring](sponsors@rubycentral.org) a conference, or by [joining as a supporting member](https://rubycentral.org/#/portal/signup).
+RubyGems is a community project. Please consider sponsoring [individual contributors for their great OSS
+work](https://github.com/ruby/rubygems/graphs/contributors).
+
+In addition, Ruby Central administers grant-funded work for improvements to `ruby/rubygems`, as well as running
+RubyGems.org (the service). You can support Ruby Central by attending or [sponsoring](mailto:sponsors@rubycentral.org)
+a [RubyConf](https://rubyconf.org/), or by [joining as a supporting member](https://rubycentral.org/#/portal/signup).
 
 ### Contributing
 
-If you'd like to contribute to RubyGems, that's awesome, and we <3 you. Check out our [guide to contributing](doc/rubygems/CONTRIBUTING.md) for more information.
+If you'd like to contribute to RubyGems, that's awesome, and we <3 you. Check out our [guide to contributing](CONTRIBUTING.md) for more information.
 
 ### Code of Conduct
 

data/bundler.gemspec

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+begin
+  require_relative "lib/bundler/version"
+rescue LoadError
+  # for Ruby core repository
+  require_relative "version"
+end
+
+Gem::Specification.new do |s|
+  s.name        = "bundler"
+  s.version     = Bundler::VERSION
+  s.license     = "MIT"
+  s.authors     = [
+    "Yehuda Katz", "Carl Lerche", "André Arko", "Terence Lee", "Tim Moore",
+    "Jessica Lynn Suttles", "Hiroshi SHIBATA", "André Medeiros", "Samuel Giddins", "David Rodríguez",
+    "James Wen", "Chris Morris", "Colby Swandale", "Grey Baker", "Stephanie Morillo"
+  ]
+  s.email = [
+    "wycats@gmail.com", "me@carllerche.com", "andre@arko.net", "hone02@gmail.com", "tmoore@incrementalism.net",
+    "jlsuttles@gmail.com", "hsbt@ruby-lang.org", "me@andremedeiros.info", "segiddins@segiddins.me", "deivid.rodriguez@riseup.net",
+    "jrw2175@columbia.edu", "chrismo@clabs.org", "colby@rubygems.org", "greysteil@gmail.com", ""
+  ]
+  s.homepage    = "https://bundler.io"
+  s.summary     = "The best way to manage your application's dependencies"
+  s.description = "Bundler manages an application's dependencies through its entire life, across many machines, systematically and repeatably"
+
+  s.metadata = {
+    "bug_tracker_uri" => "https://github.com/ruby/rubygems/issues?q=is%3Aopen+is%3Aissue+label%3ABundler",
+    "changelog_uri" => "https://github.com/ruby/rubygems/blob/master/CHANGELOG.md",
+    "homepage_uri" => "https://bundler.io/",
+    "source_code_uri" => "https://github.com/ruby/rubygems",
+  }
+
+  s.required_ruby_version     = ">= 3.2.0"
+
+  # It should match the RubyGems version shipped with `required_ruby_version` above
+  s.required_rubygems_version = ">= 3.4.1"
+
+  s.files = Dir.glob("lib/bundler{.rb,/**/*}", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+
+  # Bundler reuses RubyGems' vendored URI, SecureRandom and PubGrub, its
+  # pure-Ruby YAML serializer, its shared cooldown setting rules, its compact
+  # index client and its credential store. Ship a copy under lib/rubygems so
+  # Bundler stays self-contained on RubyGems versions that predate them.
+  s.files += Dir.glob("lib/rubygems/vendor/uri/**/*", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+  s.files += Dir.glob("lib/rubygems/vendor/securerandom/**/*", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+  s.files += Dir.glob("lib/rubygems/vendor/pub_grub/**/*", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+  s.files += Dir.glob("lib/rubygems/yaml_serializer.rb")
+  s.files += Dir.glob("lib/rubygems/cooldown_settings.rb")
+  s.files += Dir.glob("lib/rubygems/compact_index_client{.rb,/**/*}", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+  s.files += Dir.glob("lib/rubygems/credential_store{.rb,/**/*}", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+
+  # include the gemspec itself because warbler breaks w/o it
+  s.files += %w[bundler.gemspec]
+
+  # These live next to the gemspec when Bundler ships as a gem, but not when
+  # it is synced into Ruby core, where the gemspec moves under lib/bundler.
+  s.files += %w[MIT.txt].select {|f| File.file?(f) }
+  s.bindir        = "exe"
+  s.executables   = %w[bundle bundler]
+  s.require_paths = ["lib"]
+end

data/doc/POLICIES.md

@@ -0,0 +1,147 @@
+# ruby/rubygems Policies
+
+This document is an attempt to record the policies and processes that are used to govern this project--it's not fixed or permanent, and will likely evolve as events warrant.
+
+## Our Goals
+
+0. Treat everyone like a valuable human being, worthy of respect and empathy. No exceptions.
+1. Strive to empower users, the Ruby developers who use RubyGems and Bundler. For example, there is no such thing as user error, only insufficient UX design.
+2. Strive to empower contributors, as long as it does not harm users. For example, potential contributors should be able to set up a complete development and testing environment with a single command.
+3. Strive to empower maintainers, as long as it does not harm contributors or users. For example, automating issue triage to reduce repetitive work for maintainers, as long as users with problems are not worse off.
+
+These policies are intended to be examples of how to apply these goals, and we realize that we can't possibly cover every edge case or loophole. In any case where policies turn out to conflict with these goals, the goals should win.
+
+## Issue guidelines
+
+Anyone is welcome to open an issue, or comment on an issue. Issue comments without useful content (like “me too”) may be removed.
+
+Opening an issue to ask for help may eventually get you help, but chances are help will arrive faster if you post on [Stack Overflow](https://stackoverflow.com)
+
+Issues will be handled as soon as possible, which may take some time. Including a script that can be used to reproduce your issue is a great way to help maintainers help you. If you can, writing a failing test for your issue is even more helpful.
+
+## Contribution and pull request guidelines
+
+Contributions to RubyGems are made via GitHub pull requests, which must be
+approved by a project committer other than the author. To approve a PR, a
+maintainer can use GitHub's PR review feature. After that, if the original author
+is happy to merge the PR, they can press the merge button.
+
+Anyone is welcome to [contribute](../CONTRIBUTING.md). Contributed code will be released under the same license as the existing codebase.
+
+Pull requests must have passing tests to be merged. Code changes must also include tests for the new behavior. Squashing commits is not required.
+
+Every pull request should explain:
+
+1. The problem being solved
+2. Why that problem is happening
+3. What changes to fix that problem are included in the PR, and
+4. Why that implementation was chosen out of the possible options.
+
+## Long-Term Support
+
+### Ruby Version Support
+
+Both RubyGems and Bundler support Ruby versions for as long as the Ruby team supports them, as [listed here](https://www.ruby-lang.org/en/downloads/branches/). When a Ruby version reaches end-of-life, the following minor release of RubyGems/Bundler will drop backwards compatibility with that Ruby version.
+
+We also support the latest stable versions of JRuby and TruffleRuby, and constantly evaluate changes in Ruby implementation usage to potentially support more implementations.
+
+### Version Support and Releases
+
+The team ships features and bugfixes for the latest minor version. We may exceptionally backport security fixes to older series shipped with Rubies that are officially supported.
+
+Security releases will be made for RubyGems and Bundler versions that were included in a currently-supported Ruby release. For example, if a version was shipped with a Ruby release, it will receive security fixes until that Ruby version reaches end-of-life.
+
+We generally release bugfixes from the main branch and may mix bug fixes and new features in the same release. We do not guarantee bugfix releases for previous minor or major versions.
+
+These policies are not a guarantee that any particular fix will be backported. Instead, this is a way for us to set an upper limit on the versions of Ruby, RubyGems, and Bundler that we have to consider while making changes. Without the limit, the number of versions grows exponentially over time and quickly becomes overwhelming, which leads to maintainer burnout. We want to avoid that.
+
+### Backwards Compatibility
+
+We strive for backwards compatibility. Infrastructure should be as unsurprising as possible, so if something worked in version 1.x, it should continue to work in 1.y and 1.z. Changes in major versions (e.g., 1.x to 2.x) may not maintain full backwards compatibility. We may not always get it right, and there may be extenuating circumstances that force us into choosing between different kinds of breakage, but compatibility is very important to us.
+
+In general, this is what we consider as "public API":
+
+* The `gem` and `bundle` CLIs. Flags and commands will never be removed without
+  deprecation, but we may change the specific output of certain commands without
+  notice, unless a `--parseable` or equivalent flag is given. Don't rely on
+  empty error output when checking success, since progress
+  may be logged to stderr. Instead, check the exit status of the command.
+
+* The documented Gemfile DSL (both methods and their options).
+
+* The lockfile format. We may introduce slight changes in new lockfiles, but
+  we'll keep being able to read what we previously generated and we'll keep it
+  the same by default and instead provide explicit tools to upgrade existing
+  lockfiles to new formats.
+
+* Any documented methods in the RubyGems and Bundler namespaces, like
+  `Bundler.with_original_env` and similar.
+
+* Actual APIs meant to be used by other libraries, like the plugin API.
+
+* Entrypoints different from the CLI, like `bundler/setup` or
+  `bundler/inline`.
+
+We will never intentionally break any of the above in patch or minor releases.
+
+Internal classes and their methods (public or private) are not considered public
+API, but we are aware that they are used in many places. So we try
+not to break internal functionality that may be used by others, including proactively
+using code search tools in public code. That said, we may not always be able to
+avoid breaking things, and we may even intentionally introduce this kind of
+"breakage" in a minor release if we deem it affects very few users or edge
+cases. So be aware when using internals and ideally get in touch with us
+before doing so, so that we can help find the right APIs.
+
+## Discussing large changes
+
+Large changes often benefit from being written out more completely, read by others, and discussed. [GitHub Discussions](https://github.com/ruby/rubygems/discussions) is the preferred place for that to happen.
+
+## Committer Access
+
+Committers may lose their commit privileges if they are inactive for longer than 12 months. Committer permission may be restored upon request by having a pull request merged.
+
+This is designed to improve project maintainability by requiring committers to maintain familiarity with current development activity and to improve security by preventing idle committers from having their commit permissions compromised or exposed.
+
+Always create pull requests rather than pushing directly to the primary branch. Try to get code review and merge approval from someone other than yourself whenever possible.
+
+Contributors who have contributed regularly for more than six months (or implemented a completely new feature for a minor release) are eligible to join the maintainer team. Unless vetoed by an existing maintainer, these contributors will be asked to join the maintainer team. If they accept, new maintainers will be given permissions to view maintainer playbooks, accept pull requests, and release new versions.
+
+## Enforcement guidelines
+
+First off, these policies and their enforcement are subsidiary to the [code of conduct](https://github.com/ruby/rubygems/blob/master/CODE_OF_CONDUCT.md) in any case where they conflict. The first priority is treating human beings with respect and empathy, and figuring out project guidelines and sticking to them will always come after that.
+
+When it comes to carrying out our own policies, we're all regular humans trying to do the best we can. There will probably be times when we don't stick to our policies or goals. If you notice a discrepancy between real-life actions and these policies and goals, please bring it up! We want to make sure that our actions and our policies line up, and that our policies exemplify our goals.
+
+Policies are not set in stone, and may be revised if policy violations are found to be in the spirit of the project goals. Likewise, actions that violate the spirit of the project goals will be considered policy violations, and enforcement action will be taken. We're not interested in rules-lawyering, and we will take action when needed to ensure that everyone feels safe and included.
+
+Please report policy violations by email to conduct@rubygems.org. Anyone violating a policy or goal is expected to cooperate with the team (and the reporter, if they request it) to resolve the issue in a way that follows the project goals.
+
+## Team changes
+
+### Adding a new team member
+
+Interested in adding someone to the team? Here's the process.
+
+1. An existing team member nominates a potential team member to the rest of the team.
+2. The existing team reaches consensus about whether to invite the potential member.
+3. The nominator asks the potential member if they would like to join the team.
+4. The nominator also sends the candidate a link to [POLICIES](POLICIES.md) as an orientation for being on the team.
+5. If the potential member accepts:
+    - Add them to the [maintainers list][team]
+
+### Removing a team member
+
+When team members choose to retire, here's how to remove someone from the team.
+
+- Remove them from the [maintainers list][team]
+
+## Changing These Policies
+
+These policies were set in order to reduce the burden of maintenance and to keep
+committers current with existing development and policies. RubyGems work is
+primarily volunteer-driven which limits the ability to provide long-term
+support. By joining [Ruby Central](https://rubycentral.org/#/portal/signup) you
+can help extend support for older RubyGems versions.
+
+[team]: https://guides.rubygems.org/contributing/#core-projects

data/doc/UPGRADING.md

@@ -1,4 +1,4 @@
-# How to upgrade/downgrade Rubygems and Bundler:
+# How to upgrade/downgrade RubyGems and Bundler:
 
 ## Upgrade Recipe
 
@@ -9,10 +9,10 @@
 
 ## Downgrade Recipe
 
-    $ gem update --system 3.7.2
+    $ gem update --system 4.0.20
 
-    $ gem install bundler -v 2.7.2
-    $ bundle update --bundler=2.7.2
+    $ gem install bundler -v 4.0.20
+    $ bundle update --bundler=4.0.20
 
 ## Install a pre-release version
 

data/{bundler/lib → lib}/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-09-16".freeze
-    @git_commit_sha = "a15d54ed692".freeze
+    @built_at = "2026-09-09".freeze
+    @git_commit_sha = "98e4d8083a7".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/{bundler/lib → lib}/bundler/checksum.rb

@@ -187,83 +187,98 @@ module Bundler
       # However, if the new checksum is from a different source, we register like normal.
       # This ensures a mismatch error where there are multiple top level sources
       # that contain the same gem with different checksums.
+      # The store is keyed by full name rather than lock name because a
+      # content-addressable build and the ordinary platform build of the same
+      # name, version, and platform share a lock name while being different
+      # files with different checksums.
       def replace(spec, checksum)
         return unless checksum
 
-        lock_name = spec.lock_name
+        full_name = spec.full_name
         @store_mutex.synchronize do
-          existing = fetch_checksum(lock_name, checksum.algo)
+          existing = fetch_checksum(full_name, checksum.algo)
           if !existing || existing.same_source?(checksum)
-            store_checksum(lock_name, checksum)
+            store_checksum(full_name, checksum)
           else
-            merge_checksum(lock_name, checksum, existing)
+            merge_checksum(full_name, checksum, existing, spec.lock_name)
           end
         end
       end
 
       def missing?(spec)
-        @store[spec.lock_name].nil?
+        @store[spec.full_name].nil?
       end
 
       def empty?(spec)
         return false unless spec.source.is_a?(Bundler::Source::Rubygems)
 
-        @store[spec.lock_name].empty?
+        @store[spec.full_name].empty?
       end
 
       def register(spec, checksum)
-        register_checksum(spec.lock_name, checksum)
+        register_checksum(spec.full_name, checksum, spec.lock_name)
       end
 
       def merge!(other)
-        other.store.each do |lock_name, checksums|
+        other.store.each do |full_name, checksums|
           checksums.each do |_algo, checksum|
-            register_checksum(lock_name, checksum)
+            register_checksum(full_name, checksum)
           end
         end
       end
 
       def to_lock(spec)
         lock_name = spec.lock_name
-        checksums = @store[lock_name]
-        if checksums&.any?
-          "#{lock_name} #{checksums.values.map(&:to_lock).sort.join(",")}"
+        checksums = checksums_to_lock(platform_full_name(spec))
+        if checksums
+          "#{lock_name} #{checksums}"
         else
           lock_name
         end
       end
 
+      def checksums_to_lock(full_name)
+        checksums = @store[full_name]
+        return unless checksums&.any?
+
+        checksums.values.map(&:to_lock).sort.join(",")
+      end
+
       private
 
-      def register_checksum(lock_name, checksum)
+      def platform_full_name(spec)
+        Gem::NameTuple.new(spec.name, spec.version, spec.platform).full_name
+      end
+
+      def register_checksum(full_name, checksum, display_name = full_name)
         @store_mutex.synchronize do
           if checksum
-            existing = fetch_checksum(lock_name, checksum.algo)
+            existing = fetch_checksum(full_name, checksum.algo)
             if existing
-              merge_checksum(lock_name, checksum, existing)
+              merge_checksum(full_name, checksum, existing, display_name)
             else
-              store_checksum(lock_name, checksum)
+              store_checksum(full_name, checksum)
             end
           else
-            init_checksum(lock_name)
+            init_checksum(full_name)
           end
         end
       end
 
-      def merge_checksum(lock_name, checksum, existing)
-        existing.merge!(checksum) || raise(ChecksumMismatchError.new(lock_name, existing, checksum))
+      def merge_checksum(full_name, checksum, existing, display_name = full_name)
+        existing.merge!(checksum) || raise(ChecksumMismatchError.new(display_name, existing, checksum))
       end
 
-      def store_checksum(lock_name, checksum)
-        init_checksum(lock_name)[checksum.algo] = checksum
+      def store_checksum(full_name, checksum)
+        init_checksum(full_name)[checksum.algo] = checksum
       end
 
-      def init_checksum(lock_name)
-        @store[lock_name] ||= {}
+      def init_checksum(full_name)
+        @store[full_name] ||= {}
       end
 
-      def fetch_checksum(lock_name, algo)
-        @store[lock_name]&.fetch(algo, nil)
+      def fetch_checksum(full_name, algo)
+        @store[full_name]&.fetch(algo, nil)
       end
     end
   end

data/{bundler/lib → lib}/bundler/ci_detector.rb

@@ -3,7 +3,7 @@
 module Bundler
   module CIDetector
     # NOTE: Any changes made here will need to be made to both lib/rubygems/ci_detector.rb and
-    # bundler/lib/bundler/ci_detector.rb (which are enforced duplicates).
+    # lib/bundler/ci_detector.rb (which are enforced duplicates).
     # TODO: Drop that duplication once bundler drops support for RubyGems 3.4
     #
     # ## Recognized CI providers, their signifiers, and the relevant docs ##

data/{bundler/lib → lib}/bundler/cli/add.rb

@@ -14,8 +14,7 @@ module Bundler
     def run
       Bundler.ui.level = "warn" if options[:quiet]
 
-      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
-      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+      Bundler::CLI::Common.configure_cooldown(options)
 
       validate_options!
       inject_dependencies
@@ -34,7 +33,7 @@ module Bundler
 
       Injector.inject(dependencies,
         conservative_versioning: options[:version].nil?, # Perform conservative versioning only when version is not specified
-        optimistic: options[:optimistic],
+        pessimistic: options[:pessimistic],
         strict: options[:strict])
     end
 
@@ -49,7 +48,7 @@ module Bundler
 
       raise InvalidOption, "You cannot specify `--branch` and `--ref` at the same time." if options["branch"] && options["ref"]
 
-      raise InvalidOption, "You cannot specify `--strict` and `--optimistic` at the same time." if options[:strict] && options[:optimistic]
+      raise InvalidOption, "You cannot specify `--strict` and `--pessimistic` at the same time." if options[:strict] && options[:pessimistic]
 
       # raise error when no gems are specified
       raise InvalidOption, "Please specify gems to add." if gems.empty?

data/{bundler/lib → lib}/bundler/cli/cache.rb

@@ -17,6 +17,8 @@ module Bundler
       Bundler.settings.temporary(cache_all_platforms: options["all-platforms"]) do
         Bundler.load.cache
       end
+
+      Bundler::CLI::Common.prune
     end
 
     private
@@ -26,6 +28,8 @@ module Bundler
       options = self.options.dup
       options["local"] = false if Bundler.settings[:cache_all_platforms]
       options["no-cache"] = true
+      options["skip-prune"] = true
+      options["cache-archives"] = true
       Bundler::CLI::Install.new(options).run
     end
   end

data/{bundler/lib → lib}/bundler/cli/clean.rb

@@ -11,6 +11,11 @@ module Bundler
     def run
       require_path_or_force unless options[:"dry-run"]
       Bundler.load.clean(options[:"dry-run"])
+      return if options[:"dry-run"]
+
+      # Pruning last, because cleaning decides which cached .gem files are
+      # stale by reading them.
+      Bundler::CLI::Common.prune(options)
     end
 
     protected

data/{bundler/lib → lib}/bundler/cli/common.rb

@@ -2,12 +2,39 @@
 
 module Bundler
   module CLI::Common
+    # Validates the `--cooldown` flag and makes it the setting for this
+    # command. Every command that takes the flag goes through here, so they
+    # share one reading of the value.
+    def self.configure_cooldown(options)
+      value = options[:cooldown]
+
+      validate_cooldown!(value)
+      Bundler.settings.set_command_option_if_given :cooldown, value
+    end
+
     def self.validate_cooldown!(value)
-      return if value.nil?
+      # Without the flag the config files, BUNDLE_COOLDOWN and the gemrc
+      # setting decide, and those only warn, so a typo left in a config file
+      # keeps the command usable.
+      return warn_invalid_cooldown_setting if value.nil?
       return if value.is_a?(Integer) && value >= 0
       raise InvalidOption, "Expected `--cooldown` to be a non-negative integer, got #{value.inspect}"
     end
 
+    # A cooldown value that cannot be read as a non-negative integer takes no
+    # part in the resolution, so say so rather than letting the protection
+    # lapse quietly. The RubyGems `:cooldown:` setting feeds the same
+    # resolution and is checked in Bundler::Settings#rubygems_cooldown, where
+    # reading it is already being paid for.
+    def self.warn_invalid_cooldown_setting
+      require "rubygems/cooldown_settings"
+
+      value = Bundler.settings.locations(:cooldown).values.first
+      return unless Gem::CooldownSettings.invalid?(value)
+
+      Bundler.ui.warn Gem::CooldownSettings.invalid_message(value, "Bundler's configuration")
+    end
+
     def self.output_post_install_messages(messages)
       return if Bundler.settings["ignore_messages"]
       messages.to_a.each do |name, msg|
@@ -155,6 +182,15 @@ module Bundler
       clean
     end
 
+    # `bundle cache` copies the gem files out of the cache after installing, so
+    # it asks to be skipped here and prunes once it is done.
+    def self.prune(options = {})
+      return if options["skip-prune"]
+
+      categories = Bundler.settings[:prune]
+      Bundler.load.prune(categories) unless categories.empty?
+    end
+
     def self.word_list(words)
       if words.empty?
         return ""

data/{bundler/lib → lib}/bundler/cli/config.rb

@@ -97,7 +97,7 @@ module Bundler
             confirm(name)
           end
 
-          if current_value.nil?
+          if current_value.nil? && !Bundler.settings.stored_outside_config_files?(name)
             exit 1
           else
             return
@@ -111,6 +111,8 @@ module Bundler
       def confirm_all
         if @options[:parseable]
           thor.with_padding do
+            # --parseable output is fed back to `bundle config set`, where a
+            # placeholder would be read back as the credential itself.
             Bundler.settings.all.each do |setting|
               val = Bundler.settings[setting]
               Bundler.ui.info "#{setting}=#{val}"
@@ -118,7 +120,7 @@ module Bundler
           end
         else
           Bundler.ui.confirm "Settings are listed in order of priority. The top value will be used.\n"
-          Bundler.settings.all.each do |setting|
+          Bundler.settings.all_including_stored_credentials.each do |setting|
             Bundler.ui.confirm setting
             show_pretty_values_for(setting)
             Bundler.ui.confirm ""

data/{bundler/lib → lib}/bundler/cli/gem.rb

@@ -7,12 +7,6 @@ module Bundler
   end
 
   class CLI::Gem
-    TEST_FRAMEWORK_VERSIONS = {
-      "rspec" => "3.0",
-      "minitest" => "5.16",
-      "test-unit" => "3.0",
-    }.freeze
-
     DEFAULT_GITHUB_USERNAME = "[USERNAME]"
 
     attr_reader :options, :gem_name, :thor, :name, :target, :extension
@@ -117,7 +111,6 @@ module Bundler
 
       if test_framework = ask_and_set_test_framework
         config[:test] = test_framework
-        config[:test_framework_version] = TEST_FRAMEWORK_VERSIONS[test_framework]
 
         case test_framework
         when "rspec"
@@ -203,12 +196,10 @@ module Bundler
       config[:linter] = ask_and_set_linter
       case config[:linter]
       when "rubocop"
-        config[:linter_version] = rubocop_version
         Bundler.ui.info "RuboCop enabled in config"
         templates.merge!("rubocop.yml.tt" => ".rubocop.yml")
         config[:ignore_paths] << ".rubocop.yml"
       when "standard"
-        config[:linter_version] = standard_version
         Bundler.ui.info "Standard enabled in config"
         templates.merge!("standard.yml.tt" => ".standard.yml")
         config[:ignore_paths] << ".standard.yml"
@@ -471,14 +462,6 @@ module Bundler
       "3.2.0"
     end
 
-    def rubocop_version
-      "1.21"
-    end
-
-    def standard_version
-      "1.3"
-    end
-
     def github_username(git_username)
       if options[:github_username].nil?
         git_username

data/{bundler/lib → lib}/bundler/cli/install.rb

@@ -38,7 +38,7 @@ module Bundler
 
       Bundler::Fetcher.disable_endpoint = options["full-index"]
 
-      Plugin.gemfile_install(Bundler.default_gemfile) if Bundler.settings[:plugins]
+      Plugin.gemfile_install(Bundler.default_gemfile, Bundler.default_lockfile) if Bundler.settings[:plugins]
 
       # For install we want to enable strict validation
       # (rather than some optimizations we perform at app runtime).
@@ -69,6 +69,8 @@ module Bundler
       if CLI::Common.clean_after_install?
         require_relative "clean"
         Bundler::CLI::Clean.new(options).run
+      else
+        CLI::Common.prune(options)
       end
 
       Bundler::CLI::Common.output_fund_metadata_summary
@@ -113,10 +115,7 @@ module Bundler
 
       Bundler.settings.set_command_option_if_given :jobs, options["jobs"]
 
-      Bundler::CLI::Common.validate_cooldown!(options["cooldown"])
-      Bundler.settings.set_command_option_if_given :cooldown, options["cooldown"]
-
-      Bundler.settings.set_command_option_if_given :no_prune, options["no-prune"]
+      Bundler::CLI::Common.configure_cooldown(options)
 
       Bundler.settings.set_command_option_if_given :no_install, options["no-install"]