rubygems-update 4.0.21 → 4.1.0.beta1

data/{bundler/lib → lib}/bundler/installer/parallel_installer.rb

@@ -20,10 +20,6 @@ module Bundler
         state == :installed
       end
 
-      def enqueued?
-        state == :enqueued
-      end
-
       def enqueue_with_priority?
         state == :installable && spec.extensions.any?
       end
@@ -100,7 +96,8 @@ module Bundler
       handle_error if failed_specs.any?
       @specs
     ensure
-      worker_pool&.stop
+      @worker_pool&.stop
+      @download_worker_pool&.stop
     end
 
     private
@@ -170,17 +167,18 @@ module Bundler
       end
     end
 
+    def download_worker_pool
+      @download_worker_pool ||= Bundler::Worker.new(@size, "Gem Downloader",
+        ->(spec_install, worker_num) { do_download(spec_install, worker_num) }, response_queue: response_queue)
+    end
+
     def worker_pool
-      @worker_pool ||= Bundler::Worker.new @size, "Parallel Installer", lambda {|spec_install, worker_num|
-        case spec_install.state
-        when :enqueued
-          do_download(spec_install, worker_num)
-        when :installable
-          do_install(spec_install, worker_num)
-        else
-          spec_install
-        end
-      }
+      @worker_pool ||= Bundler::Worker.new(@size, "Parallel Installer",
+        ->(spec_install, worker_num) { do_install(spec_install, worker_num) }, response_queue: response_queue)
+    end
+
+    def response_queue
+      @response_queue ||= Thread::Queue.new
     end
 
     def do_download(spec_install, worker_num)
@@ -218,24 +216,24 @@ module Bundler
       spec_install
     end
 
-    # Dequeue a spec and save its post-install message and then enqueue the
-    # remaining specs.
-    # Some specs might've had to wait til this spec was installed to be
-    # processed so the call to `enqueue_specs` is important after every
-    # dequeue.
+    # Process one completed download or installation. Downloads can finish
+    # before their dependencies are installed, so check all downloaded specs
+    # after each completion and enqueue any that are now installable.
     def process_specs(installed_specs)
       spec = worker_pool.deq
 
       if spec.installed?
         installed_specs[spec.name] = true
-        return
       elsif spec.failed?
         return
-      elsif spec.ready_to_install?(installed_specs)
-        spec.state = :installable
       end
 
-      worker_pool.enq(spec, priority: spec.enqueue_with_priority?)
+      @specs.each do |candidate|
+        next unless candidate.ready_to_install?(installed_specs)
+
+        candidate.state = :installable
+        worker_pool.enq(candidate, priority: candidate.enqueue_with_priority?)
+      end
     end
 
     def finished_installing?
@@ -274,11 +272,8 @@ module Bundler
       t
     end
 
-    # Keys in the remains hash represent uninstalled gems specs.
-    # We enqueue all gem specs that do not have any dependencies.
-    # Later we call this lambda again to install specs that depended on
-    # previously installed specifications. We continue until all specs
-    # are installed.
+    # Queue every missing spec for download. `process_specs` schedules each
+    # downloaded spec for installation once its dependencies are installed.
     def enqueue_specs(installed_specs)
       @specs.each do |spec|
         if spec.installed?
@@ -287,7 +282,7 @@ module Bundler
         end
 
         spec.state = :enqueued
-        worker_pool.enq spec
+        download_worker_pool.enq spec
       end
     end
   end

data/{bundler/lib → lib}/bundler/installer.rb

@@ -228,18 +228,32 @@ module Bundler
     end
 
     def ensure_specs_are_compatible!
+      overrides = @definition.overrides
       @definition.specs.each do |spec|
-        unless spec.matches_current_ruby?
-          raise InstallError, "#{spec.full_name} requires ruby version #{spec.required_ruby_version}, " \
-            "which is incompatible with the current version, #{Gem.ruby_version}"
+        unless spec.matches_current_ruby_with_overrides?(overrides)
+          raise InstallError, incompatibility_message(spec, "requires ruby version #{spec.required_ruby_version}, " \
+            "which is incompatible with the current version, #{Gem.ruby_version}")
         end
-        unless spec.matches_current_rubygems?
-          raise InstallError, "#{spec.full_name} requires rubygems version #{spec.required_rubygems_version}, " \
-            "which is incompatible with the current version, #{Gem.rubygems_version}"
+        unless spec.matches_current_rubygems_with_overrides?(overrides)
+          raise InstallError, incompatibility_message(spec, "requires rubygems version #{spec.required_rubygems_version}, " \
+            "which is incompatible with the current version, #{Gem.rubygems_version}")
         end
       end
     end
 
+    # Build the error raised when a locked spec can't run on the current Ruby or
+    # RubyGems. When the offending spec is a platform-specific variant locked in
+    # frozen mode, point users at the fix: re-resolving outside frozen mode adds
+    # the Ruby (non platform-specific) fallback variant to the lockfile.
+    def incompatibility_message(spec, reason)
+      message = "#{spec.full_name} #{reason}"
+      return message unless Bundler.frozen_bundle? && spec.platform != Gem::Platform::RUBY
+
+      message + "\n\nThe lockfile only includes the #{spec.platform} variant of #{spec.name}. " \
+        "If a compatible Ruby variant is available, run `bundle install` outside of frozen/deployment mode " \
+        "to add it to the lockfile as a fallback, then commit the updated #{SharedHelpers.relative_lockfile_path}."
+    end
+
     def lock
       @definition.lock
     end

data/{bundler/lib → lib}/bundler/lazy_specification.rb

@@ -8,8 +8,9 @@ module Bundler
     include MatchPlatform
     include ForcePlatform
 
-    attr_reader :name, :version, :platform, :materialization
+    attr_reader :name, :version, :platform, :materialization, :content_address
     attr_accessor :source, :remote, :force_ruby_platform, :dependencies, :required_ruby_version, :required_rubygems_version
+    attr_accessor :overrides
 
     #
     # For backwards compatibility with existing lockfiles, if the most specific
@@ -26,20 +27,22 @@ module Bundler
     alias_method :runtime_dependencies, :dependencies
 
     def self.from_spec(s)
-      lazy_spec = new(s.name, s.version, s.platform, s.source)
+      lazy_spec = new(s.name, s.version, s.platform, s.source, content_address: s.content_address)
       lazy_spec.dependencies = s.runtime_dependencies
       lazy_spec.required_ruby_version = s.required_ruby_version
       lazy_spec.required_rubygems_version = s.required_rubygems_version
+      lazy_spec.overrides = s.overrides if s.is_a?(LazySpecification)
       lazy_spec
     end
 
-    def initialize(name, version, platform, source = nil, **materialization_options)
+    def initialize(name, version, platform, source = nil, content_address: nil, **materialization_options)
       @name          = name
       @version       = version
       @dependencies  = []
       @required_ruby_version = Gem::Requirement.default
       @required_rubygems_version = Gem::Requirement.default
       @platform = platform || Gem::Platform::RUBY
+      @content_address = content_address
 
       @original_source = source
       @source = source
@@ -63,19 +66,25 @@ module Bundler
     end
 
     def full_name
-      @full_name ||= if platform == Gem::Platform::RUBY
+      @full_name ||= if Gem::ContentAddress.content_addressed?(self, validate_ruby_abi: false)
+        "#{@name}-#{@version}-#{@content_address}"
+      elsif platform == Gem::Platform::RUBY
         "#{@name}-#{@version}"
       else
         "#{@name}-#{@version}-#{platform}"
       end
     end
 
+    def file_name
+      "#{full_name}.gem"
+    end
+
     def lock_name
       @lock_name ||= name_tuple.lock_name
     end
 
     def name_tuple
-      Gem::NameTuple.new(@name, @version, @platform)
+      Gem::NameTuple.new(@name, @version, @platform, content_address: @content_address)
     end
 
     def ==(other)
@@ -110,6 +119,16 @@ module Bundler
       @name == dependency.name && effective_requirement.satisfied_by?(Gem::Version.new(@version))
     end
 
+    ##
+    # Assigns the content address parsed from the lockfile's CONTENT
+    # ADDRESSES section. The full name embeds the content address, so its
+    # memoization must be invalidated.
+
+    def content_address=(value)
+      @content_address = value
+      @full_name = nil
+    end
+
     def to_lock
       out = String.new
       out << "    #{lock_name}\n"
@@ -128,13 +147,13 @@ module Bundler
       materialize(self, &:first)
     end
 
-    def materialized_for_installation
-      @materialization = materialize_for_installation
+    def materialized_for_installation(locked_platforms = nil)
+      @materialization = materialize_for_installation(locked_platforms)
 
       self unless incomplete?
     end
 
-    def materialize_for_installation
+    def materialize_for_installation(locked_platforms)
       source.local!
 
       if use_exact_resolved_specifications?
@@ -144,7 +163,7 @@ module Bundler
         # Exact spec is incompatible; in frozen mode, try to find a compatible platform variant
         # In non-frozen mode, return nil to trigger re-resolution and lockfile update
         if Bundler.frozen_bundle?
-          materialize([name, version]) {|specs| resolve_best_platform(specs) }
+          materialize([name, version]) {|specs| resolve_best_platform(specs, locked_platforms: locked_platforms) }
         end
       else
         materialize([name, version]) {|specs| resolve_best_platform(specs) }
@@ -185,12 +204,14 @@ module Bundler
     # Try platforms in order of preference until finding a compatible spec.
     # Used for legacy lockfiles and as a fallback when the exact locked spec
     # is incompatible. Falls back to frozen bundle behavior if none match.
-    def resolve_best_platform(specs)
-      find_compatible_platform_spec(specs) || frozen_bundle_fallback(specs)
+    def resolve_best_platform(specs, locked_platforms: nil)
+      specs = MatchPlatform.select_all_content_address_match(specs, content_address)
+
+      find_compatible_platform_spec(specs, locked_platforms: locked_platforms) || frozen_bundle_fallback(specs)
     end
 
-    def find_compatible_platform_spec(specs)
-      candidate_platforms.each do |plat|
+    def find_compatible_platform_spec(specs, locked_platforms: nil)
+      candidate_platforms(locked_platforms: locked_platforms).each do |plat|
         candidates = MatchPlatform.select_best_platform_match(specs, plat)
         spec = choose_compatible(candidates, fallback_to_non_installable: false)
         return spec if spec
@@ -200,9 +221,14 @@ module Bundler
 
     # Platforms to try in order of preference. Ruby platform is last since it
     # requires compilation, but works when precompiled gems are incompatible.
-    def candidate_platforms
+    # When a set of locked platforms is given (frozen mode), restrict the
+    # candidates to those, so we never materialize a platform that wasn't locked.
+    def candidate_platforms(locked_platforms: nil)
       target = source.is_a?(Source::Path) ? platform : Bundler.local_platform
-      [target, platform, Gem::Platform::RUBY].uniq
+      platforms = [target, platform, Gem::Platform::RUBY].uniq
+      return platforms unless locked_platforms
+
+      platforms & locked_platforms
     end
 
     # In frozen mode, accept any candidate. Will error at install time.
@@ -234,8 +260,9 @@ module Bundler
     # about the mismatch higher up the stack, right before trying to install the
     # bad gem.
     def choose_compatible(candidates, fallback_to_non_installable: Bundler.frozen_bundle?)
+      override_list = overrides || []
       search = candidates.reverse.find do |spec|
-        spec.is_a?(StubSpecification) || spec.matches_current_metadata?
+        spec.is_a?(StubSpecification) || spec.matches_current_metadata_with_overrides?(override_list)
       end
       if search.nil? && fallback_to_non_installable
         search = candidates.last
@@ -262,7 +289,7 @@ module Bundler
         spec.dependencies = dependencies
       else
         if !source.is_a?(Source::Path) && spec.runtime_dependencies.sort != dependencies.sort
-          raise IncorrectLockfileDependencies.new(self)
+          raise IncorrectLockfileDependencies.new(self, spec.runtime_dependencies, dependencies)
         end
       end
     end

data/{bundler/lib → lib}/bundler/lockfile_generator.rb

@@ -19,6 +19,7 @@ module Bundler
       add_sources
       add_platforms
       add_dependencies
+      add_content_addresses
       add_checksums
       add_locked_ruby_version
       add_bundled_with
@@ -66,10 +67,31 @@ module Bundler
       end
     end
 
+    def add_content_addresses
+      content_addresses = definition.resolve.filter_map do |spec|
+        next unless Gem::ContentAddress.content_addressed?(spec, validate_ruby_abi: false)
+
+        line = "#{spec.lock_name} #{spec.content_address}"
+
+        if definition.locked_checksums
+          checksums = spec.source.checksum_store.checksums_to_lock(spec.full_name)
+          line += " #{checksums}" if checksums
+        end
+
+        line
+      end
+
+      add_section("CONTENT ADDRESSES", content_addresses) unless content_addresses.empty?
+    end
+
     def add_checksums
       return unless definition.locked_checksums
-      checksums = definition.resolve.map do |spec|
-        spec.source.checksum_store.to_lock(spec)
+      checksums = definition.resolve.filter_map do |spec|
+        line = spec.source.checksum_store.to_lock(spec)
+
+        next if line == spec.lock_name && Gem::ContentAddress.content_addressed?(spec, validate_ruby_abi: false)
+
+        line
       end
 
       add_section("CHECKSUMS", checksums + bundler_checksum)

data/{bundler/lib → lib}/bundler/lockfile_parser.rb

@@ -41,6 +41,7 @@ module Bundler
     BUNDLED      = "BUNDLED WITH"
     DEPENDENCIES = "DEPENDENCIES"
     CHECKSUMS    = "CHECKSUMS"
+    CONTENT_ADDRESSES = "CONTENT ADDRESSES"
     PLATFORMS    = "PLATFORMS"
     RUBY         = "RUBY VERSION"
     GIT          = "GIT"
@@ -57,6 +58,7 @@ module Bundler
       Gem::Version.create("1.12") => [RUBY].freeze,
       Gem::Version.create("1.13") => [PLUGIN].freeze,
       Gem::Version.create("2.5.0") => [CHECKSUMS].freeze,
+      Gem::Version.create("4.1.0") => [CONTENT_ADDRESSES].freeze,
     }.freeze
 
     KNOWN_SECTIONS = SECTIONS_BY_VERSION_INTRODUCED.values.flatten!.freeze
@@ -95,14 +97,14 @@ module Bundler
       lockfile_contents.split(BUNDLED).last.strip
     end
 
-    def initialize(lockfile, strict: false)
+    def initialize(lockfile, strict: false, lockfile_path: nil)
       @platforms    = []
       @sources      = []
       @metadata_source = Source::Metadata.new
       @dependencies = {}
       @parse_method = nil
       @specs        = {}
-      @lockfile_path = begin
+      @lockfile_path = lockfile_path || begin
         SharedHelpers.relative_lockfile_path
       rescue GemfileNotFound
         "Gemfile.lock"
@@ -140,6 +142,8 @@ module Bundler
           # for all gemfiles that don't already explicitly include the feature.
           @checksums = true
           @parse_method = :parse_checksum
+        elsif line == CONTENT_ADDRESSES
+          @parse_method = :parse_content_address
         elsif line == PLATFORMS
           @parse_method = :parse_platform
         elsif line == RUBY
@@ -227,6 +231,16 @@ module Bundler
       $                                                  # Line end
     /xo
 
+    NAME_VERSION_CONTENT_ADDRESS = /
+      ^#{space}{2}(?!#{space})                           # Exactly 2 spaces at the start of the line
+      (.*?)                                              # Name
+      #{space}\(([^-]*)                                  # Space, followed by version
+      -(.*)\)                                            # Platform, always present for content-addressable gems
+      #{space}([0-9a-f]{8,64})                           # Content address
+      (?:#{space}([^ ]+))?                               # Optional checksums
+      $                                                  # Line end
+    /xo
+
     def parse_dependency(line)
       return unless line =~ NAME_VERSION
       spaces = $1
@@ -268,7 +282,8 @@ module Bundler
 
       version = Gem::Version.new(version)
       platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY
-      full_name = Gem::NameTuple.new(name, version, platform).full_name
+      name_tuple = Gem::NameTuple.new(name, version, platform)
+      full_name = name_tuple.full_name
       spec = @specs[full_name]
 
       if name == "bundler"
@@ -280,10 +295,33 @@ module Bundler
         checksums.split(",") do |lock_checksum|
           column = line.index(lock_checksum) + 1
           checksum = Checksum.from_lock(lock_checksum, "#{@lockfile_path}:#{@pos.line}:#{column}")
-          spec.source.checksum_store.register(spec, checksum)
+          spec.source.checksum_store.register(name_tuple, checksum)
         end
       else
-        spec.source.checksum_store.register(spec, nil)
+        spec.source.checksum_store.register(name_tuple, nil)
+      end
+    end
+
+    def parse_content_address(line)
+      return unless line =~ NAME_VERSION_CONTENT_ADDRESS
+
+      name = -$1
+      version = Gem::Version.new($2)
+      platform = Gem::Platform.new($3)
+      content_address = $4
+      checksums = $5
+
+      spec = @specs[Gem::NameTuple.new(name, version, platform).full_name]
+      return unless spec
+
+      spec.content_address = content_address
+
+      return unless checksums
+
+      checksums.split(",") do |lock_checksum|
+        column = line.index(lock_checksum) + 1
+        checksum = Checksum.from_lock(lock_checksum, "#{@lockfile_path}:#{@pos.line}:#{column}")
+        spec.source.checksum_store.register(spec, checksum)
       end
     end
 

data/{bundler/lib → lib}/bundler/man/bundle-add.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-ADD" "1" "April 2026" ""
+.TH "BUNDLE\-ADD" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-add\fR \- Add gem to the Gemfile and run bundle install
 .SH "SYNOPSIS"
@@ -46,13 +46,16 @@ Do not print progress information to the standard output\.
 Adds the gem to the Gemfile but does not install it\.
 .TP
 \fB\-\-optimistic\fR
-Adds optimistic declaration of version\.
+Ignored (now default behavior)
+.TP
+\fB\-\-pessimistic\fR
+Adds pessimistic declaration of version\.
 .TP
 \fB\-\-strict\fR
 Adds strict declaration of version\.
 .TP
 \fB\-\-cooldown=<number>\fR
-Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run\. See \fBcooldown\fR in bundle\-config(1) for precedence rules\.
+Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run, overriding every other cooldown setting, RubyGems' own included\. See \fBcooldown\fR in bundle\-config(1) for precedence rules\.
 .SH "EXAMPLES"
 .IP "1." 4
 You can add the \fBrails\fR gem to the Gemfile without any version restriction\. The source of the gem will be the global source\.
@@ -65,7 +68,7 @@ You can add the \fBrails\fR gem with version greater than 1\.1 (not including 1\
 .IP "3." 4
 You can use the \fBhttps://gems\.example\.com\fR custom source and assign the gem to a group\.
 .IP
-\fBbundle add rails \-\-version "~> 5\.0\.0" \-\-source "https://gems\.example\.com" \-\-group "development"\fR
+\fBbundle add rails \-\-version ">= 5\.0\.0" \-\-source "https://gems\.example\.com" \-\-group "development"\fR
 .IP "4." 4
 The following adds the \fBgem\fR entry to the Gemfile without installing the gem\. You can install gems later via \fBbundle install\fR\.
 .IP

data/{bundler/lib → lib}/bundler/man/bundle-add.1.ronn

@@ -51,15 +51,19 @@ Adds the named gem to the [`Gemfile(5)`][Gemfile(5)] and run `bundle install`.
   Adds the gem to the Gemfile but does not install it.
 
 * `--optimistic`:
-  Adds optimistic declaration of version.
+  Ignored (now default behavior)
+
+* `--pessimistic`:
+  Adds pessimistic declaration of version.
 
 * `--strict`:
   Adds strict declaration of version.
 
 * `--cooldown=<number>`:
   Only consider gem versions published at least <number> days ago when
-  resolving. Pass `0` to disable cooldown for this run. See `cooldown`
-  in bundle-config(1) for precedence rules.
+  resolving. Pass `0` to disable cooldown for this run, overriding every
+  other cooldown setting, RubyGems' own included. See `cooldown` in
+  bundle-config(1) for precedence rules.
 
 ## EXAMPLES
 
@@ -75,7 +79,7 @@ Adds the named gem to the [`Gemfile(5)`][Gemfile(5)] and run `bundle install`.
 3. You can use the `https://gems.example.com` custom source and assign the gem
    to a group.
 
-   `bundle add rails --version "~> 5.0.0" --source "https://gems.example.com" --group "development"`
+   `bundle add rails --version ">= 5.0.0" --source "https://gems.example.com" --group "development"`
 
 4. The following adds the `gem` entry to the Gemfile without installing the
    gem. You can install gems later via `bundle install`.

data/{bundler/lib → lib}/bundler/man/bundle-binstubs.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-BINSTUBS" "1" "April 2026" ""
+.TH "BUNDLE\-BINSTUBS" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-binstubs\fR \- Install the binstubs of the listed gems
 .SH "SYNOPSIS"

data/{bundler/lib → lib}/bundler/man/bundle-cache.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-CACHE" "1" "April 2026" ""
+.TH "BUNDLE\-CACHE" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-cache\fR \- Package your needed \fB\.gem\fR files into your application
 .SH "SYNOPSIS"
@@ -18,7 +18,7 @@ Include gems for all platforms present in the lockfile, not only the current one
 Specify a different cache path than the default (vendor/cache)\.
 .TP
 \fB\-\-cooldown=<number>\fR
-Only consider gem versions published at least \fInumber\fR days ago when resolving before caching\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
+Only consider gem versions published at least \fInumber\fR days ago when resolving before caching\. Pass \fB0\fR to disable cooldown for this run, overriding every other cooldown setting, RubyGems' own included\. See \fBcooldown\fR in bundle\-config(1)\.
 .TP
 \fB\-\-gemfile=GEMFILE\fR
 Use the specified gemfile instead of Gemfile\.

data/{bundler/lib → lib}/bundler/man/bundle-cache.1.ronn

@@ -24,8 +24,8 @@ use the gems in the cache in preference to the ones on `rubygems.org`.
 * `--cooldown=<number>`:
   Only consider gem versions published at least <number> days ago when
   resolving before caching. Pass `0` to disable cooldown for this run,
-  overriding any per-source or global configuration. See `cooldown` in
-  bundle-config(1).
+  overriding every other cooldown setting, RubyGems' own included. See
+  `cooldown` in bundle-config(1).
 
 * `--gemfile=GEMFILE`:
   Use the specified gemfile instead of Gemfile.

data/{bundler/lib → lib}/bundler/man/bundle-check.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-CHECK" "1" "April 2026" ""
+.TH "BUNDLE\-CHECK" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-check\fR \- Verifies if dependencies are satisfied by installed gems
 .SH "SYNOPSIS"

data/{bundler/lib → lib}/bundler/man/bundle-clean.1

@@ -1,6 +1,6 @@
 .\" generated with Ronn-NG/v0.10.1
 .\" http://github.com/apjanke/ronn-ng/tree/0.10.1
-.TH "BUNDLE\-CLEAN" "1" "April 2026" ""
+.TH "BUNDLE\-CLEAN" "1" "May 2026" ""
 .SH "NAME"
 \fBbundle\-clean\fR \- Cleans up unused gems in your bundler directory
 .SH "SYNOPSIS"