rubygems-update 4.0.22 → 4.0.23

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 749ce900ad671da4cc10f224bc056fd01abb570ad1ea631796dad9f33025b538
-  data.tar.gz: 71a19e66013da25a69f73e12f96251f8615463e9f805fbd4be14003ff7f2395a
+  metadata.gz: 2260352c2624a3ae9cf0e6097f01885b629db9bc4bb4896e8ba2553ecf18f49d
+  data.tar.gz: da371b40f613b3681bcc75cbc9f1a13e4813ee7bfd1f7808ebaf41d76080d8db
 SHA512:
-  metadata.gz: 0e2f312ea9515fbabdd056db9d9233f8557243c4060cb8ebb15e1394c55624b6d23eaadfd40a512baca8ea70ec1dd1c5e521744d532ce3ef3c256d7e133356ed
-  data.tar.gz: d961561440e32ad0f6768f2db8a2a73a098df218219c13b3d66dd3b7c013fb7c75fe71ffb8a9ecd52901525e239ef92fb28a897ea317ef337034525029afa070
+  metadata.gz: 4f7bc18982adcbcf73382c37cea141c266e0d5fd1b2c3814c337fc04cac281f6d774c129312665dafad70fb8aa65e69ba389c8bd7dabd315d5feb8988e9f00ca
+  data.tar.gz: 4f4be770ef448f4ab13a3bccf91305148edc604327190c0dccbbdcab3ebf36bb46af49b1b2681e2922b792cb75e7c82301dce04371ef79e840190eb4d6d61670

data/CHANGELOG.md

@@ -1,10 +1,19 @@
 # Changelog
 
+## 4.0.23 / 2026-10-14
+
+### Enhancements:
+
+* Update vendored gems to latest versions. Pull request [#9948](https://github.com/ruby/rubygems/pull/9948) by Hiroshi SHIBATA
+* Drop setuid, setgid and sticky bits when extracting gems. Pull request [#9929](https://github.com/ruby/rubygems/pull/9929) by Hiroshi SHIBATA
+* Improve handling of paths with invalid Windows characters. Pull request [#9276](https://github.com/ruby/rubygems/pull/9276) by Said Kaldybaev and Hiroshi SHIBATA
+* Installs bundler 4.0.23 as a default gem.
+
 ## 4.0.22 / 2026-09-30
 
 ### Enhancements:
 
-* Add --source option to gem exec command. Pull request [#9765](https://github.com/ruby/rubygems/pull/9765) by Akshay Birajdar and Akshay Birajdar
+* Add --source option to gem exec command. Pull request [#9765](https://github.com/ruby/rubygems/pull/9765) by Akshay Birajdar
 * Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
 * Validate the version field in Gem::Installer#verify_spec. Pull request [#9890](https://github.com/ruby/rubygems/pull/9890) by Hiroshi SHIBATA
 * Installs bundler 4.0.22 as a default gem.

data/Manifest.txt

@@ -566,7 +566,7 @@ lib/rubygems/vendor/net-http/lib/net/http/response.rb
 lib/rubygems/vendor/net-http/lib/net/http/responses.rb
 lib/rubygems/vendor/net-http/lib/net/http/status.rb
 lib/rubygems/vendor/net-http/lib/net/https.rb
-lib/rubygems/vendor/net-protocol/LICENSE.txt
+lib/rubygems/vendor/net-protocol/COPYING
 lib/rubygems/vendor/net-protocol/lib/net/protocol.rb
 lib/rubygems/vendor/optparse/COPYING
 lib/rubygems/vendor/optparse/lib/optionparser.rb

data/bundler/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 4.0.23 / 2026-10-14
+
+### Enhancements:
+
+* Update vendored gems to latest versions. Pull request [#9948](https://github.com/ruby/rubygems/pull/9948) by Hiroshi SHIBATA
+
+### Bug fixes:
+
+* Stop retrying a 416 response to a request without Range. Pull request [#9938](https://github.com/ruby/rubygems/pull/9938) by Hiroshi SHIBATA
+* Respect Gemfile lockfile in `bundle lock`. Pull request [#9661](https://github.com/ruby/rubygems/pull/9661) by David Stosik and Hiroshi SHIBATA
+
 ## 4.0.22 / 2026-09-30
 
 ### Enhancements:

data/bundler/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-09-30".freeze
-    @git_commit_sha = "ff2bd50".freeze
+    @built_at = "2026-10-14".freeze
+    @git_commit_sha = "642a23e".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/bundler/lib/bundler/cli/lock.rb

@@ -75,10 +75,21 @@ module Bundler
           puts definition.to_lock
         else
           file = options[:lockfile]
-          file = file ? Pathname.new(file).expand_path : Bundler.default_lockfile
+          file = if file
+            Pathname.new(file).expand_path
+          elsif ENV["BUNDLE_LOCKFILE"].to_s.empty?
+            definition.lockfile
+          else
+            # BUNDLE_LOCKFILE outranks the lockfile method in the Gemfile, see gemfile(5)
+            Bundler.default_lockfile
+          end
 
-          puts "Writing lockfile to #{file}"
-          definition.write_lock(file, false)
+          if file
+            puts "Writing lockfile to #{file}"
+            definition.write_lock(file, false)
+          else
+            Bundler.ui.warn "Not writing a lockfile because the Gemfile sets `lockfile false`"
+          end
         end
 
         Bundler::CLI::Common.output_cooldown_skipped_summary(definition)

data/bundler/lib/bundler/fetcher/downloader.rb

@@ -57,6 +57,8 @@ module Bundler
           end
           fetch(new_uri, headers, counter + 1)
         when Gem::Net::HTTPRequestedRangeNotSatisfiable
+          raise bad_response(response) unless headers.key?("Range")
+
           new_headers = headers.dup
           new_headers.delete("Range")
           fetch(uri, new_headers)
@@ -72,9 +74,7 @@ module Bundler
         when Gem::Net::HTTPNotFound
           raise FallbackError, "Gem::Net::HTTPNotFound: #{filtered_uri}"
         else
-          message = "Gem::#{response.class.name.gsub(/\AGem::/, "")}"
-          message += ": #{response.body}" unless response.body.empty?
-          raise HTTPError, message
+          raise bad_response(response)
         end
       end
 
@@ -110,6 +110,12 @@ module Bundler
 
       private
 
+      def bad_response(response)
+        message = "Gem::#{response.class.name.gsub(/\AGem::/, "")}"
+        message += ": #{response.body}" unless response.body.empty?
+        HTTPError.new(message)
+      end
+
       def https?(uri)
         uri.scheme&.casecmp("https")&.zero?
       end

data/bundler/lib/bundler/vendor/connection_pool/lib/connection_pool/timed_stack.rb

@@ -54,9 +54,12 @@ class Bundler::ConnectionPool::TimedStack
   # immediately returned. If no connection is available within the given
   # timeout a Bundler::ConnectionPool::TimeoutError is raised.
   #
-  # +:timeout+ is the only checked entry in +options+ and is preferred over
-  # the +timeout+ argument (which will be removed in a future release). Other
-  # options may be used by subclasses that extend TimedStack.
+  # @option options [Float] :timeout (0.5) Wait this many seconds for an available entry
+  # @option options [Class] :exception (Bundler::ConnectionPool::TimeoutError) Exception class to raise
+  #   if an entry was not available within the timeout period. Use `exception: false` to return nil.
+  #
+  # The +timeout+ argument will be removed in 3.0.
+  # Other options may be used by subclasses that extend TimedStack.
   def pop(timeout = 0.5, options = {})
     options, timeout = timeout, 0.5 if Hash === timeout
     timeout = options.fetch :timeout, timeout
@@ -73,7 +76,14 @@ class Bundler::ConnectionPool::TimedStack
         return connection if connection
 
         to_wait = deadline - current_time
-        raise Bundler::ConnectionPool::TimeoutError, "Waited #{timeout} sec, #{length}/#{@max} available" if to_wait <= 0
+        if to_wait <= 0
+          exc = options.fetch(:exception, Bundler::ConnectionPool::TimeoutError)
+          if exc
+            raise Bundler::ConnectionPool::TimeoutError, "Waited #{timeout} sec, #{length}/#{@max} available"
+          else
+            return nil
+          end
+        end
         @resource.wait(@mutex, to_wait)
       end
     end

data/bundler/lib/bundler/vendor/connection_pool/lib/connection_pool/version.rb

@@ -1,3 +1,3 @@
 class Bundler::ConnectionPool
-  VERSION = "2.5.4"
+  VERSION = "2.5.5"
 end

data/bundler/lib/bundler/vendor/connection_pool/lib/connection_pool.rb

@@ -104,6 +104,9 @@ class Bundler::ConnectionPool
   end
 
   def with(options = {})
+    # We need to manage exception handling manually here in order
+    # to work correctly with `Gem::Timeout.timeout` and `Thread#raise`.
+    # Otherwise an interrupted Thread can leak connections.
     Thread.handle_interrupt(Exception => :never) do
       conn = checkout(options)
       begin

data/bundler/lib/bundler/vendor/fileutils/lib/fileutils.rb

@@ -181,7 +181,7 @@ end
 #
 module Bundler::FileUtils
   # The version number.
-  VERSION = "1.8.0"
+  VERSION = "1.8.1"
 
   def self.private_module_function(name)   #:nodoc:
     module_function name
@@ -279,38 +279,67 @@ module Bundler::FileUtils
   end
   private_module_function :remove_trailing_slash
 
+  # :markup: markdown
   #
-  # Creates directories at the paths in the given +list+
-  # (a single path or an array of paths);
-  # returns +list+ if it is an array, <tt>[list]</tt> otherwise.
+  # call-seq:
+  #   Bundler::FileUtils.mkdir(*paths, mode: 0775, noop: nil, verbose: nil) -> array_of_paths or nil
   #
-  # Argument +list+ or its elements
-  # should be {interpretable as paths}[rdoc-ref:FileUtils@Path+Arguments].
+  # Argument `paths` may be one path or an array of paths;
+  # each must be {interpretable as a path}[rdoc-ref:FileUtils@Path+Arguments].
   #
-  # With no keyword arguments, creates a directory at each +path+ in +list+
-  # by calling: <tt>Dir.mkdir(path, mode)</tt>;
-  # see {Dir.mkdir}[https://docs.ruby-lang.org/en/master/Dir.html#method-c-mkdir]:
+  # By default, creates a directory entry at each of the given `paths`;
+  # each directory has permissions `0775`;
+  # returns an array of the paths:
   #
-  #   Bundler::FileUtils.mkdir(%w[tmp0 tmp1]) # => ["tmp0", "tmp1"]
-  #   Bundler::FileUtils.mkdir('tmp4')        # => ["tmp4"]
+  # ```ruby
+  # Bundler::FileUtils.mkdir('foo')                 # => ["foo"]
+  # Bundler::FileUtils.mkdir(%w[bar baz])           # => ["bar", "baz"]
+  # File.stat(Dir.new('foo')).mode.to_s(8) # => "40775"
+  # File.stat(Dir.new('bar')).mode.to_s(8) # => "40775"
+  # File.stat(Dir.new('baz')).mode.to_s(8) # => "40775"
+  # Bundler::FileUtils.rmdir(%w[foo bar baz])       # => ["foo", "bar", "baz"]
+  # ```
   #
-  # Keyword arguments:
+  # Raises an exception if for any reason a directory cannot be created;
+  # a common reason is that the directory already exists.
   #
-  # - <tt>mode: <i>mode</i></tt> - also calls <tt>File.chmod(mode, path)</tt>;
-  #   see {File.chmod}[https://docs.ruby-lang.org/en/master/File.html#method-c-chmod].
-  # - <tt>noop: true</tt> - does not create directories.
-  # - <tt>verbose: true</tt> - prints an equivalent command:
+  # With keyword argument `mode` given,
+  # creates directories with the given permissions:
   #
-  #     Bundler::FileUtils.mkdir(%w[tmp0 tmp1], verbose: true)
-  #     Bundler::FileUtils.mkdir(%w[tmp2 tmp3], mode: 0700, verbose: true)
+  # ```ruby
+  # Bundler::FileUtils.mkdir('bar', mode: 0664)
+  # File.stat(Dir.new('bar')).mode.to_s(8) # => "40664"
+  # Bundler::FileUtils.rmdir('bar')
+  # ```
   #
-  #   Output:
+  # With keyword argument `noop` given as `true`,
+  # does not create directories;
+  # returns `nil`
+  #
+  # ```ruby
+  # Bundler::FileUtils.mkdir('foo', noop: true) # => nil
+  # Dir.exist?('foo')                  # => false
+  # ```
+  #
+  # With keyword argument `verbose` given as `true`,
+  # prints a shell command:
   #
-  #     mkdir tmp0 tmp1
-  #     mkdir -m 700 tmp2 tmp3
+  # ```ruby
+  # Bundler::FileUtils.mkdir('foo', verbose: true)
+  # Bundler::FileUtils.mkdir(%w[bar baz], mode: 0644, verbose: true)
+  # Bundler::FileUtils.mkdir(%w[bar baz], mode: 0644, verbose: true, noop: true)
+  # ```
   #
-  # Raises an exception if any path points to an existing
-  # file or directory, or if for any reason a directory cannot be created.
+  # Output:
+  #
+  # ```text
+  # mkdir foo
+  # mkdir -m 644 bar baz
+  # mkdir -m 644 bar baz
+  # ```
+  #
+  # Note that in the last call above (containing `noop: true`)
+  # the existence of the directory is not checked.
   #
   # Related: Bundler::FileUtils.mkdir_p.
   #
@@ -686,7 +715,7 @@ module Bundler::FileUtils
   # Keyword arguments:
   #
   # - <tt>force: true</tt> - overwrites +dest+ if it exists.
-  # - <tt>relative: false</tt> - create links relative to +dest+.
+  # - <tt>relative: true</tt> - create links relative to +dest+.
   # - <tt>noop: true</tt> - does not create links.
   # - <tt>verbose: true</tt> - prints an equivalent command:
   #
@@ -754,7 +783,7 @@ module Bundler::FileUtils
         n = real_ddirs.size - i
         n -= 1 unless target_directory
         link2 = fu_clean_components(*Array.new([n, 0].max, '..'), *real_sdirs[i..-1])
-        link1 = link2 if link1.size > link2.size
+        link1 = link2 if !link2.empty? and link1.size > link2.size
       end
       s = File.join(link1)
       fu_output_message [cmd, s, d].flatten.join(' ') if verbose
@@ -2037,10 +2066,6 @@ module Bundler::FileUtils
       def fu_windows?; false end #:nodoc:
     end
 
-    def fu_copy_stream0(src, dest, blksize = nil)   #:nodoc:
-      IO.copy_stream(src, dest)
-    end
-
     def fu_stream_blksize(*streams) #:nodoc:
       streams.each do |s|
         next unless s.respond_to?(:stat)

data/bundler/lib/bundler/vendor/net-http-persistent/lib/net/http/persistent/pool.rb

@@ -4,7 +4,7 @@ class Gem::Net::HTTP::Persistent::Pool < Bundler::ConnectionPool # :nodoc:
   attr_reader :key # :nodoc:
 
   def initialize(options = {}, &block)
-    super
+    super(**options, &block)
 
     @available = Gem::Net::HTTP::Persistent::TimedStackMulti.new(@size, &block)
     @key = "current-#{@available.object_id}"

data/bundler/lib/bundler/vendor/net-http-persistent/lib/net/http/persistent/timed_stack_multi.rb

@@ -1,5 +1,10 @@
 class Gem::Net::HTTP::Persistent::TimedStackMulti < Bundler::ConnectionPool::TimedStack # :nodoc:
 
+  ##
+  # Detects if Bundler::ConnectionPool 3.0+ is being used (needed for TimedStack subclass compatibility)
+
+  CP_USES_KEYWORD_ARGS = Gem::Version.new(Bundler::ConnectionPool::VERSION) >= Gem::Version.new('3.0.0') # :nodoc:
+
   ##
   # Returns a new hash that has arrays for keys
   #
@@ -11,7 +16,11 @@ class Gem::Net::HTTP::Persistent::TimedStackMulti < Bundler::ConnectionPool::Tim
   end
 
   def initialize(size = 0, &block)
-    super
+    if CP_USES_KEYWORD_ARGS
+      super(size: size, &block)
+    else
+      super(size, &block)
+    end
 
     @enqueued = 0
     @ques = self.class.hash_of_arrays

data/bundler/lib/bundler/vendor/net-http-persistent/lib/net/http/persistent.rb

@@ -1,10 +1,7 @@
 require_relative '../../../../../vendored_net_http'
 require_relative '../../../../../vendored_uri'
-begin
-  require 'cgi/escape'
-rescue LoadError
-  require 'cgi/util' # for escaping
-end
+require 'cgi/escape'
+require 'cgi/util' unless defined?(CGI::EscapeExt)
 require_relative '../../../../connection_pool/lib/connection_pool'
 
 autoload :OpenSSL, 'openssl'
@@ -180,7 +177,7 @@ class Gem::Net::HTTP::Persistent
   ##
   # The version of Gem::Net::HTTP::Persistent you are using
 
-  VERSION = '4.0.6'
+  VERSION = '4.0.8'
 
   ##
   # Error class for errors raised by Gem::Net::HTTP::Persistent.  Various
@@ -475,6 +472,13 @@ class Gem::Net::HTTP::Persistent
 
   attr_reader :verify_hostname
 
+
+  ##
+  #  Sets whether to ignore end-of-file when reading a response body
+  #  with Content-Length headers.
+
+  attr_accessor :ignore_eof
+
   ##
   # Creates a new Gem::Net::HTTP::Persistent.
   #
@@ -514,6 +518,7 @@ class Gem::Net::HTTP::Persistent
     @max_retries      = 1
     @socket_options   = []
     @ssl_generation   = 0 # incremented when SSL session variables change
+    @ignore_eof       = nil
 
     @socket_options << [Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1] if
       Socket.const_defined? :TCP_NODELAY
@@ -642,6 +647,7 @@ class Gem::Net::HTTP::Persistent
         reset connection
       end
 
+      http.ignore_eof         = @ignore_eof    if @ignore_eof
       http.keep_alive_timeout = @idle_timeout  if @idle_timeout
       http.max_retries        = @max_retries   if http.respond_to?(:max_retries=)
       http.read_timeout       = @read_timeout  if @read_timeout

data/bundler/lib/bundler/vendor/thor/lib/thor/actions/inject_into_file.rb

@@ -2,6 +2,38 @@ require_relative "empty_directory"
 
 class Bundler::Thor
   module Actions
+    WARNINGS = {unchanged_no_flag: "File unchanged! Either the supplied flag value not found or the content has already been inserted!"}
+
+    # Injects the given content into a file, raising an error if the contents of
+    # the file are not changed. Different from gsub_file, this method is reversible.
+    #
+    # ==== Parameters
+    # destination<String>:: Relative path to the destination root
+    # data<String>:: Data to add to the file. Can be given as a block.
+    # config<Hash>:: give :verbose => false to not log the status and the flag
+    #                for injection (:after or :before) or :force => true for
+    #                insert two or more times the same content.
+    #
+    # ==== Examples
+    #
+    #   insert_into_file "config/environment.rb", "config.gem :thor", :after => "Rails::Initializer.run do |config|\n"
+    #
+    #   insert_into_file "config/environment.rb", :after => "Rails::Initializer.run do |config|\n" do
+    #     gems = ask "Which gems would you like to add?"
+    #     gems.split(" ").map{ |gem| "  config.gem :#{gem}" }.join("\n")
+    #   end
+    #
+    def insert_into_file!(destination, *args, &block)
+      data = block_given? ? block : args.shift
+
+      config = args.shift || {}
+      config[:after] = /\z/ unless config.key?(:before) || config.key?(:after)
+      config = config.merge({error_on_no_change: true})
+
+      action InjectIntoFile.new(self, destination, data, config)
+    end
+    alias_method :inject_into_file!, :insert_into_file!
+
     # Injects the given content into a file. Different from gsub_file, this
     # method is reversible.
     #
@@ -21,8 +53,6 @@ class Bundler::Thor
     #     gems.split(" ").map{ |gem| "  config.gem :#{gem}" }.join("\n")
     #   end
     #
-    WARNINGS = {unchanged_no_flag: "File unchanged! Either the supplied flag value not found or the content has already been inserted!"}
-
     def insert_into_file(destination, *args, &block)
       data = block_given? ? block : args.shift
 
@@ -47,6 +77,7 @@ class Bundler::Thor
 
         @replacement = data.is_a?(Proc) ? data.call : data
         @flag = Regexp.escape(@flag) unless @flag.is_a?(Regexp)
+        @error_on_no_change = @config.fetch(:error_on_no_change, false)
       end
 
       def invoke!
@@ -59,6 +90,8 @@ class Bundler::Thor
         if exists?
           if replace!(/#{flag}/, content, config[:force])
             say_status(:invoke)
+          elsif @error_on_no_change
+            raise Bundler::Thor::Error, "The content of #{destination} did not change"
           elsif replacement_present?
             say_status(:unchanged, color: :blue)
           else

data/bundler/lib/bundler/vendor/thor/lib/thor/base.rb

@@ -13,8 +13,9 @@ class Bundler::Thor
   autoload :RakeCompat, File.expand_path("rake_compat", __dir__)
   autoload :Group,      File.expand_path("group", __dir__)
 
-  # Shortcuts for help.
+  # Shortcuts for help and tree commands.
   HELP_MAPPINGS       = %w(-h -? --help -D)
+  TREE_MAPPINGS       = %w(-t --tree)
 
   # Bundler::Thor methods that should not be overwritten by the user.
   THOR_RESERVED_WORDS = %w(invoke shell options behavior root destination_root relative_root

data/bundler/lib/bundler/vendor/thor/lib/thor/shell/basic.rb

@@ -311,13 +311,11 @@ class Bundler::Thor
       end
 
       def show_diff(destination, content) #:nodoc:
-        diff_cmd = ENV["THOR_DIFF"] || ENV["RAILS_DIFF"] || "diff -u"
-
         require "tempfile"
         Tempfile.open(File.basename(destination), File.dirname(destination), binmode: true) do |temp|
           temp.write content
           temp.rewind
-          system %(#{diff_cmd} "#{destination}" "#{temp.path}")
+          system(*diff_tool, destination, temp.path)
         end
       end
 
@@ -369,15 +367,25 @@ class Bundler::Thor
 
       def merge(destination, content) #:nodoc:
         require "tempfile"
-        Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination)) do |temp|
+        Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination), binmode: true) do |temp|
           temp.write content
           temp.rewind
-          system(merge_tool, temp.path, destination)
+          system(*merge_tool, temp.path, destination)
         end
       end
 
       def merge_tool #:nodoc:
-        @merge_tool ||= ENV["THOR_MERGE"] || "git difftool --no-index"
+        @merge_tool ||= begin
+          require "shellwords"
+          Shellwords.split(ENV["THOR_MERGE"] || "git difftool --no-index")
+        end
+      end
+
+      def diff_tool #:nodoc:
+        @diff_cmd ||= begin
+          require "shellwords"
+          Shellwords.split(ENV["THOR_DIFF"] || ENV["RAILS_DIFF"] || "diff -u")
+        end
       end
     end
   end

data/bundler/lib/bundler/vendor/thor/lib/thor/shell/color.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "basic"
 
 class Bundler::Thor

data/bundler/lib/bundler/vendor/thor/lib/thor/version.rb

@@ -1,3 +1,3 @@
 class Bundler::Thor
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

data/bundler/lib/bundler/vendor/thor/lib/thor.rb

@@ -625,7 +625,7 @@ class Bundler::Thor
     # alias name.
     def find_command_possibilities(meth)
       len = meth.to_s.length
-      possibilities = all_commands.reject { |_k, c| c.hidden? }.merge(map).keys.select { |n| meth == n[0, len] }.sort
+      possibilities = all_commands.reject {|k, v| v.is_a?(HiddenCommand) }.merge(map).keys.select { |n| meth == n[0, len] }.sort
       unique_possibilities = possibilities.map { |k| map[k] || k }.uniq
 
       if possibilities.include?(meth)
@@ -671,4 +671,37 @@ class Bundler::Thor
       self.class.help(shell, subcommand)
     end
   end
+
+  map TREE_MAPPINGS => :tree
+
+  desc "tree", "Print a tree of all available commands"
+  def tree
+    build_command_tree(self.class, "")
+  end
+
+private
+
+  def build_command_tree(klass, indent)
+    # Print current class name if it's not the root Bundler::Thor class
+    unless klass == Bundler::Thor
+      say "#{indent}#{klass.namespace || 'default'}", :blue
+      indent = "#{indent}  "
+    end
+
+    # Print all commands for this class
+    visible_commands = klass.commands.reject { |_, cmd| cmd.hidden? || cmd.name == "help" }
+    commands_count = visible_commands.count
+    visible_commands.sort.each_with_index do |(command_name, command), i|
+      description = command.description.split("\n").first || ""
+      icon = i == (commands_count - 1) ? "└─" : "├─"
+      say "#{indent}#{icon} ", nil, false
+      say command_name, :green, false
+      say " (#{description})" unless description.empty?
+    end
+
+    # Print all subcommands (from registered Bundler::Thor subclasses)
+    klass.subcommand_classes.each do |_, subclass|
+      build_command_tree(subclass, indent)
+    end
+  end
 end

data/bundler/lib/bundler/vendor/uri/lib/uri/common.rb

@@ -271,7 +271,7 @@ module Bundler::URI
   #   # => #<Bundler::URI::HTTP http://example.com/foo/bar>
   #
   def self.join(*str)
-    DEFAULT_PARSER.join(*str)
+    PARSER.join(*str)
   end
 
   #

data/bundler/lib/bundler/vendor/uri/lib/uri/generic.rb

@@ -466,7 +466,7 @@ module Bundler::URI
     #
     #   uri = Bundler::URI.parse("http://john:S3nsit1ve@my.example.com")
     #   uri.user = "sam"
-    #   uri.to_s  #=> "http://sam:V3ry_S3nsit1ve@my.example.com"
+    #   uri.to_s  #=> "http://sam@my.example.com"
     #
     def user=(user)
       check_user(user)
@@ -1021,9 +1021,21 @@ module Bundler::URI
 
       # RFC2396, Section 5.2, 6), a)
       base_path << '' if base_path.last == '..'
-      while i = base_path.index('..')
-        base_path.slice!(i - 1, 2)
+      # Remove "<segment>/.." pairs in a single left-to-right pass (O(n)).
+      # This deliberately differs from the relative-path stack handling
+      # below: a leading ".." (one with no preceding segment left to
+      # cancel) discards the whole base path, reproducing the previous
+      # index/slice! implementation exactly.
+      reduced = []
+      base_path.each do |seg|
+        if seg == '..'
+          break if reduced.empty?
+          reduced.pop
+        else
+          reduced << seg
+        end
       end
+      base_path = reduced
 
       if (first = rel_path.first) and first.empty?
         base_path.clear

data/bundler/lib/bundler/vendor/uri/lib/uri/version.rb

@@ -1,6 +1,6 @@
 module Bundler::URI
   # :stopdoc:
-  VERSION = '1.1.1'.freeze
+  VERSION = '1.1.2'.freeze
   VERSION_CODE = VERSION.split('.').map{|s| s.rjust(2, '0')}.join.freeze
   # :startdoc:
 end

data/bundler/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.22".freeze
+  VERSION = "4.0.23".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first