rubygems-update 4.0.23 → 4.0.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2260352c2624a3ae9cf0e6097f01885b629db9bc4bb4896e8ba2553ecf18f49d
-  data.tar.gz: da371b40f613b3681bcc75cbc9f1a13e4813ee7bfd1f7808ebaf41d76080d8db
+  metadata.gz: 12a02c6521aff4409e80855dadfcdb2d47008984e7e9b469e4be1d747160a981
+  data.tar.gz: 8e53022237b43998ae24f8c8860b6cb10438a4ccc0fb51f95f4e43a449857f57
 SHA512:
-  metadata.gz: 4f7bc18982adcbcf73382c37cea141c266e0d5fd1b2c3814c337fc04cac281f6d774c129312665dafad70fb8aa65e69ba389c8bd7dabd315d5feb8988e9f00ca
-  data.tar.gz: 4f4be770ef448f4ab13a3bccf91305148edc604327190c0dccbbdcab3ebf36bb46af49b1b2681e2922b792cb75e7c82301dce04371ef79e840190eb4d6d61670
+  metadata.gz: c0efca98d58afb043fcd127dbccdf77d465b555473891fa19214745ce7b0b55312982cd694ac96a7c0b5311df89865fa5a813a990afad52091fb055bc625e9d2
+  data.tar.gz: 1100a548b7b270a14f9cea5dbb1cb9d8b71da3991ca501862c32028a2ba1816c9300cbbbe1f66ff89dca5a9bb6dc17fa8fe08e4375ed7e1035da1825542058ed

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 4.0.24 / 2026-11-05
+
+### Enhancements:
+
+* Installs bundler 4.0.24 as a default gem.
+
+### Bug fixes:
+
+* Skip executable removal gracefully when the bin directory is missing. Pull request [#9963](https://github.com/ruby/rubygems/pull/9963) by Evan Li and Hiroshi SHIBATA
+* Fix file locks letting multiple processes in when lock files are removed. Pull request [#9930](https://github.com/ruby/rubygems/pull/9930) by Richard Janita and Hiroshi SHIBATA
+* Turn off echo before printing the password prompt. Pull request [#9969](https://github.com/ruby/rubygems/pull/9969) by Mike Dalessio
+
+### Documentation:
+
+* [DOC] Fix link. Pull request [#10014](https://github.com/ruby/rubygems/pull/10014) by Burdette Lamar
+
 ## 4.0.23 / 2026-10-14
 
 ### Enhancements:

data/bundler/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 4.0.24 / 2026-11-05
+
+### Enhancements:
+
+* Read the Ruby version from mise's inline table form. Pull request [#9991](https://github.com/ruby/rubygems/pull/9991) by Hiroshi SHIBATA
+* Report which locked gems can't be materialized for the current platform. Pull request [#9738](https://github.com/ruby/rubygems/pull/9738) by Muhammad Moussa
+
+### Bug fixes:
+
+* Fix `bundle exec` with no arguments for paths containing spaces. Pull request [#9996](https://github.com/ruby/rubygems/pull/9996) by Brandon Weiss
+* Respect enclosing platforms and install_if for gemspec development dependencies. Pull request [#9992](https://github.com/ruby/rubygems/pull/9992) by Hiroshi SHIBATA
+* Respect enclosing group and platforms for gemspec dependencies. Pull request [#9990](https://github.com/ruby/rubygems/pull/9990) by Denis Talakevich
+* Don't report locked gems in the cooldown summary. Pull request [#9981](https://github.com/ruby/rubygems/pull/9981) by Patrik Ragnarsson
+* Make `Bundler::Source::Rubygems#hash` agree with `eql?`. Pull request [#9983](https://github.com/ruby/rubygems/pull/9983) by Hiroshi SHIBATA
+* Add checksums after platform changes in `bundle lock`. Pull request [#9960](https://github.com/ruby/rubygems/pull/9960) by Farid Zakaria
+* Apply BUNDLE_RETRY to lazy gemspec downloads. Pull request [#9868](https://github.com/ruby/rubygems/pull/9868) by Islam Elsayed
+* Fix file locks letting multiple processes in when lock files are removed. Pull request [#9930](https://github.com/ruby/rubygems/pull/9930) by Richard Janita and Hiroshi SHIBATA
+
 ## 4.0.23 / 2026-10-14
 
 ### Enhancements:

data/bundler/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-10-14".freeze
-    @git_commit_sha = "642a23e".freeze
+    @built_at = "2026-11-05".freeze
+    @git_commit_sha = "3b396e4".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/bundler/lib/bundler/cli/exec.rb

@@ -24,7 +24,7 @@ module Bundler
           kernel_load(bin_path, *args)
         else
           bin_path = explicit_path(bin_path)
-          kernel_exec(bin_path, *args)
+          kernel_exec([bin_path, bin_path], *args)
         end
       else
         # exec using the given command

data/bundler/lib/bundler/cli/lock.rb

@@ -43,7 +43,6 @@ module Bundler
 
       Bundler.settings.temporary(frozen: false) do
         definition = Bundler.definition(update, Bundler.default_lockfile)
-        definition.add_checksums if options["add-checksums"]
 
         Bundler::CLI::Common.configure_gem_version_promoter(definition, options) if options[:update]
 
@@ -65,6 +64,11 @@ module Bundler
           raise InvalidOption, "Removing all platforms from the bundle is not allowed"
         end
 
+        # Adding checksums resolves the bundle to fetch them, so it has to
+        # run after every platform change above has been recorded, or the
+        # new platforms are listed in the lockfile without their specs.
+        definition.add_checksums if options["add-checksums"]
+
         definition.remotely! unless options[:local]
 
         if options["normalize-platforms"]

data/bundler/lib/bundler/definition.rb

@@ -748,7 +748,9 @@ module Bundler
       loop do
         break if incomplete_specs.empty?
 
-        Bundler.ui.debug("The lockfile does not have all gems needed for the current platform though, Bundler will still re-resolve dependencies")
+        Bundler.ui.debug("The lockfile does not have all gems needed for the current platform (#{Bundler.local_platform}) though, " \
+                         "Bundler will still re-resolve dependencies. The following locked gems could not be materialized for it: " \
+                         "#{incomplete_specs.map(&:full_name).join(", ")}")
         sources.remote!
         reresolve_without(incomplete_specs)
         specs = resolve.materialize(dependencies)

data/bundler/lib/bundler/dsl.rb

@@ -80,11 +80,15 @@ module Bundler
         @gemspecs << spec
 
         path path, "glob" => glob, "name" => spec.name, "gemspec" => spec do
-          add_dependency spec.name
+          options = {}
+          normalize_options(spec.name, [], options)
+          add_dependency spec.name, nil, options
         end
 
         spec.development_dependencies.each do |dep|
-          add_dependency dep.name, dep.requirement.as_list, "gemspec_dev_dep" => true, "group" => development_group
+          options = {}
+          normalize_options(dep.name, dep.requirement.as_list, options)
+          add_dependency dep.name, dep.requirement.as_list, options.merge("gemspec_dev_dep" => true, "group" => development_group)
         end
       when 0
         raise InvalidOption, "There are no gemspecs at #{expanded_path}"

data/bundler/lib/bundler/fetcher.rb

@@ -156,7 +156,10 @@ module Bundler
       elsif cached_spec_path = gemspec_cached_path(spec_file_name)
         Bundler.load_gemspec(cached_spec_path)
       else
-        Bundler.safe_load_marshal Bundler.rubygems.inflate(downloader.fetch(uri).body)
+        body = Bundler::Retry.new("fetcher", FAIL_ERRORS).attempts do
+          downloader.fetch(uri).body
+        end
+        Bundler.safe_load_marshal Bundler.rubygems.inflate(body)
       end
       raise MarshalError, "is #{spec.inspect}" unless spec.is_a?(Gem::Specification)
       spec

data/bundler/lib/bundler/man/gemfile.5

@@ -461,6 +461,8 @@ The \fBgemspec\fR method adds any runtime dependencies as gem requirements in th
 .P
 The \fBgemspec\fR method supports optional \fB:path\fR, \fB:glob\fR, \fB:name\fR, and \fB:development_group\fR options, which control where bundler looks for the \fB\.gemspec\fR, the glob it uses to look for the gemspec (defaults to: \fB{,*,*/*}\.gemspec\fR), what named \fB\.gemspec\fR it uses (if more than one is present), and which group development dependencies are included in\.
 .P
+When \fBgemspec\fR is called inside a \fBgroup\fR block, the gem requirement on your project goes into that group instead of the default group, and so do its runtime dependencies\. Development dependencies stay in the \fBdevelopment\fR group, or the group given by \fB:development_group\fR\. An enclosing \fBplatforms\fR or \fBinstall_if\fR block applies to the project and its development dependencies alike\.
+.P
 When a \fBgemspec\fR dependency encounters version conflicts during resolution, the local version under development will always be selected \-\- even if there are remote versions that better match other requirements for the \fBgemspec\fR gem\.
 .SH "EVAL_GEMFILE"
 A Gemfile \fBMAY\fR be split across multiple files\. The \fBeval_gemfile\fR method reads the contents of another file as if they appeared in the current Gemfile\. A relative path is resolved against the directory of the file containing the call\.

data/bundler/lib/bundler/man/gemfile.5.ronn

@@ -546,6 +546,12 @@ options, which control where bundler looks for the `.gemspec`, the glob it uses
 for the gemspec (defaults to: `{,*,*/*}.gemspec`), what named `.gemspec` it uses
 (if more than one is present), and which group development dependencies are included in.
 
+When `gemspec` is called inside a `group` block, the gem requirement on your
+project goes into that group instead of the default group, and so do its runtime
+dependencies. Development dependencies stay in the `development` group, or the
+group given by `:development_group`. An enclosing `platforms` or `install_if`
+block applies to the project and its development dependencies alike.
+
 When a `gemspec` dependency encounters version conflicts during resolution, the
 local version under development will always be selected -- even if there are
 remote versions that better match other requirements for the `gemspec` gem.

data/bundler/lib/bundler/resolver.rb

@@ -499,6 +499,8 @@ module Bundler
       @cooldown_skipped_specs.each do |(name, version), spec|
         resolved = resolved_versions[name]
         next unless resolved && version > resolved
+        package = @base.get_package(name)
+        next if !package.unlock? && package.locked_version == resolved
         next unless requirements[name].all? {|req| req.satisfied_by?(version) }
         newest = newest_skipped[name]
         newest_skipped[name] = spec if newest.nil? || version > newest.version

data/bundler/lib/bundler/ruby_dsl.rb

@@ -42,11 +42,12 @@ module Bundler
     # Loads the file relative to the dirname of the Gemfile itself.
     def normalize_ruby_file(filename)
       file_content = Bundler.read_file(gemfile.dirname.join(filename))
-      # match "ruby-3.2.2", ruby = "3.2.2", ruby = '3.2.2' or "ruby   3.2.2" capturing version string up to the first space or comment
+      # match "ruby-3.2.2", ruby = "3.2.2", ruby = '3.2.2', ruby = { version = "3.2.2" } or "ruby   3.2.2" capturing version string up to the first space or comment
       version_match = /^               # Start of line
                       ruby             # Literal "ruby"
                       [\s-]*           # Optional whitespace or hyphens (for "ruby-3.2.2" format)
                       (?:=\s*)?        # Optional equals sign with whitespace (for ruby = "3.2.2" format)
+                      (?:\{[^}]*?\bversion\s*=\s*)? # Optional inline table up to its version key (for ruby = { version = "3.2.2" } format)
                       (?:
                         "([^"]+)"      # Double quoted version
                         |

data/bundler/lib/bundler/rubygems_ext.rb

@@ -40,11 +40,22 @@ module Gem
         end
       end
 
-      def open_file_with_lock(path, &block)
+      def open_file_with_lock(path)
         file_lock = "#{path}.lock"
-        open_file_with_flock(file_lock, &block)
-      ensure
-        FileUtils.rm_f file_lock
+
+        loop do
+          open_file_with_flock(file_lock) do |io|
+            # The previous holder removed the file while we were waiting on it,
+            # so leave this block and try again on the file now at the lock path
+            next unless File.identical?(io, file_lock)
+
+            begin
+              return yield io
+            ensure
+              FileUtils.rm_f file_lock
+            end
+          end
+        end
       end
     end
   end

data/bundler/lib/bundler/source/rubygems.rb

@@ -76,7 +76,7 @@ module Bundler
       end
 
       def hash
-        @remotes.hash
+        credless_remotes.hash
       end
 
       def eql?(other)

data/bundler/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.23".freeze
+  VERSION = "4.0.24".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

data/lib/rubygems/ext/builder.rb

@@ -155,7 +155,7 @@ class Gem::Ext::Builder
   end
 
   ##
-  # Splits a command string such as ENV["MAKE"] into an argument list.
+  # Splits a command string such as <tt>ENV["MAKE"]</tt> into an argument list.
   #
   # On Windows, a value that names an existing file, such as
   # <tt>C:\path\nmake.exe</tt>, is taken as a single word because POSIX

data/lib/rubygems/uninstaller.rb

@@ -208,6 +208,9 @@ class Gem::Uninstaller
 
     return if executables.empty?
 
+    bin_dir = @bin_dir || Gem.bindir(spec.base_dir)
+    return if bin_dir_missing?(bin_dir)
+
     executables = executables.map {|exec| formatted_program_filename exec }
 
     remove = if @force_executables.nil?
@@ -220,8 +223,6 @@ class Gem::Uninstaller
     end
 
     if remove
-      bin_dir = @bin_dir || Gem.bindir(spec.base_dir)
-
       raise Gem::FilePermissionError, bin_dir unless File.writable? bin_dir
 
       executables.each do |exe_name|
@@ -398,6 +399,17 @@ class Gem::Uninstaller
 
   private
 
+  # Only a directory that does not exist is skipped. Any other error, such as
+  # EACCES on a parent directory, is left to the writable check.
+  def bin_dir_missing?(bin_dir)
+    File.stat(bin_dir)
+    false
+  rescue Errno::ENOENT
+    true
+  rescue SystemCallError
+    false
+  end
+
   def rm_r(path, exclusions:)
     FileUtils::Entry_.new(path).postorder_traverse do |ent|
       ent.remove unless exclusions.include?(ent.path)

data/lib/rubygems/user_interaction.rb

@@ -295,10 +295,12 @@ class Gem::StreamUI
   def ask_for_password(question)
     return nil unless tty?
 
-    @outs.print(question, "  ")
-    @outs.flush
-
-    password = _gets_noecho
+    require_io_console
+    password = @ins.noecho do
+      @outs.print(question, "  ")
+      @outs.flush
+      @ins.gets
+    end
     @outs.puts
     password&.chomp!
     password
@@ -314,11 +316,6 @@ class Gem::StreamUI
     end
   end
 
-  def _gets_noecho
-    require_io_console
-    @ins.noecho { @ins.gets }
-  end
-
   ##
   # Display a statement.
 

data/lib/rubygems.rb

@@ -9,7 +9,7 @@
 require "rbconfig"
 
 module Gem
-  VERSION = "4.0.23"
+  VERSION = "4.0.24"
 end
 
 require_relative "rubygems/defaults"
@@ -853,14 +853,30 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
   end
 
   ##
-  # Open a file with given flags, and protect access with a file lock
+  # Open a file with given flags, and protect access with a file lock.
+  #
+  # The lock file is removed once done, while still holding the lock. Since
+  # processes waiting for the lock may end up acquiring it on the removed file,
+  # after acquiring it we check that the locked file is still the one at the
+  # lock path, and start over otherwise.
 
-  def self.open_file_with_lock(path, &block)
+  def self.open_file_with_lock(path)
     file_lock = "#{path}.lock"
-    open_file_with_flock(file_lock, &block)
-  ensure
-    require "fileutils"
-    FileUtils.rm_f file_lock
+
+    loop do
+      open_file_with_flock(file_lock) do |io|
+        # The previous holder removed the file while we were waiting on it, so
+        # leave this block and try again on the file now at the lock path
+        next unless File.identical?(io, file_lock)
+
+        begin
+          return yield io
+        ensure
+          require "fileutils"
+          FileUtils.rm_f file_lock
+        end
+      end
+    end
   end
 
   ##

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubygems-update
 version: !ruby/object:Gem::Version
-  version: 4.0.23
+  version: 4.0.24
 platform: ruby
 authors:
 - Jim Weirich