rubygems-update 4.1.0.beta1 → 4.1.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b352c4644037755a5e766ee276d2356a72562c64003a787e5ead57ffdd2f6f59
-  data.tar.gz: cc343e5d3bd5a9d3cab8eea31cef6425181ab659ba0d1ea881e84e6f7dca4e76
+  metadata.gz: 92ef5aaf37fa34e9c54d4ccb621998b24ad8a17dacf8fd40c4d3431b1deadf5f
+  data.tar.gz: b7f8ac5ccc71b284957ce258ce02c6930926da7e32d15ac1295220fd7caa6dbc
 SHA512:
-  metadata.gz: c891896e6322726cb21068e0a6ebcf1b9c68150eb8713a6e046ce7e2e8f8dafbb9e432d010d9b3f945c282f07c82ea45a149ab153d6dae4b0524234135172d60
-  data.tar.gz: 4ec266e81774d02b685d030902415a2edd83379bd3299d3259f6f4e10c26e3096a2e09c448c85b58a07953f6c6c71058f5e7fd50434f8e65dabb60d3f006b28a
+  metadata.gz: f27352dfa7e4d9f164444c96ee7ce41ff17dd8288ce4a7e96f3f5c4ca3452fee4427a73abb7c82f753165488880039fcef77e6d3870addf9a57d908cfe8f3810
+  data.tar.gz: 1dcf75db4af1ac4206836b95283658481f5d70a3a049e06959a642efbcb5e7a4945067417b43daa8ac648f72aa6d7124907c31546ba82f1102fa334237426bc5

data/CHANGELOG.md

@@ -2,6 +2,97 @@
 
 Bundler's changelog before 4.0.0, when it was versioned separately from RubyGems, is in [doc/CHANGELOG-bundler-2.x.md](https://github.com/ruby/rubygems/blob/master/doc/CHANGELOG-bundler-2.x.md).
 
+## 4.1.0.beta2 / 2026-10-08
+
+### RubyGems
+
+Changes already released in 4.0.x are not repeated here.
+
+#### Features:
+
+* Support content addressable gems in `Gem::PackageTask`. Pull request [#9897](https://github.com/ruby/rubygems/pull/9897) by Harriet Oughton, Gira Chawda and Jenny Shen
+* Add `--content-addressable` to `gem build` and make `--ruby-abi` only set the Ruby ABI. Pull request [#9906](https://github.com/ruby/rubygems/pull/9906) by Harriet Oughton
+
+#### Enhancements:
+
+* Drop setuid, setgid and sticky bits when extracting gems. Pull request [#9929](https://github.com/ruby/rubygems/pull/9929) by Hiroshi SHIBATA
+* Improve handling of paths with invalid Windows characters. Pull request [#9276](https://github.com/ruby/rubygems/pull/9276) by Said Kaldybaev and Hiroshi SHIBATA
+* Installs bundler 4.1.0.beta2 as a default gem.
+
+#### Breaking changes:
+
+* Build a platform gem with `gem build --platform` for the local platform. Pull request [#9873](https://github.com/ruby/rubygems/pull/9873) by Hiroshi SHIBATA
+* Fix `gem update --user-install` updating gems outside the user directory. Pull request [#9872](https://github.com/ruby/rubygems/pull/9872) by Hiroshi SHIBATA
+
+### Bundler
+
+Changes already released in 4.0.x are not repeated here.
+
+#### Features:
+
+* Let override drop or replace one dependency of a gem. Pull request [#9935](https://github.com/ruby/rubygems/pull/9935) by Hiroshi SHIBATA
+* Add `sparse_checkout` option to git source. Pull request [#9295](https://github.com/ruby/rubygems/pull/9295) by Ian Ker-Seymer and Hiroshi SHIBATA
+* Implement `--exact-match` Flag for `bundle info` / `show` / `open`. Pull request [#9489](https://github.com/ruby/rubygems/pull/9489) by Harriet Oughton
+
+#### Bug fixes:
+
+* Respect Gemfile lockfile in `bundle lock`. Pull request [#9661](https://github.com/ruby/rubygems/pull/9661) by David Stosik and Hiroshi SHIBATA
+
+## 4.0.22 / 2026-09-30
+
+### RubyGems
+
+#### Enhancements:
+
+* Add --source option to gem exec command. Pull request [#9765](https://github.com/ruby/rubygems/pull/9765) by Akshay Birajdar
+* Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
+* Validate the version field in Gem::Installer#verify_spec. Pull request [#9890](https://github.com/ruby/rubygems/pull/9890) by Hiroshi SHIBATA
+* Installs bundler 4.0.22 as a default gem.
+
+#### Bug fixes:
+
+* Remove the build_info file on uninstall and stop gem build from logging unknown extensions. Pull request [#9894](https://github.com/ruby/rubygems/pull/9894) by Hiroshi SHIBATA
+
+### Bundler
+
+#### Enhancements:
+
+* Report the effective platform in `bundle platform`. Pull request [#9898](https://github.com/ruby/rubygems/pull/9898) by Islam Elsayed
+* Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
+* Update Magnus version in Rust extension gem template. Pull request [#9904](https://github.com/ruby/rubygems/pull/9904) by Mat Sadler and Hiroshi SHIBATA
+
+#### Bug fixes:
+
+* Stop `Bundler.bin_path` creating the directory it reports. Pull request [#9887](https://github.com/ruby/rubygems/pull/9887) by Islam Elsayed and Hiroshi SHIBATA
+* Look up `bundler-<command>` executables only in PATH. Pull request [#9874](https://github.com/ruby/rubygems/pull/9874) by Hiroshi SHIBATA
+
+#### Documentation:
+
+* Describe `--major` as preferring the latest major version. Pull request [#9891](https://github.com/ruby/rubygems/pull/9891) by Hiroshi SHIBATA
+
+## 4.0.21 / 2026-09-16
+
+### RubyGems
+
+#### Enhancements:
+
+* Stop vendoring resolv for two regexps. Pull request [#9877](https://github.com/ruby/rubygems/pull/9877) by Hiroshi SHIBATA
+* Normalize absolute symlink targets during gem extraction. Pull request [#9860](https://github.com/ruby/rubygems/pull/9860) by Hiroshi SHIBATA
+* Installs bundler 4.0.21 as a default gem.
+
+### Bundler
+
+#### Enhancements:
+
+* Don't update bundler to a prerelease unless asked for one. Pull request [#9869](https://github.com/ruby/rubygems/pull/9869) by Hiroshi SHIBATA
+* Reject Bundler redirects that downgrade https to http. Pull request [#9859](https://github.com/ruby/rubygems/pull/9859) by Hiroshi SHIBATA
+
+#### Bug fixes:
+
+* Support `safe.bareRepository=explicit` in git sources. Pull request [#9876](https://github.com/ruby/rubygems/pull/9876) by Hiroshi SHIBATA
+* Stop resolving locally for empty CHECKSUMS entries. Pull request [#9862](https://github.com/ruby/rubygems/pull/9862) by Hiroshi SHIBATA
+* Expand the git source gemspec path before the chdir. Pull request [#9845](https://github.com/ruby/rubygems/pull/9845) by Hiroshi SHIBATA
+
 ## 4.1.0.beta1 / 2026-09-09
 
 ### RubyGems
@@ -10,14 +101,14 @@ Changes already released in 4.0.x are not repeated here.
 
 #### Features:
 
-* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen
+* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen, Harriet Oughton and Gira Chawda
 * Let the gem and bundle cooldown settings cover each other. Pull request [#9852](https://github.com/ruby/rubygems/pull/9852) by Hiroshi SHIBATA
-* Rubygems: Add PQC ML-DSA support for cryptographically signed gems workflow. Pull request [#9697](https://github.com/ruby/rubygems/pull/9697) by Jun Aruga
+* Rubygems: Add PQC ML-DSA support for cryptographically signed gems workflow. Pull request [#9697](https://github.com/ruby/rubygems/pull/9697) by Jun Aruga, Kazuki Yamaguchi and Hiroshi SHIBATA
 * Preserve non-UTF-8 legacy gem metadata. Pull request [#9835](https://github.com/ruby/rubygems/pull/9835) by Stanislav (Stas) Katkov
 * Add an opt-in OS credential store for gem and bundler credentials. Pull request [#9671](https://github.com/ruby/rubygems/pull/9671) by Hiroshi SHIBATA
 * Add --cooldown to gem install, update and outdated. Pull request [#9734](https://github.com/ruby/rubygems/pull/9734) by Hiroshi SHIBATA
 * Adopt the compact index for gem commands. Pull request [#9606](https://github.com/ruby/rubygems/pull/9606) by Hiroshi SHIBATA
-* Replace Molinillo with PubGrub for dependency resolution. Pull request [#9402](https://github.com/ruby/rubygems/pull/9402) by Matt Larraz
+* Replace Molinillo with PubGrub for dependency resolution. Pull request [#9402](https://github.com/ruby/rubygems/pull/9402) by Matt Larraz and Colby Swandale
 * Replace the rubygems-specific lockfile parser with Bundler's parser. Pull request [#9564](https://github.com/ruby/rubygems/pull/9564) by Hiroshi SHIBATA
 * Remove pessimistic versioning in gem command output. Pull request [#9550](https://github.com/ruby/rubygems/pull/9550) by Jeremy Evans
 * Change Gem::Version#approximate_recommendation to be optimistic. Pull request [#9537](https://github.com/ruby/rubygems/pull/9537) by Jeremy Evans
@@ -52,7 +143,7 @@ Changes already released in 4.0.x are not repeated here.
 
 #### Features:
 
-* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen
+* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen, Harriet Oughton and Gira Chawda
 * Let the gem and bundle cooldown settings cover each other. Pull request [#9852](https://github.com/ruby/rubygems/pull/9852) by Hiroshi SHIBATA
 * Add a `prune` setting to drop rebuildable install artifacts. Pull request [#9815](https://github.com/ruby/rubygems/pull/9815) by Hiroshi SHIBATA
 * Add an opt-in OS credential store for gem and bundler credentials. Pull request [#9671](https://github.com/ruby/rubygems/pull/9671) by Hiroshi SHIBATA
@@ -63,8 +154,8 @@ Changes already released in 4.0.x are not repeated here.
 * Reuse RubyGems' vendored SecureRandom in Bundler. Pull request [#9651](https://github.com/ruby/rubygems/pull/9651) by Hiroshi SHIBATA
 * Reuse RubyGems' vendored URI in Bundler. Pull request [#9650](https://github.com/ruby/rubygems/pull/9650) by Hiroshi SHIBATA
 * Fix two issues by including the ruby platform variants in the lock file. Pull request [#9556](https://github.com/ruby/rubygems/pull/9556) by Randy Stauner
-* Fix plugin installation from gemfile. Pull request [#6957](https://github.com/ruby/rubygems/pull/6957) by Cody Cutrer
-* Add plugin hooks for Gemfile evaluation and source fetching. Pull request [#9488](https://github.com/ruby/rubygems/pull/9488) by Hiroshi SHIBATA
+* Fix plugin installation from gemfile. Pull request [#6957](https://github.com/ruby/rubygems/pull/6957) by Cody Cutrer, Diogo Fernandes and Hiroshi SHIBATA
+* Add plugin hooks for Gemfile evaluation and source fetching. Pull request [#9488](https://github.com/ruby/rubygems/pull/9488) by Hiroshi SHIBATA, Cody Cutrer and Marv
 * Use optimistic version constraints in bundle gem output. Pull request [#9533](https://github.com/ruby/rubygems/pull/9533) by Jeremy Evans
 * Extend Gemfile `override` DSL with `:all` target and metadata fields (Phase 2). Pull request [#9530](https://github.com/ruby/rubygems/pull/9530) by Hiroshi SHIBATA
 * Switch bundle add to use optimistic versioning by default. Pull request [#9526](https://github.com/ruby/rubygems/pull/9526) by Jeremy Evans
@@ -72,7 +163,7 @@ Changes already released in 4.0.x are not repeated here.
 * Add `--no-build-extension` and `--no-install-plugin` options to gem install. Pull request [#9473](https://github.com/ruby/rubygems/pull/9473) by Hiroshi SHIBATA
 * Include detailed dependencies when gemfile and lockfile are conflicts. Pull request [#9332](https://github.com/ruby/rubygems/pull/9332) by Hiroshi SHIBATA
 * Implement relative path handling for plugin paths. Pull request [#9299](https://github.com/ruby/rubygems/pull/9299) by Hiroshi SHIBATA
-* Bundler/inline: perform installation from a forked child. Pull request [#7941](https://github.com/ruby/rubygems/pull/7941) by Jean byroot Boussier
+* Bundler/inline: perform installation from a forked child. Pull request [#7941](https://github.com/ruby/rubygems/pull/7941) by Jean Boussier and Hiroshi SHIBATA
 * Add global gem cache shared by RubyGems and Bundler. Pull request [#9230](https://github.com/ruby/rubygems/pull/9230) by Anthony Panozzo
 * Update custom errors with Exception#full_message. Pull request [#8488](https://github.com/ruby/rubygems/pull/8488) by neimadTL
 
@@ -92,7 +183,7 @@ Changes already released in 4.0.x are not repeated here.
 #### Breaking changes:
 
 * Remove external tool version checks from `bundle env`. Pull request [#9593](https://github.com/ruby/rubygems/pull/9593) by Hiroshi SHIBATA
-* Bundler: ignore patchlevel kwarg in ruby DSL. Pull request [#6023](https://github.com/ruby/rubygems/pull/6023) by Takuya N
+* Bundler: ignore patchlevel kwarg in ruby DSL. Pull request [#6023](https://github.com/ruby/rubygems/pull/6023) by Takuya N and Hiroshi SHIBATA
 * Unify RubyGems and Bundler documentation. Pull request [#9237](https://github.com/ruby/rubygems/pull/9237) by Hiroshi SHIBATA
 
 #### Deprecations:

data/Manifest.txt

@@ -533,8 +533,6 @@ lib/rubygems/vendor/pub_grub/lib/pub_grub/version_constraint.rb
 lib/rubygems/vendor/pub_grub/lib/pub_grub/version_range.rb
 lib/rubygems/vendor/pub_grub/lib/pub_grub/version_solver.rb
 lib/rubygems/vendor/pub_grub/lib/pub_grub/version_union.rb
-lib/rubygems/vendor/resolv/COPYING
-lib/rubygems/vendor/resolv/lib/resolv.rb
 lib/rubygems/vendor/securerandom/COPYING
 lib/rubygems/vendor/securerandom/lib/securerandom.rb
 lib/rubygems/vendor/timeout/COPYING

data/SECURITY.md

@@ -2,6 +2,15 @@
 
 We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly.
 
-For any security bug or issue with the RubyGems client or RubyGems.org service, please email security@rubygems.org with details about the problem or submit a report using [HackerOne](https://hackerone.com/rubygems).
+For any security bug or issue with the RubyGems client, Bundler, or RubyGems.org service, please email security@rubygems.org with details about the problem or submit a report using [HackerOne](https://hackerone.com/rubygems). A malicious or compromised gem published on RubyGems.org can be reported the same way.
 
 For additional information about RubyGems security, please see https://rubygems.org/pages/security.
+
+## Out of scope for RubyGems and Bundler
+
+The following are not treated as vulnerabilities. A technically correct report may still be fixed in public as a regular bug or hardening change.
+
+- Code you chose to run, whether a gem you install or the `Gemfile` of a repository you run `bundle` in. A gem can ship a native extension whose build runs arbitrary code as you, and a `Gemfile` is Ruby code, so anything a crafted gem or repository does within your privileges, such as writing or deleting files or path traversal through gem metadata, adds no capability, whether or not the gem declares extensions.
+- A gem source or mirror you chose to trust. Reports that assume the configured source is malicious or compromised are out of scope, and so is gem metadata that rubygems.org rejects at push time, since it can only arrive from a local file or a gem server you chose to trust.
+- Your own environment and settings. This covers attacks that require write access to files RubyGems or Bundler already load on your behalf, such as plugins, `.gemrc` or `.bundle/config`, and behavior after you explicitly disable a protection such as TLS certificate verification.
+- Issues already fixed on the `master` branch. Please check it before reporting.

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-09-09".freeze
-    @git_commit_sha = "98e4d8083a7".freeze
+    @built_at = "2026-10-08".freeze
+    @git_commit_sha = "f8b8b02".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/common.rb

@@ -122,6 +122,10 @@ module Bundler
       raise GemNotFound, gem_not_found_message(name, Bundler.definition.dependencies)
     end
 
+    def self.select_spec_with_match_type(name, options)
+      select_spec(name, options["exact-match"] ? nil : :regex_match)
+    end
+
     def self.default_gem_spec(name)
       gem_spec = Gem::Specification.find_all_by_name(name).last
       gem_spec if gem_spec&.default_gem?

data/lib/bundler/cli/doctor/ssl.rb

@@ -124,14 +124,10 @@ module Bundler
       ctx = OpenSSL::SSL::SSLContext.new
       supported = true
 
-      if ctx.respond_to?(:min_version=)
-        begin
-          ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
-        rescue OpenSSL::SSL::SSLError, NameError
-          supported = false
-        end
-      else
-        supported = OpenSSL::SSL::SSLContext::METHODS.include?(:TLSv1_2) # rubocop:disable Naming/VariableNumber
+      begin
+        ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
+      rescue OpenSSL::SSL::SSLError, NameError
+        supported = false
       end
 
       Bundler.ui.warn(<<~EOM) unless supported

data/lib/bundler/cli/info.rb

@@ -26,7 +26,7 @@ module Bundler
     private
 
     def spec_for_gem(name)
-      Bundler::CLI::Common.select_spec(name, :regex_match)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
     end
 
     def print_gem_version(spec)

data/lib/bundler/cli/lock.rb

@@ -74,10 +74,21 @@ module Bundler
           puts definition.to_lock
         else
           file = options[:lockfile]
-          file = file ? Pathname.new(file).expand_path : Bundler.default_lockfile
+          file = if file
+            Pathname.new(file).expand_path
+          elsif ENV["BUNDLE_LOCKFILE"].to_s.empty?
+            definition.lockfile
+          else
+            # BUNDLE_LOCKFILE outranks the lockfile method in the Gemfile, see gemfile(5)
+            Bundler.default_lockfile
+          end
 
-          puts "Writing lockfile to #{file}"
-          definition.write_lock(file, false)
+          if file
+            puts "Writing lockfile to #{file}"
+            definition.write_lock(file, false)
+          else
+            Bundler.ui.warn "Not writing a lockfile because the Gemfile sets `lockfile false`"
+          end
         end
 
         Bundler::CLI::Common.output_cooldown_skipped_summary(definition)

data/lib/bundler/cli/open.rb

@@ -13,7 +13,7 @@ module Bundler
       raise InvalidOption, "Cannot specify `--path` option without a value" if !@path.nil? && @path.empty?
       editor = [ENV["BUNDLER_EDITOR"], ENV["VISUAL"], ENV["EDITOR"]].find {|e| !e.nil? && !e.empty? }
       return Bundler.ui.info("To open a bundled gem, set $EDITOR or $BUNDLER_EDITOR") unless editor
-      return unless spec = Bundler::CLI::Common.select_spec(name, :regex_match)
+      return unless spec = spec_for_gem(name)
       if spec.default_gem?
         Bundler.ui.info "Unable to open #{name} because it's a default gem, so the directory it would normally be installed to does not exist."
       else
@@ -35,5 +35,11 @@ module Bundler
       require "shellwords"
       Shellwords.split(editor)
     end
+
+    private
+
+    def spec_for_gem(name)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
+    end
   end
 end

data/lib/bundler/cli/outdated.rb

@@ -90,7 +90,9 @@ module Bundler
         dependency = current_dependencies[current_spec.name]
         groups = ""
         if dependency && !options[:parseable]
-          groups = dependency.groups.join(", ")
+          groups = dependency.groups
+          groups = groups.sort if options_include_groups
+          groups = groups.join(", ")
         end
 
         outdated_gems << {
@@ -101,13 +103,11 @@ module Bundler
         }
       end
 
-      relevant_outdated_gems = if options_include_groups
-        outdated_gems.group_by {|g| g[:groups] }.sort.flat_map do |groups, gems|
-          contains_group = groups.split(", ").include?(options[:group])
-          next unless options[:groups] || contains_group
-
-          gems
-        end.compact
+      relevant_outdated_gems = if options[:groups]
+        without_groups, with_groups = outdated_gems.partition {|g| g[:groups].empty? }
+        with_groups.group_by {|g| g[:groups] }.sort.flat_map(&:last) + without_groups
+      elsif options_include_groups
+        outdated_gems.select {|g| g[:groups].split(", ").include?(options[:group]) }
       else
         outdated_gems
       end
@@ -333,8 +333,6 @@ module Bundler
 
       Bundler.ui.info justify(header, column_sizes)
 
-      data.sort_by! {|row| row[0] }
-
       data.each do |row|
         Bundler.ui.info justify(row, column_sizes)
       end

data/lib/bundler/cli/platform.rb

@@ -25,7 +25,7 @@ module Bundler
       else
         platforms = Bundler.definition.platforms.map {|p| "* #{p}" }
 
-        output << "Your platform is: #{Gem::Platform.local}"
+        output << platform_info
         output << "Your app has gems that work on these platforms:\n#{platforms.join("\n")}"
 
         if ruby_version
@@ -44,5 +44,19 @@ module Bundler
 
       Bundler.ui.info output.join("\n\n")
     end
+
+    private
+
+    def platform_info
+      info = "Your platform is: #{Gem::Platform.local}"
+      return info if Bundler.local_platform == Gem::Platform.local
+
+      info + "\nHowever, your effective platform is: #{Bundler.local_platform} " \
+        "(because force_ruby_platform is #{force_ruby_platform_origin})"
+    end
+
+    def force_ruby_platform_origin
+      Bundler.settings.pretty_values_for(:force_ruby_platform).first.sub(/\ASet /, "set ")
+    end
   end
 end

data/lib/bundler/cli/show.rb

@@ -20,7 +20,7 @@ module Bundler
         if gem_name == "bundler"
           path = File.expand_path("../../..", __dir__)
         else
-          spec = Bundler::CLI::Common.select_spec(gem_name, :regex_match)
+          spec = spec_for_gem(gem_name)
           return unless spec
           path = spec.full_gem_path
           unless File.directory?(path)
@@ -55,6 +55,10 @@ module Bundler
 
     private
 
+    def spec_for_gem(name)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
+    end
+
     def fetch_latest_specs
       definition = Bundler.definition(true)
       Bundler.ui.info "Fetching remote specs for outdated check...\n\n"

data/lib/bundler/cli/update.rb

@@ -13,7 +13,7 @@ module Bundler
 
       update_bundler = options[:bundler]
 
-      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler) if update_bundler
+      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler, pre: options[:pre]) if update_bundler
 
       sources = Array(options[:source])
       groups  = Array(options[:group]).map(&:to_sym)

data/lib/bundler/cli.rb

@@ -177,7 +177,7 @@ module Bundler
         else
           puts File.read("#{man_path}/#{File.basename(man_page)}.ronn")
         end
-      elsif command_path = Bundler.which("bundler-#{cli}")
+      elsif command_path = self.class.bundler_command_path(cli)
         Kernel.exec(command_path, "--help")
       else
         super
@@ -189,11 +189,23 @@ module Bundler
         return Bundler::Plugin.exec_command(command, ARGV[1..-1])
       end
 
-      return super unless command_path = Bundler.which("bundler-#{command}")
+      return super unless command_path = bundler_command_path(command)
 
       Kernel.exec(command_path, *ARGV[1..-1])
     end
 
+    # Only PATH is searched, unlike Bundler.which, which also finds a file in
+    # the current directory and returns a bare name that Kernel.exec cannot run.
+    def self.bundler_command_path(command)
+      ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |path|
+        path = path[1..-2] if path.start_with?('"') && path.end_with?('"')
+        command_path = Bundler.find_executable(File.expand_path("bundler-#{command}", path))
+        return command_path if command_path
+      end
+
+      nil
+    end
+
     desc "init [OPTIONS]", "Generates a Gemfile into the current working directory"
     long_desc <<-D
       Init generates a default Gemfile in the current working directory. When adding a
@@ -319,10 +331,10 @@ module Bundler
     method_option "source", type: :array, banner: "Update a specific source (and all gems associated with it)"
     method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "ruby", type: :boolean, banner: "Update ruby specified in Gemfile.lock"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "Always choose the highest allowed version when updating gems, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "Do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "Use bundle install conservative update behavior and do not allow shared dependencies to be updated."
@@ -342,6 +354,7 @@ module Bundler
     D
     method_option "paths", type: :boolean, banner: "List the paths of all gems that are required by your Gemfile."
     method_option "outdated", type: :boolean, banner: "Show verbose output including whether gems are outdated (removed)."
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def show(gem_name = nil)
       if ARGV.include?("--outdated")
         removed_message = "the `--outdated` flag to `bundle show` has been removed in favor of `bundle show --verbose`"
@@ -367,6 +380,7 @@ module Bundler
     desc "info GEM [OPTIONS]", "Show information for the given gem"
     method_option "path", type: :boolean, banner: "Print full path to gem"
     method_option "version", type: :boolean, banner: "Print gem version"
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def info(gem_name)
       require_relative "cli/info"
       Info.new(options, gem_name).run
@@ -434,7 +448,7 @@ module Bundler
     method_option "filter-strict", type: :boolean, aliases: "--strict", banner: "Only list newer versions allowed by your Gemfile requirements"
     method_option "update-strict", type: :boolean, banner: "Strict conservative resolution, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "filter-major", type: :boolean, banner: "Only list major newer versions"
     method_option "filter-minor", type: :boolean, banner: "Only list minor newer versions"
@@ -530,6 +544,7 @@ module Bundler
 
     desc "open GEM", "Opens the source directory of the given bundled gem"
     method_option "path", type: :string, lazy_default: "", banner: "Open relative path of the gem source."
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def open(name)
       require_relative "cli/open"
       Open.new(options, name).run
@@ -640,11 +655,11 @@ module Bundler
     method_option "normalize-platforms", type: :boolean, default: false, banner: "Normalize lockfile platforms"
     method_option "patch", type: :boolean, banner: "If updating, prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "If updating, prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "If updating, prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "If updating, prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "If updating, always choose the highest allowed version, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"

data/lib/bundler/constants.rb

@@ -3,7 +3,7 @@
 require "rbconfig"
 
 module Bundler
-  WINDOWS = RbConfig::CONFIG["host_os"] =~ /(msdos|mswin|djgpp|mingw)/
+  WINDOWS = RbConfig::CONFIG["host_os"] =~ /(mswin|mingw)/
   deprecate_constant :WINDOWS
 
   FREEBSD = RbConfig::CONFIG["host_os"].to_s.include?("bsd")

data/lib/bundler/definition.rb

@@ -198,7 +198,7 @@ module Bundler
 
       sources.cached!
 
-      if options[:add_checksums] || (!options[:local] && (install_needed? || refetch_needed?(options)))
+      if options[:add_checksums] || (!options[:local] && (install_needed? || refetch_needed?(options) || @locked_spec_with_empty_checksums))
         sources.remote!
         true
       else
@@ -346,7 +346,9 @@ module Bundler
     #
     # @return [SpecSet] resolved dependencies
     def resolve
-      @resolve ||= if Bundler.frozen_bundle?
+      return @resolve if @resolve
+
+      @resolve = if Bundler.frozen_bundle?
         Bundler.ui.debug "Frozen, using resolution from the lockfile"
         @locked_specs
       elsif no_resolve_needed?
@@ -366,6 +368,8 @@ module Bundler
 
         start_resolution
       end
+      warn_inert_overrides(@resolve)
+      @resolve
     end
 
     def spec_git_paths
@@ -650,7 +654,7 @@ module Bundler
         @missing_lockfile_dep ||
         @unlocking_bundler ||
         @locked_spec_with_missing_checksums ||
-        @locked_spec_with_empty_checksums ||
+        empty_checksums_actionable? ||
         @locked_spec_with_missing_deps ||
         @locked_spec_with_invalid_deps
     end
@@ -659,6 +663,16 @@ module Bundler
       unlocking? || something_changed?
     end
 
+    # Only a remote fetch can fill an empty CHECKSUMS entry, so it justifies a
+    # resolution only when one is coming. Resolving locally for it would repeat
+    # on every `Bundler.setup` without changing the lockfile. Frozen mode still
+    # has to refuse the entry.
+    def empty_checksums_actionable?
+      return false unless @locked_spec_with_empty_checksums
+
+      Bundler.frozen_bundle? || !sources.local_mode?
+    end
+
     def should_add_extra_platforms?
       !lockfile_exists? && Bundler::MatchPlatform.generic_local_platform_is_ruby? && !Bundler.settings[:force_ruby_platform]
     end
@@ -1095,25 +1109,61 @@ module Bundler
       end
 
       converge_overrides_outside_dependencies
+      converge_rewritten_dependencies
 
       @changed_dependencies.any?
     end
 
-    def converge_overrides_outside_dependencies
+    # The lockfile keeps the upstream dependencies of every gem, so a gem that
+    # a `from:`/`to:` override cut loose stays locked until a resolution drops
+    # it.
+    def converge_rewritten_dependencies
       @overrides.each do |override|
-        # :all overrides are intentionally not pre-unlocked. They take effect on
-        # fresh resolution (no lockfile) or when the user runs `bundle update`.
-        # Forcing a full re-resolve from a single :all directive would surprise
-        # users with unrelated dependency churn.
-        next unless override.target.is_a?(String)
+        next unless override.from
 
         name = override.target
-        next if @changed_dependencies.include?(name)
         next if @originally_locked_specs[name].empty?
-        # version: overrides on direct deps are detected in the per-dep
+        next if @dependencies.any? {|d| d.name == name }
+
+        still_required = @originally_locked_specs.any? do |s|
+          Override.rewrite_dependencies(@overrides, s.name, s.runtime_dependencies).any? {|d| d.name == name }
+        end
+        next if still_required
+
+        @gems_to_unlock << name
+        @changed_dependencies << name
+      end
+    end
+
+    # A misspelled `from:` gem leaves the override with nothing to rewrite.
+    def warn_inert_overrides(specs)
+      @overrides.each do |override|
+        next unless override.from
+        next if specs[override.from].any? {|s| s.dependencies.any? {|d| d.name == override.target } }
+
+        Bundler.ui.warn "#{override} has no effect because the bundle has no #{override.from} that depends on #{override.target}"
+      end
+    end
+
+    def converge_overrides_outside_dependencies
+      @overrides.each do |override|
+        # :all and metadata overrides are intentionally not pre-unlocked. The
+        # lockfile does not record overrides, so unlocking for them would
+        # re-resolve on every run and reject every frozen install. Install-time
+        # compatibility checks already honor them for locked specs, and they
+        # affect resolution on a fresh lock or when the user runs `bundle update`.
+        next unless override.target.is_a?(String) && override.field == :version
+
+        name = override.target
+        # Overrides on direct deps are detected in the per-dep
         # converge_dependencies loop via apply_override_to + matches_spec?.
-        # Other fields are not visible there, so they always reach here.
-        next if override.field == :version && @dependencies.any? {|d| d.name == name }
+        next if @dependencies.any? {|d| d.name == name }
+
+        locked_specs = @originally_locked_specs[name]
+        next if locked_specs.empty?
+        # Only a version string constrains on its own. :ignore_upper and nil
+        # loosen requirements the lockfile already satisfies.
+        next if override.apply_to(Gem::Requirement.default).satisfied_by?(locked_specs.first.version)
 
         @gems_to_unlock << name
         @changed_dependencies << name
@@ -1342,7 +1392,7 @@ module Bundler
     end
 
     def source_map
-      @source_map ||= SourceMap.new(sources, dependencies, @locked_specs)
+      @source_map ||= SourceMap.new(sources, dependencies, @locked_specs, @overrides.filter_map {|o| o.operation if o.from })
     end
 
     def new_resolver_for_full_update