rubygems-update 4.1.0.beta1 → 4.1.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b352c4644037755a5e766ee276d2356a72562c64003a787e5ead57ffdd2f6f59
-  data.tar.gz: cc343e5d3bd5a9d3cab8eea31cef6425181ab659ba0d1ea881e84e6f7dca4e76
+  metadata.gz: 6318a5162408d17e02ca7534ba15f8701fe7eeeeaf7d891f4331588d0e595472
+  data.tar.gz: c044abf170bb96482454ed885860c11aa96cda0618cdaac5177009bdbb1d814d
 SHA512:
-  metadata.gz: c891896e6322726cb21068e0a6ebcf1b9c68150eb8713a6e046ce7e2e8f8dafbb9e432d010d9b3f945c282f07c82ea45a149ab153d6dae4b0524234135172d60
-  data.tar.gz: 4ec266e81774d02b685d030902415a2edd83379bd3299d3259f6f4e10c26e3096a2e09c448c85b58a07953f6c6c71058f5e7fd50434f8e65dabb60d3f006b28a
+  metadata.gz: 3c0e7401e36950ef3563213d1489dacccf2cdabf370c63bdb789a0ac0f0bd68987d3ac558dcb9054bbd9dc6ab0003853878d4563f43a43fb995d77d6ecfd6ddb
+  data.tar.gz: 0677d5d8ec93ba1e7d6698c7b480d5f496cc2d42a37aea380e981133da66ef3b49bece38b90aab61425a30c5b7126e6f2354eea48614b508ec6ac72e6225e856

data/CHANGELOG.md

@@ -2,6 +2,150 @@
 
 Bundler's changelog before 4.0.0, when it was versioned separately from RubyGems, is in [doc/CHANGELOG-bundler-2.x.md](https://github.com/ruby/rubygems/blob/master/doc/CHANGELOG-bundler-2.x.md).
 
+## 4.1.0.beta3 / 2026-10-28
+
+### RubyGems
+
+#### Enhancements:
+
+* Installs bundler 4.1.0.beta3 as a default gem.
+
+#### Bug fixes:
+
+* Skip executable removal gracefully when the bin directory is missing. Pull request [#9963](https://github.com/ruby/rubygems/pull/9963) by Evan Li and Hiroshi SHIBATA
+* Fix file locks letting multiple processes in when lock files are removed. Pull request [#9930](https://github.com/ruby/rubygems/pull/9930) by Richard Janita and Hiroshi SHIBATA
+* Turn off echo before printing the password prompt. Pull request [#9969](https://github.com/ruby/rubygems/pull/9969) by Mike Dalessio
+
+### Bundler
+
+Changes already released in 4.0.x are not repeated here.
+
+#### Features:
+
+* Rename the `from:` and `to:` keys of `override` to `in:` and `with:`. Pull request [#9979](https://github.com/ruby/rubygems/pull/9979) by Hiroshi SHIBATA
+* Record overrides in Gemfile.lock (`OVERRIDES` section). Pull request [#9958](https://github.com/ruby/rubygems/pull/9958) by Ufuk Kayserilioglu
+
+#### Bug fixes:
+
+* Make `Bundler::Source::Rubygems#hash` agree with `eql?`. Pull request [#9983](https://github.com/ruby/rubygems/pull/9983) by Hiroshi SHIBATA
+* Add checksums after platform changes in `bundle lock`. Pull request [#9960](https://github.com/ruby/rubygems/pull/9960) by Farid Zakaria
+* Apply BUNDLE_RETRY to lazy gemspec downloads. Pull request [#9868](https://github.com/ruby/rubygems/pull/9868) by Islam Elsayed
+* Fix file locks letting multiple processes in when lock files are removed. Pull request [#9930](https://github.com/ruby/rubygems/pull/9930) by Richard Janita and Hiroshi SHIBATA
+* Preload git sources that share a cache one after another. Pull request [#9951](https://github.com/ruby/rubygems/pull/9951) by Shai
+
+## 4.0.23 / 2026-10-14
+
+### RubyGems
+
+#### Enhancements:
+
+* Update vendored gems to latest versions. Pull request [#9948](https://github.com/ruby/rubygems/pull/9948) by Hiroshi SHIBATA
+* Drop setuid, setgid and sticky bits when extracting gems. Pull request [#9929](https://github.com/ruby/rubygems/pull/9929) by Hiroshi SHIBATA
+* Improve handling of paths with invalid Windows characters. Pull request [#9276](https://github.com/ruby/rubygems/pull/9276) by Said Kaldybaev and Hiroshi SHIBATA
+* Installs bundler 4.0.23 as a default gem.
+
+### Bundler
+
+#### Enhancements:
+
+* Update vendored gems to latest versions. Pull request [#9948](https://github.com/ruby/rubygems/pull/9948) by Hiroshi SHIBATA
+
+#### Bug fixes:
+
+* Stop retrying a 416 response to a request without Range. Pull request [#9938](https://github.com/ruby/rubygems/pull/9938) by Hiroshi SHIBATA
+* Respect Gemfile lockfile in `bundle lock`. Pull request [#9661](https://github.com/ruby/rubygems/pull/9661) by David Stosik and Hiroshi SHIBATA
+
+## 4.1.0.beta2 / 2026-10-08
+
+### RubyGems
+
+Changes already released in 4.0.x are not repeated here.
+
+#### Features:
+
+* Support content addressable gems in `Gem::PackageTask`. Pull request [#9897](https://github.com/ruby/rubygems/pull/9897) by Harriet Oughton, Gira Chawda and Jenny Shen
+* Add `--content-addressable` to `gem build` and make `--ruby-abi` only set the Ruby ABI. Pull request [#9906](https://github.com/ruby/rubygems/pull/9906) by Harriet Oughton
+
+#### Enhancements:
+
+* Drop setuid, setgid and sticky bits when extracting gems. Pull request [#9929](https://github.com/ruby/rubygems/pull/9929) by Hiroshi SHIBATA
+* Improve handling of paths with invalid Windows characters. Pull request [#9276](https://github.com/ruby/rubygems/pull/9276) by Said Kaldybaev and Hiroshi SHIBATA
+* Installs bundler 4.1.0.beta2 as a default gem.
+
+#### Breaking changes:
+
+* Build a platform gem with `gem build --platform` for the local platform. Pull request [#9873](https://github.com/ruby/rubygems/pull/9873) by Hiroshi SHIBATA
+* Fix `gem update --user-install` updating gems outside the user directory. Pull request [#9872](https://github.com/ruby/rubygems/pull/9872) by Hiroshi SHIBATA
+
+### Bundler
+
+Changes already released in 4.0.x are not repeated here.
+
+#### Features:
+
+* Let override drop or replace one dependency of a gem. Pull request [#9935](https://github.com/ruby/rubygems/pull/9935) by Hiroshi SHIBATA
+* Add `sparse_checkout` option to git source. Pull request [#9295](https://github.com/ruby/rubygems/pull/9295) by Ian Ker-Seymer and Hiroshi SHIBATA
+* Implement `--exact-match` Flag for `bundle info` / `show` / `open`. Pull request [#9489](https://github.com/ruby/rubygems/pull/9489) by Harriet Oughton
+
+#### Bug fixes:
+
+* Respect Gemfile lockfile in `bundle lock`. Pull request [#9661](https://github.com/ruby/rubygems/pull/9661) by David Stosik and Hiroshi SHIBATA
+
+## 4.0.22 / 2026-09-30
+
+### RubyGems
+
+#### Enhancements:
+
+* Add --source option to gem exec command. Pull request [#9765](https://github.com/ruby/rubygems/pull/9765) by Akshay Birajdar
+* Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
+* Validate the version field in Gem::Installer#verify_spec. Pull request [#9890](https://github.com/ruby/rubygems/pull/9890) by Hiroshi SHIBATA
+* Installs bundler 4.0.22 as a default gem.
+
+#### Bug fixes:
+
+* Remove the build_info file on uninstall and stop gem build from logging unknown extensions. Pull request [#9894](https://github.com/ruby/rubygems/pull/9894) by Hiroshi SHIBATA
+
+### Bundler
+
+#### Enhancements:
+
+* Report the effective platform in `bundle platform`. Pull request [#9898](https://github.com/ruby/rubygems/pull/9898) by Islam Elsayed
+* Keep credentials on redirects only within the same origin. Pull request [#9909](https://github.com/ruby/rubygems/pull/9909) by Hiroshi SHIBATA
+* Update Magnus version in Rust extension gem template. Pull request [#9904](https://github.com/ruby/rubygems/pull/9904) by Mat Sadler and Hiroshi SHIBATA
+
+#### Bug fixes:
+
+* Stop `Bundler.bin_path` creating the directory it reports. Pull request [#9887](https://github.com/ruby/rubygems/pull/9887) by Islam Elsayed and Hiroshi SHIBATA
+* Look up `bundler-<command>` executables only in PATH. Pull request [#9874](https://github.com/ruby/rubygems/pull/9874) by Hiroshi SHIBATA
+
+#### Documentation:
+
+* Describe `--major` as preferring the latest major version. Pull request [#9891](https://github.com/ruby/rubygems/pull/9891) by Hiroshi SHIBATA
+
+## 4.0.21 / 2026-09-16
+
+### RubyGems
+
+#### Enhancements:
+
+* Stop vendoring resolv for two regexps. Pull request [#9877](https://github.com/ruby/rubygems/pull/9877) by Hiroshi SHIBATA
+* Normalize absolute symlink targets during gem extraction. Pull request [#9860](https://github.com/ruby/rubygems/pull/9860) by Hiroshi SHIBATA
+* Installs bundler 4.0.21 as a default gem.
+
+### Bundler
+
+#### Enhancements:
+
+* Don't update bundler to a prerelease unless asked for one. Pull request [#9869](https://github.com/ruby/rubygems/pull/9869) by Hiroshi SHIBATA
+* Reject Bundler redirects that downgrade https to http. Pull request [#9859](https://github.com/ruby/rubygems/pull/9859) by Hiroshi SHIBATA
+
+#### Bug fixes:
+
+* Support `safe.bareRepository=explicit` in git sources. Pull request [#9876](https://github.com/ruby/rubygems/pull/9876) by Hiroshi SHIBATA
+* Stop resolving locally for empty CHECKSUMS entries. Pull request [#9862](https://github.com/ruby/rubygems/pull/9862) by Hiroshi SHIBATA
+* Expand the git source gemspec path before the chdir. Pull request [#9845](https://github.com/ruby/rubygems/pull/9845) by Hiroshi SHIBATA
+
 ## 4.1.0.beta1 / 2026-09-09
 
 ### RubyGems
@@ -10,14 +154,14 @@ Changes already released in 4.0.x are not repeated here.
 
 #### Features:
 
-* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen
+* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen, Harriet Oughton and Gira Chawda
 * Let the gem and bundle cooldown settings cover each other. Pull request [#9852](https://github.com/ruby/rubygems/pull/9852) by Hiroshi SHIBATA
-* Rubygems: Add PQC ML-DSA support for cryptographically signed gems workflow. Pull request [#9697](https://github.com/ruby/rubygems/pull/9697) by Jun Aruga
+* Rubygems: Add PQC ML-DSA support for cryptographically signed gems workflow. Pull request [#9697](https://github.com/ruby/rubygems/pull/9697) by Jun Aruga, Kazuki Yamaguchi and Hiroshi SHIBATA
 * Preserve non-UTF-8 legacy gem metadata. Pull request [#9835](https://github.com/ruby/rubygems/pull/9835) by Stanislav (Stas) Katkov
 * Add an opt-in OS credential store for gem and bundler credentials. Pull request [#9671](https://github.com/ruby/rubygems/pull/9671) by Hiroshi SHIBATA
 * Add --cooldown to gem install, update and outdated. Pull request [#9734](https://github.com/ruby/rubygems/pull/9734) by Hiroshi SHIBATA
 * Adopt the compact index for gem commands. Pull request [#9606](https://github.com/ruby/rubygems/pull/9606) by Hiroshi SHIBATA
-* Replace Molinillo with PubGrub for dependency resolution. Pull request [#9402](https://github.com/ruby/rubygems/pull/9402) by Matt Larraz
+* Replace Molinillo with PubGrub for dependency resolution. Pull request [#9402](https://github.com/ruby/rubygems/pull/9402) by Matt Larraz and Colby Swandale
 * Replace the rubygems-specific lockfile parser with Bundler's parser. Pull request [#9564](https://github.com/ruby/rubygems/pull/9564) by Hiroshi SHIBATA
 * Remove pessimistic versioning in gem command output. Pull request [#9550](https://github.com/ruby/rubygems/pull/9550) by Jeremy Evans
 * Change Gem::Version#approximate_recommendation to be optimistic. Pull request [#9537](https://github.com/ruby/rubygems/pull/9537) by Jeremy Evans
@@ -52,7 +196,7 @@ Changes already released in 4.0.x are not repeated here.
 
 #### Features:
 
-* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen
+* Add content addressable gems support. Pull request [#9773](https://github.com/ruby/rubygems/pull/9773) by Jenny Shen, Harriet Oughton and Gira Chawda
 * Let the gem and bundle cooldown settings cover each other. Pull request [#9852](https://github.com/ruby/rubygems/pull/9852) by Hiroshi SHIBATA
 * Add a `prune` setting to drop rebuildable install artifacts. Pull request [#9815](https://github.com/ruby/rubygems/pull/9815) by Hiroshi SHIBATA
 * Add an opt-in OS credential store for gem and bundler credentials. Pull request [#9671](https://github.com/ruby/rubygems/pull/9671) by Hiroshi SHIBATA
@@ -63,8 +207,8 @@ Changes already released in 4.0.x are not repeated here.
 * Reuse RubyGems' vendored SecureRandom in Bundler. Pull request [#9651](https://github.com/ruby/rubygems/pull/9651) by Hiroshi SHIBATA
 * Reuse RubyGems' vendored URI in Bundler. Pull request [#9650](https://github.com/ruby/rubygems/pull/9650) by Hiroshi SHIBATA
 * Fix two issues by including the ruby platform variants in the lock file. Pull request [#9556](https://github.com/ruby/rubygems/pull/9556) by Randy Stauner
-* Fix plugin installation from gemfile. Pull request [#6957](https://github.com/ruby/rubygems/pull/6957) by Cody Cutrer
-* Add plugin hooks for Gemfile evaluation and source fetching. Pull request [#9488](https://github.com/ruby/rubygems/pull/9488) by Hiroshi SHIBATA
+* Fix plugin installation from gemfile. Pull request [#6957](https://github.com/ruby/rubygems/pull/6957) by Cody Cutrer, Diogo Fernandes and Hiroshi SHIBATA
+* Add plugin hooks for Gemfile evaluation and source fetching. Pull request [#9488](https://github.com/ruby/rubygems/pull/9488) by Hiroshi SHIBATA, Cody Cutrer and Marv
 * Use optimistic version constraints in bundle gem output. Pull request [#9533](https://github.com/ruby/rubygems/pull/9533) by Jeremy Evans
 * Extend Gemfile `override` DSL with `:all` target and metadata fields (Phase 2). Pull request [#9530](https://github.com/ruby/rubygems/pull/9530) by Hiroshi SHIBATA
 * Switch bundle add to use optimistic versioning by default. Pull request [#9526](https://github.com/ruby/rubygems/pull/9526) by Jeremy Evans
@@ -72,7 +216,7 @@ Changes already released in 4.0.x are not repeated here.
 * Add `--no-build-extension` and `--no-install-plugin` options to gem install. Pull request [#9473](https://github.com/ruby/rubygems/pull/9473) by Hiroshi SHIBATA
 * Include detailed dependencies when gemfile and lockfile are conflicts. Pull request [#9332](https://github.com/ruby/rubygems/pull/9332) by Hiroshi SHIBATA
 * Implement relative path handling for plugin paths. Pull request [#9299](https://github.com/ruby/rubygems/pull/9299) by Hiroshi SHIBATA
-* Bundler/inline: perform installation from a forked child. Pull request [#7941](https://github.com/ruby/rubygems/pull/7941) by Jean byroot Boussier
+* Bundler/inline: perform installation from a forked child. Pull request [#7941](https://github.com/ruby/rubygems/pull/7941) by Jean Boussier and Hiroshi SHIBATA
 * Add global gem cache shared by RubyGems and Bundler. Pull request [#9230](https://github.com/ruby/rubygems/pull/9230) by Anthony Panozzo
 * Update custom errors with Exception#full_message. Pull request [#8488](https://github.com/ruby/rubygems/pull/8488) by neimadTL
 
@@ -92,7 +236,7 @@ Changes already released in 4.0.x are not repeated here.
 #### Breaking changes:
 
 * Remove external tool version checks from `bundle env`. Pull request [#9593](https://github.com/ruby/rubygems/pull/9593) by Hiroshi SHIBATA
-* Bundler: ignore patchlevel kwarg in ruby DSL. Pull request [#6023](https://github.com/ruby/rubygems/pull/6023) by Takuya N
+* Bundler: ignore patchlevel kwarg in ruby DSL. Pull request [#6023](https://github.com/ruby/rubygems/pull/6023) by Takuya N and Hiroshi SHIBATA
 * Unify RubyGems and Bundler documentation. Pull request [#9237](https://github.com/ruby/rubygems/pull/9237) by Hiroshi SHIBATA
 
 #### Deprecations:

data/Manifest.txt

@@ -503,7 +503,7 @@ lib/rubygems/vendor/net-http/lib/net/http/response.rb
 lib/rubygems/vendor/net-http/lib/net/http/responses.rb
 lib/rubygems/vendor/net-http/lib/net/http/status.rb
 lib/rubygems/vendor/net-http/lib/net/https.rb
-lib/rubygems/vendor/net-protocol/LICENSE.txt
+lib/rubygems/vendor/net-protocol/COPYING
 lib/rubygems/vendor/net-protocol/lib/net/protocol.rb
 lib/rubygems/vendor/optparse/COPYING
 lib/rubygems/vendor/optparse/lib/optionparser.rb
@@ -533,8 +533,6 @@ lib/rubygems/vendor/pub_grub/lib/pub_grub/version_constraint.rb
 lib/rubygems/vendor/pub_grub/lib/pub_grub/version_range.rb
 lib/rubygems/vendor/pub_grub/lib/pub_grub/version_solver.rb
 lib/rubygems/vendor/pub_grub/lib/pub_grub/version_union.rb
-lib/rubygems/vendor/resolv/COPYING
-lib/rubygems/vendor/resolv/lib/resolv.rb
 lib/rubygems/vendor/securerandom/COPYING
 lib/rubygems/vendor/securerandom/lib/securerandom.rb
 lib/rubygems/vendor/timeout/COPYING

data/SECURITY.md

@@ -2,6 +2,15 @@
 
 We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly.
 
-For any security bug or issue with the RubyGems client or RubyGems.org service, please email security@rubygems.org with details about the problem or submit a report using [HackerOne](https://hackerone.com/rubygems).
+For any security bug or issue with the RubyGems client, Bundler, or RubyGems.org service, please email security@rubygems.org with details about the problem or submit a report using [HackerOne](https://hackerone.com/rubygems). A malicious or compromised gem published on RubyGems.org can be reported the same way.
 
 For additional information about RubyGems security, please see https://rubygems.org/pages/security.
+
+## Out of scope for RubyGems and Bundler
+
+The following are not treated as vulnerabilities. A technically correct report may still be fixed in public as a regular bug or hardening change.
+
+- Code you chose to run, whether a gem you install or the `Gemfile` of a repository you run `bundle` in. A gem can ship a native extension whose build runs arbitrary code as you, and a `Gemfile` is Ruby code, so anything a crafted gem or repository does within your privileges, such as writing or deleting files or path traversal through gem metadata, adds no capability, whether or not the gem declares extensions.
+- A gem source or mirror you chose to trust. Reports that assume the configured source is malicious or compromised are out of scope, and so is gem metadata that rubygems.org rejects at push time, since it can only arrive from a local file or a gem server you chose to trust.
+- Your own environment and settings. This covers attacks that require write access to files RubyGems or Bundler already load on your behalf, such as plugins, `.gemrc` or `.bundle/config`, and behavior after you explicitly disable a protection such as TLS certificate verification.
+- Issues already fixed on the `master` branch. Please check it before reporting.

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-09-09".freeze
-    @git_commit_sha = "98e4d8083a7".freeze
+    @built_at = "2026-10-28".freeze
+    @git_commit_sha = "cd7536a".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/common.rb

@@ -122,6 +122,10 @@ module Bundler
       raise GemNotFound, gem_not_found_message(name, Bundler.definition.dependencies)
     end
 
+    def self.select_spec_with_match_type(name, options)
+      select_spec(name, options["exact-match"] ? nil : :regex_match)
+    end
+
     def self.default_gem_spec(name)
       gem_spec = Gem::Specification.find_all_by_name(name).last
       gem_spec if gem_spec&.default_gem?

data/lib/bundler/cli/doctor/ssl.rb

@@ -124,14 +124,10 @@ module Bundler
       ctx = OpenSSL::SSL::SSLContext.new
       supported = true
 
-      if ctx.respond_to?(:min_version=)
-        begin
-          ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
-        rescue OpenSSL::SSL::SSLError, NameError
-          supported = false
-        end
-      else
-        supported = OpenSSL::SSL::SSLContext::METHODS.include?(:TLSv1_2) # rubocop:disable Naming/VariableNumber
+      begin
+        ctx.min_version = ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
+      rescue OpenSSL::SSL::SSLError, NameError
+        supported = false
       end
 
       Bundler.ui.warn(<<~EOM) unless supported

data/lib/bundler/cli/info.rb

@@ -26,7 +26,7 @@ module Bundler
     private
 
     def spec_for_gem(name)
-      Bundler::CLI::Common.select_spec(name, :regex_match)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
     end
 
     def print_gem_version(spec)

data/lib/bundler/cli/lock.rb

@@ -42,7 +42,6 @@ module Bundler
 
       Bundler.settings.temporary(frozen: false) do
         definition = Bundler.definition(update, Bundler.default_lockfile)
-        definition.add_checksums if options["add-checksums"]
 
         Bundler::CLI::Common.configure_gem_version_promoter(definition, options) if options[:update]
 
@@ -64,6 +63,11 @@ module Bundler
           raise InvalidOption, "Removing all platforms from the bundle is not allowed"
         end
 
+        # Adding checksums resolves the bundle to fetch them, so it has to
+        # run after every platform change above has been recorded, or the
+        # new platforms are listed in the lockfile without their specs.
+        definition.add_checksums if options["add-checksums"]
+
         definition.remotely! unless options[:local]
 
         if options["normalize-platforms"]
@@ -74,10 +78,21 @@ module Bundler
           puts definition.to_lock
         else
           file = options[:lockfile]
-          file = file ? Pathname.new(file).expand_path : Bundler.default_lockfile
+          file = if file
+            Pathname.new(file).expand_path
+          elsif ENV["BUNDLE_LOCKFILE"].to_s.empty?
+            definition.lockfile
+          else
+            # BUNDLE_LOCKFILE outranks the lockfile method in the Gemfile, see gemfile(5)
+            Bundler.default_lockfile
+          end
 
-          puts "Writing lockfile to #{file}"
-          definition.write_lock(file, false)
+          if file
+            puts "Writing lockfile to #{file}"
+            definition.write_lock(file, false)
+          else
+            Bundler.ui.warn "Not writing a lockfile because the Gemfile sets `lockfile false`"
+          end
         end
 
         Bundler::CLI::Common.output_cooldown_skipped_summary(definition)

data/lib/bundler/cli/open.rb

@@ -13,7 +13,7 @@ module Bundler
       raise InvalidOption, "Cannot specify `--path` option without a value" if !@path.nil? && @path.empty?
       editor = [ENV["BUNDLER_EDITOR"], ENV["VISUAL"], ENV["EDITOR"]].find {|e| !e.nil? && !e.empty? }
       return Bundler.ui.info("To open a bundled gem, set $EDITOR or $BUNDLER_EDITOR") unless editor
-      return unless spec = Bundler::CLI::Common.select_spec(name, :regex_match)
+      return unless spec = spec_for_gem(name)
       if spec.default_gem?
         Bundler.ui.info "Unable to open #{name} because it's a default gem, so the directory it would normally be installed to does not exist."
       else
@@ -35,5 +35,11 @@ module Bundler
       require "shellwords"
       Shellwords.split(editor)
     end
+
+    private
+
+    def spec_for_gem(name)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
+    end
   end
 end

data/lib/bundler/cli/outdated.rb

@@ -90,7 +90,9 @@ module Bundler
         dependency = current_dependencies[current_spec.name]
         groups = ""
         if dependency && !options[:parseable]
-          groups = dependency.groups.join(", ")
+          groups = dependency.groups
+          groups = groups.sort if options_include_groups
+          groups = groups.join(", ")
         end
 
         outdated_gems << {
@@ -101,13 +103,11 @@ module Bundler
         }
       end
 
-      relevant_outdated_gems = if options_include_groups
-        outdated_gems.group_by {|g| g[:groups] }.sort.flat_map do |groups, gems|
-          contains_group = groups.split(", ").include?(options[:group])
-          next unless options[:groups] || contains_group
-
-          gems
-        end.compact
+      relevant_outdated_gems = if options[:groups]
+        without_groups, with_groups = outdated_gems.partition {|g| g[:groups].empty? }
+        with_groups.group_by {|g| g[:groups] }.sort.flat_map(&:last) + without_groups
+      elsif options_include_groups
+        outdated_gems.select {|g| g[:groups].split(", ").include?(options[:group]) }
       else
         outdated_gems
       end
@@ -333,8 +333,6 @@ module Bundler
 
       Bundler.ui.info justify(header, column_sizes)
 
-      data.sort_by! {|row| row[0] }
-
       data.each do |row|
         Bundler.ui.info justify(row, column_sizes)
       end

data/lib/bundler/cli/platform.rb

@@ -25,7 +25,7 @@ module Bundler
       else
         platforms = Bundler.definition.platforms.map {|p| "* #{p}" }
 
-        output << "Your platform is: #{Gem::Platform.local}"
+        output << platform_info
         output << "Your app has gems that work on these platforms:\n#{platforms.join("\n")}"
 
         if ruby_version
@@ -44,5 +44,19 @@ module Bundler
 
       Bundler.ui.info output.join("\n\n")
     end
+
+    private
+
+    def platform_info
+      info = "Your platform is: #{Gem::Platform.local}"
+      return info if Bundler.local_platform == Gem::Platform.local
+
+      info + "\nHowever, your effective platform is: #{Bundler.local_platform} " \
+        "(because force_ruby_platform is #{force_ruby_platform_origin})"
+    end
+
+    def force_ruby_platform_origin
+      Bundler.settings.pretty_values_for(:force_ruby_platform).first.sub(/\ASet /, "set ")
+    end
   end
 end

data/lib/bundler/cli/show.rb

@@ -20,7 +20,7 @@ module Bundler
         if gem_name == "bundler"
           path = File.expand_path("../../..", __dir__)
         else
-          spec = Bundler::CLI::Common.select_spec(gem_name, :regex_match)
+          spec = spec_for_gem(gem_name)
           return unless spec
           path = spec.full_gem_path
           unless File.directory?(path)
@@ -55,6 +55,10 @@ module Bundler
 
     private
 
+    def spec_for_gem(name)
+      Bundler::CLI::Common.select_spec_with_match_type(name, options)
+    end
+
     def fetch_latest_specs
       definition = Bundler.definition(true)
       Bundler.ui.info "Fetching remote specs for outdated check...\n\n"

data/lib/bundler/cli/update.rb

@@ -13,7 +13,7 @@ module Bundler
 
       update_bundler = options[:bundler]
 
-      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler) if update_bundler
+      Bundler.self_manager.update_bundler_and_restart_with_it_if_needed(update_bundler, pre: options[:pre]) if update_bundler
 
       sources = Array(options[:source])
       groups  = Array(options[:group]).map(&:to_sym)

data/lib/bundler/cli.rb

@@ -177,7 +177,7 @@ module Bundler
         else
           puts File.read("#{man_path}/#{File.basename(man_page)}.ronn")
         end
-      elsif command_path = Bundler.which("bundler-#{cli}")
+      elsif command_path = self.class.bundler_command_path(cli)
         Kernel.exec(command_path, "--help")
       else
         super
@@ -189,11 +189,23 @@ module Bundler
         return Bundler::Plugin.exec_command(command, ARGV[1..-1])
       end
 
-      return super unless command_path = Bundler.which("bundler-#{command}")
+      return super unless command_path = bundler_command_path(command)
 
       Kernel.exec(command_path, *ARGV[1..-1])
     end
 
+    # Only PATH is searched, unlike Bundler.which, which also finds a file in
+    # the current directory and returns a bare name that Kernel.exec cannot run.
+    def self.bundler_command_path(command)
+      ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |path|
+        path = path[1..-2] if path.start_with?('"') && path.end_with?('"')
+        command_path = Bundler.find_executable(File.expand_path("bundler-#{command}", path))
+        return command_path if command_path
+      end
+
+      nil
+    end
+
     desc "init [OPTIONS]", "Generates a Gemfile into the current working directory"
     long_desc <<-D
       Init generates a default Gemfile in the current working directory. When adding a
@@ -319,10 +331,10 @@ module Bundler
     method_option "source", type: :array, banner: "Update a specific source (and all gems associated with it)"
     method_option "force", type: :boolean, aliases: "--redownload", banner: "Force reinstalling every gem, even if already installed"
     method_option "ruby", type: :boolean, banner: "Update ruby specified in Gemfile.lock"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "Always choose the highest allowed version when updating gems, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "Do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "Use bundle install conservative update behavior and do not allow shared dependencies to be updated."
@@ -342,6 +354,7 @@ module Bundler
     D
     method_option "paths", type: :boolean, banner: "List the paths of all gems that are required by your Gemfile."
     method_option "outdated", type: :boolean, banner: "Show verbose output including whether gems are outdated (removed)."
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def show(gem_name = nil)
       if ARGV.include?("--outdated")
         removed_message = "the `--outdated` flag to `bundle show` has been removed in favor of `bundle show --verbose`"
@@ -367,6 +380,7 @@ module Bundler
     desc "info GEM [OPTIONS]", "Show information for the given gem"
     method_option "path", type: :boolean, banner: "Print full path to gem"
     method_option "version", type: :boolean, banner: "Print gem version"
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def info(gem_name)
       require_relative "cli/info"
       Info.new(options, gem_name).run
@@ -434,7 +448,7 @@ module Bundler
     method_option "filter-strict", type: :boolean, aliases: "--strict", banner: "Only list newer versions allowed by your Gemfile requirements"
     method_option "update-strict", type: :boolean, banner: "Strict conservative resolution, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "minor", type: :boolean, banner: "Prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "Prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "Prefer updating to latest major version (default)"
     method_option "patch", type: :boolean, banner: "Prefer updating only to next patch version"
     method_option "filter-major", type: :boolean, banner: "Only list major newer versions"
     method_option "filter-minor", type: :boolean, banner: "Only list minor newer versions"
@@ -530,6 +544,7 @@ module Bundler
 
     desc "open GEM", "Opens the source directory of the given bundled gem"
     method_option "path", type: :string, lazy_default: "", banner: "Open relative path of the gem source."
+    method_option "exact-match", type: :boolean, banner: "Only match gems whose names exactly match the given name"
     def open(name)
       require_relative "cli/open"
       Open.new(options, name).run
@@ -640,11 +655,11 @@ module Bundler
     method_option "normalize-platforms", type: :boolean, default: false, banner: "Normalize lockfile platforms"
     method_option "patch", type: :boolean, banner: "If updating, prefer updating only to next patch version"
     method_option "minor", type: :boolean, banner: "If updating, prefer updating only to next minor version"
-    method_option "major", type: :boolean, banner: "If updating, prefer updating to next major version (default)"
+    method_option "major", type: :boolean, banner: "If updating, prefer updating to latest major version (default)"
     method_option "pre", type: :boolean, banner: "If updating, always choose the highest allowed version, regardless of prerelease status"
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
-    method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "bundler", type: :string, lazy_default: ">= #{Bundler::VERSION}", banner: "Update the locked version of bundler"
     method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"

data/lib/bundler/constants.rb

@@ -3,7 +3,7 @@
 require "rbconfig"
 
 module Bundler
-  WINDOWS = RbConfig::CONFIG["host_os"] =~ /(msdos|mswin|djgpp|mingw)/
+  WINDOWS = RbConfig::CONFIG["host_os"] =~ /(mswin|mingw)/
   deprecate_constant :WINDOWS
 
   FREEBSD = RbConfig::CONFIG["host_os"].to_s.include?("bsd")