rubygems-update 4.1.0.beta2 → 4.1.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92ef5aaf37fa34e9c54d4ccb621998b24ad8a17dacf8fd40c4d3431b1deadf5f
-  data.tar.gz: b7f8ac5ccc71b284957ce258ce02c6930926da7e32d15ac1295220fd7caa6dbc
+  metadata.gz: 6318a5162408d17e02ca7534ba15f8701fe7eeeeaf7d891f4331588d0e595472
+  data.tar.gz: c044abf170bb96482454ed885860c11aa96cda0618cdaac5177009bdbb1d814d
 SHA512:
-  metadata.gz: f27352dfa7e4d9f164444c96ee7ce41ff17dd8288ce4a7e96f3f5c4ca3452fee4427a73abb7c82f753165488880039fcef77e6d3870addf9a57d908cfe8f3810
-  data.tar.gz: 1dcf75db4af1ac4206836b95283658481f5d70a3a049e06959a642efbcb5e7a4945067417b43daa8ac648f72aa6d7124907c31546ba82f1102fa334237426bc5
+  metadata.gz: 3c0e7401e36950ef3563213d1489dacccf2cdabf370c63bdb789a0ac0f0bd68987d3ac558dcb9054bbd9dc6ab0003853878d4563f43a43fb995d77d6ecfd6ddb
+  data.tar.gz: 0677d5d8ec93ba1e7d6698c7b480d5f496cc2d42a37aea380e981133da66ef3b49bece38b90aab61425a30c5b7126e6f2354eea48614b508ec6ac72e6225e856

data/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 Bundler's changelog before 4.0.0, when it was versioned separately from RubyGems, is in [doc/CHANGELOG-bundler-2.x.md](https://github.com/ruby/rubygems/blob/master/doc/CHANGELOG-bundler-2.x.md).
 
+## 4.1.0.beta3 / 2026-10-28
+
+### RubyGems
+
+#### Enhancements:
+
+* Installs bundler 4.1.0.beta3 as a default gem.
+
+#### Bug fixes:
+
+* Skip executable removal gracefully when the bin directory is missing. Pull request [#9963](https://github.com/ruby/rubygems/pull/9963) by Evan Li and Hiroshi SHIBATA
+* Fix file locks letting multiple processes in when lock files are removed. Pull request [#9930](https://github.com/ruby/rubygems/pull/9930) by Richard Janita and Hiroshi SHIBATA
+* Turn off echo before printing the password prompt. Pull request [#9969](https://github.com/ruby/rubygems/pull/9969) by Mike Dalessio
+
+### Bundler
+
+Changes already released in 4.0.x are not repeated here.
+
+#### Features:
+
+* Rename the `from:` and `to:` keys of `override` to `in:` and `with:`. Pull request [#9979](https://github.com/ruby/rubygems/pull/9979) by Hiroshi SHIBATA
+* Record overrides in Gemfile.lock (`OVERRIDES` section). Pull request [#9958](https://github.com/ruby/rubygems/pull/9958) by Ufuk Kayserilioglu
+
+#### Bug fixes:
+
+* Make `Bundler::Source::Rubygems#hash` agree with `eql?`. Pull request [#9983](https://github.com/ruby/rubygems/pull/9983) by Hiroshi SHIBATA
+* Add checksums after platform changes in `bundle lock`. Pull request [#9960](https://github.com/ruby/rubygems/pull/9960) by Farid Zakaria
+* Apply BUNDLE_RETRY to lazy gemspec downloads. Pull request [#9868](https://github.com/ruby/rubygems/pull/9868) by Islam Elsayed
+* Fix file locks letting multiple processes in when lock files are removed. Pull request [#9930](https://github.com/ruby/rubygems/pull/9930) by Richard Janita and Hiroshi SHIBATA
+* Preload git sources that share a cache one after another. Pull request [#9951](https://github.com/ruby/rubygems/pull/9951) by Shai
+
+## 4.0.23 / 2026-10-14
+
+### RubyGems
+
+#### Enhancements:
+
+* Update vendored gems to latest versions. Pull request [#9948](https://github.com/ruby/rubygems/pull/9948) by Hiroshi SHIBATA
+* Drop setuid, setgid and sticky bits when extracting gems. Pull request [#9929](https://github.com/ruby/rubygems/pull/9929) by Hiroshi SHIBATA
+* Improve handling of paths with invalid Windows characters. Pull request [#9276](https://github.com/ruby/rubygems/pull/9276) by Said Kaldybaev and Hiroshi SHIBATA
+* Installs bundler 4.0.23 as a default gem.
+
+### Bundler
+
+#### Enhancements:
+
+* Update vendored gems to latest versions. Pull request [#9948](https://github.com/ruby/rubygems/pull/9948) by Hiroshi SHIBATA
+
+#### Bug fixes:
+
+* Stop retrying a 416 response to a request without Range. Pull request [#9938](https://github.com/ruby/rubygems/pull/9938) by Hiroshi SHIBATA
+* Respect Gemfile lockfile in `bundle lock`. Pull request [#9661](https://github.com/ruby/rubygems/pull/9661) by David Stosik and Hiroshi SHIBATA
+
 ## 4.1.0.beta2 / 2026-10-08
 
 ### RubyGems

data/Manifest.txt

@@ -503,7 +503,7 @@ lib/rubygems/vendor/net-http/lib/net/http/response.rb
 lib/rubygems/vendor/net-http/lib/net/http/responses.rb
 lib/rubygems/vendor/net-http/lib/net/http/status.rb
 lib/rubygems/vendor/net-http/lib/net/https.rb
-lib/rubygems/vendor/net-protocol/LICENSE.txt
+lib/rubygems/vendor/net-protocol/COPYING
 lib/rubygems/vendor/net-protocol/lib/net/protocol.rb
 lib/rubygems/vendor/optparse/COPYING
 lib/rubygems/vendor/optparse/lib/optionparser.rb

data/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2026-10-08".freeze
-    @git_commit_sha = "f8b8b02".freeze
+    @built_at = "2026-10-28".freeze
+    @git_commit_sha = "cd7536a".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/lib/bundler/cli/lock.rb

@@ -42,7 +42,6 @@ module Bundler
 
       Bundler.settings.temporary(frozen: false) do
         definition = Bundler.definition(update, Bundler.default_lockfile)
-        definition.add_checksums if options["add-checksums"]
 
         Bundler::CLI::Common.configure_gem_version_promoter(definition, options) if options[:update]
 
@@ -64,6 +63,11 @@ module Bundler
           raise InvalidOption, "Removing all platforms from the bundle is not allowed"
         end
 
+        # Adding checksums resolves the bundle to fetch them, so it has to
+        # run after every platform change above has been recorded, or the
+        # new platforms are listed in the lockfile without their specs.
+        definition.add_checksums if options["add-checksums"]
+
         definition.remotely! unless options[:local]
 
         if options["normalize-platforms"]

data/lib/bundler/definition.rb

@@ -167,6 +167,7 @@ module Bundler
 
       @dependency_changes = converge_dependencies
       @local_changes = converge_locals
+      @override_changes = converge_overrides
 
       check_lockfile
     end
@@ -477,6 +478,11 @@ module Bundler
       @resolved_bundler_version || Bundler.gem_version
     end
 
+    # The lines for the OVERRIDES section of Gemfile.lock.
+    def overrides_to_lock
+      @overrides.map(&:to_lock).uniq
+    end
+
     def to_lock
       require_relative "lockfile_generator"
       LockfileGenerator.generate(self)
@@ -599,6 +605,11 @@ module Bundler
       added.concat new_deps.map {|d| "* #{pretty_dep(d)}" } if new_deps.any?
       deleted.concat deleted_deps.map {|d| "* #{pretty_dep(d)}" } if deleted_deps.any?
 
+      if @override_changes
+        added.concat((overrides_to_lock - locked_overrides_to_lock).sort.map {|o| "* override #{o}" })
+        deleted.concat((locked_overrides_to_lock - overrides_to_lock).sort.map {|o| "* override #{o}" })
+      end
+
       both_sources = Hash.new {|h, k| h[k] = [] }
       current_dependencies.each {|d| both_sources[d.name][0] = d }
       current_locked_dependencies.each {|d| both_sources[d.name][1] = d }
@@ -908,6 +919,8 @@ module Bundler
         else
           lockfile_changed_reason
         end
+      elsif @override_changes
+        "the overrides in your gemfile changed"
       else
         "some dependencies were deleted from your gemfile"
       end
@@ -943,6 +956,7 @@ module Bundler
         [@locked_spec_with_empty_checksums, "your lockfile has an empty CHECKSUMS entry for \"#{@locked_spec_with_empty_checksums}\""],
         [@locked_spec_with_missing_deps, "your lockfile includes \"#{@locked_spec_with_missing_deps}\" but not some of its dependencies"],
         [@locked_spec_with_invalid_deps, "your lockfile does not satisfy dependencies of \"#{@locked_spec_with_invalid_deps}\""],
+        [@override_changes, "the overrides in your gemfile changed"],
       ].select(&:first).map(&:last).join(", ")
     end
 
@@ -1115,7 +1129,7 @@ module Bundler
     end
 
     # The lockfile keeps the upstream dependencies of every gem, so a gem that
-    # a `from:`/`to:` override cut loose stays locked until a resolution drops
+    # a `with:`/`in:` override cut loose stays locked until a resolution drops
     # it.
     def converge_rewritten_dependencies
       @overrides.each do |override|
@@ -1135,7 +1149,7 @@ module Bundler
       end
     end
 
-    # A misspelled `from:` gem leaves the override with nothing to rewrite.
+    # A misspelled `in:` gem leaves the override with nothing to rewrite.
     def warn_inert_overrides(specs)
       @overrides.each do |override|
         next unless override.from
@@ -1145,13 +1159,29 @@ module Bundler
       end
     end
 
+    # The lockfile records the Gemfile's overrides, so a change to them is a
+    # change to the lockfile even when every locked version still satisfies
+    # them. Rewriting the section needs no resolution, so this stays out of
+    # #something_changed?. #write_lock rewrites it because the generated
+    # contents differ, and the frozen check reports it.
+    def converge_overrides
+      return false unless @locked_gems
+
+      overrides_to_lock.sort != locked_overrides_to_lock.sort
+    end
+
+    def locked_overrides_to_lock
+      Array(@locked_gems&.overrides).map(&:to_lock).uniq
+    end
+
     def converge_overrides_outside_dependencies
       @overrides.each do |override|
-        # :all and metadata overrides are intentionally not pre-unlocked. The
-        # lockfile does not record overrides, so unlocking for them would
-        # re-resolve on every run and reject every frozen install. Install-time
-        # compatibility checks already honor them for locked specs, and they
-        # affect resolution on a fresh lock or when the user runs `bundle update`.
+        # :all and metadata overrides are intentionally not pre-unlocked.
+        # Unlocking for them would re-resolve gems the user did not ask to
+        # move. Install-time compatibility checks already honor them for locked
+        # specs, and they affect resolution on a fresh lock or when the user
+        # runs `bundle update`. Changing one still rewrites the OVERRIDES
+        # section (see #converge_overrides).
         next unless override.target.is_a?(String) && override.field == :version
 
         name = override.target
@@ -1266,7 +1296,7 @@ module Bundler
     def preload_git_source_worker
       workers = Bundler.settings.installation_parallelization
 
-      @preload_git_source_worker ||= Bundler::Worker.new(workers, "Git source preloading", ->(source, _) { source.specs })
+      @preload_git_source_worker ||= Bundler::Worker.new(workers, "Git source preloading", ->(sources, _) { sources.each(&:specs) })
     end
 
     def preload_git_sources
@@ -1277,7 +1307,13 @@ module Bundler
       end
 
       begin
-        needed_git_sources.each {|source| preload_git_source_worker.enq(source) }
+        # Sources from the same repository share one cache directory, and
+        # running git in that directory from two workers at once makes the
+        # fetches collide. Preload sources that share a cache in one job, one
+        # after the other, and run the separate caches in parallel.
+        needed_git_sources.group_by(&:cache_path).each_value do |sources|
+          preload_git_source_worker.enq(sources)
+        end
       ensure
         preload_git_source_worker.stop
       end

data/lib/bundler/dsl.rb

@@ -202,7 +202,12 @@ module Bundler
       validate_override_target!(target)
       source_location = caller_locations(1, 1)&.first
 
-      if operations.key?(:from) || operations.key?(:to)
+      # 4.1.0.beta2 spelled `with:` and `in:` as `to:` and `from:`.
+      if operations.key?(:from)
+        raise ArgumentError, "`from:` and `to:` of `override` are now `in:` and `with:`; write `override #{target.inspect}, with: #{operations.fetch(:to, "<gem>").inspect}, in: #{operations[:from].inspect}`"
+      end
+
+      if operations.key?(:in) || operations.key?(:with)
         add_dependency_override(target, operations, source_location)
         return
       end
@@ -292,8 +297,16 @@ module Bundler
 
     def validate_override_target!(target)
       return if target == :all
-      return if target.is_a?(String)
-      raise ArgumentError, "override target must be :all or a gem name string, got #{target.inspect}"
+      raise ArgumentError, "override target must be :all or a gem name string, got #{target.inspect}" unless target.is_a?(String)
+      validate_override_gem_name!(target)
+    end
+
+    # Override names are recorded in the lockfile's OVERRIDES section, so they
+    # must be valid gem names.
+    def validate_override_gem_name!(name)
+      validate_gem_name!(name)
+      return if Gem::Specification::VALID_NAME_PATTERN.match?(name)
+      raise GemfileError, "#{name.inspect} is not a valid gem name"
     end
 
     def validate_override_field!(field)
@@ -324,40 +337,40 @@ module Bundler
     end
 
     def add_dependency_override(target, operations, source_location)
-      unless operations.key?(:from)
-        raise ArgumentError, "`override #{target.inspect}, to:` requires `from:` naming the gem whose dependency is rewritten"
+      unless operations.key?(:in)
+        raise ArgumentError, "`override #{target.inspect}, with:` requires `in:` naming the gem whose dependency is rewritten"
       end
-      unless operations.key?(:to)
-        raise ArgumentError, "`override #{target.inspect}, from:` requires `to:`; use `to: nil` to drop the dependency or `to: \"<gem>\"` to replace it"
+      unless operations.key?(:with)
+        raise ArgumentError, "`override #{target.inspect}, in:` requires `with:`; use `with: nil` to drop the dependency or `with: \"<gem>\"` to replace it"
       end
 
-      from = operations[:from]
-      to = operations[:to]
+      from = operations[:in]
+      with = operations[:with]
       requirement = operations[:version]
 
-      raise ArgumentError, "`override :all` does not accept `from:`" if target == :all
-      raise ArgumentError, "`from:` must be a gem name string, got #{from.inspect}" unless from.is_a?(String)
-      raise ArgumentError, "`to:` must be a gem name string or nil, got #{to.inspect}" unless to.nil? || to.is_a?(String)
-      raise ArgumentError, "`to:` must name a gem other than #{target.inspect} and #{from.inspect}" if to == target || to == from
-      validate_gem_name!(from)
-      validate_gem_name!(to) if to
+      raise ArgumentError, "`override :all` does not accept `in:`" if target == :all
+      raise ArgumentError, "`in:` must be a gem name string, got #{from.inspect}" unless from.is_a?(String)
+      raise ArgumentError, "`with:` must be a gem name string or nil, got #{with.inspect}" unless with.nil? || with.is_a?(String)
+      raise ArgumentError, "`with:` must name a gem other than #{target.inspect} and #{from.inspect}" if with == target || with == from
+      validate_override_gem_name!(from)
+      validate_override_gem_name!(with) if with
 
-      unsupported = operations.keys - [:from, :to, :version]
+      unsupported = operations.keys - [:in, :with, :version]
       if unsupported.any?
-        raise ArgumentError, "unsupported override field `#{unsupported.first}:` with `from:`; supported fields: `to:`, `version:`"
+        raise ArgumentError, "unsupported override field `#{unsupported.first}:` with `in:`; supported fields: `with:`, `version:`"
       end
 
       if operations.key?(:version)
-        raise ArgumentError, "`version:` with `from:` requires `to:` to name a replacement gem" if to.nil?
-        raise ArgumentError, "`version:` with `from:` must be a version requirement string, got #{requirement.inspect}" unless requirement.is_a?(String)
+        raise ArgumentError, "`version:` with `in:` requires `with:` to name a replacement gem" if with.nil?
+        raise ArgumentError, "`version:` with `in:` must be a version requirement string, got #{requirement.inspect}" unless requirement.is_a?(String)
         validate_override_operation!(requirement)
       end
 
       if @overrides.any? {|o| o.target == target && o.from == from }
-        raise ArgumentError, "duplicate override for #{target.inspect} `from: #{from.inspect}`"
+        raise ArgumentError, "duplicate override for #{target.inspect} `in: #{from.inspect}`"
       end
 
-      @overrides << Override.new(target, :to, to, from: from, requirement: requirement, source_location: source_location)
+      @overrides << Override.new(target, :with, with, from: from, requirement: requirement, source_location: source_location)
     end
 
     # Dropping a gem the Gemfile requires directly would leave it installed

data/lib/bundler/fetcher/downloader.rb

@@ -66,6 +66,8 @@ module Bundler
           end
           fetch(new_uri, headers, counter + 1)
         when Gem::Net::HTTPRequestedRangeNotSatisfiable
+          raise bad_response(response) unless headers.key?("Range")
+
           new_headers = headers.dup
           new_headers.delete("Range")
           fetch(uri, new_headers)
@@ -81,9 +83,7 @@ module Bundler
         when Gem::Net::HTTPNotFound
           raise FallbackError, "Gem::Net::HTTPNotFound: #{filtered_uri}"
         else
-          message = "Gem::#{response.class.name.gsub(/\AGem::/, "")}"
-          message += ": #{response.body}" unless response.body.empty?
-          raise HTTPError, message
+          raise bad_response(response)
         end
       end
 
@@ -121,6 +121,12 @@ module Bundler
 
       private
 
+      def bad_response(response)
+        message = "Gem::#{response.class.name.gsub(/\AGem::/, "")}"
+        message += ": #{response.body}" unless response.body.empty?
+        HTTPError.new(message)
+      end
+
       def network_down_error(uri, filtered_uri)
         host = uri.host
         host_port = "#{host}:#{uri.port}"

data/lib/bundler/fetcher.rb

@@ -157,7 +157,10 @@ module Bundler
       elsif cached_spec_path = gemspec_cached_path(spec_file_name)
         Bundler.load_gemspec(cached_spec_path)
       else
-        Bundler.safe_load_marshal Bundler.rubygems.inflate(downloader.fetch(uri).body)
+        body = Bundler::Retry.new("fetcher", FAIL_ERRORS).attempts do
+          downloader.fetch(uri).body
+        end
+        Bundler.safe_load_marshal Bundler.rubygems.inflate(body)
       end
       raise MarshalError, "is #{spec.inspect}" unless spec.is_a?(Gem::Specification)
       spec

data/lib/bundler/lockfile_generator.rb

@@ -19,6 +19,7 @@ module Bundler
       add_sources
       add_platforms
       add_dependencies
+      add_overrides
       add_content_addresses
       add_checksums
       add_locked_ruby_version
@@ -67,6 +68,11 @@ module Bundler
       end
     end
 
+    def add_overrides
+      overrides = definition.overrides_to_lock
+      add_section("OVERRIDES", overrides) unless overrides.empty?
+    end
+
     def add_content_addresses
       content_addresses = definition.resolve.filter_map do |spec|
         next unless Gem::ContentAddress.content_addressed?(spec, validate_ruby_abi: false)

data/lib/bundler/lockfile_parser.rb

@@ -36,12 +36,14 @@ module Bundler
       :bundler_version,
       :ruby_version,
       :checksums,
+      :overrides,
     )
 
     BUNDLED      = "BUNDLED WITH"
     DEPENDENCIES = "DEPENDENCIES"
     CHECKSUMS    = "CHECKSUMS"
     CONTENT_ADDRESSES = "CONTENT ADDRESSES"
+    OVERRIDES    = "OVERRIDES"
     PLATFORMS    = "PLATFORMS"
     RUBY         = "RUBY VERSION"
     GIT          = "GIT"
@@ -61,7 +63,11 @@ module Bundler
       Gem::Version.create("4.1.0") => [CONTENT_ADDRESSES].freeze,
     }.freeze
 
-    KNOWN_SECTIONS = SECTIONS_BY_VERSION_INTRODUCED.values.flatten!.freeze
+    # OVERRIDES is deliberately not in SECTIONS_BY_VERSION_INTRODUCED. Sections
+    # listed there are ignored when comparing a lockfile bundled with an older
+    # Bundler, so a lockfile still BUNDLED WITH 4.0 would never get its
+    # overrides recorded while the resolution stays the same.
+    KNOWN_SECTIONS = (SECTIONS_BY_VERSION_INTRODUCED.values.flatten + [OVERRIDES]).freeze
 
     ENVIRONMENT_VERSION_SECTIONS = [BUNDLED, RUBY].freeze
     deprecate_constant(:ENVIRONMENT_VERSION_SECTIONS)
@@ -104,6 +110,7 @@ module Bundler
       @dependencies = {}
       @parse_method = nil
       @specs        = {}
+      @overrides    = nil
       @lockfile_path = lockfile_path || begin
         SharedHelpers.relative_lockfile_path
       rescue GemfileNotFound
@@ -144,6 +151,9 @@ module Bundler
           @parse_method = :parse_checksum
         elsif line == CONTENT_ADDRESSES
           @parse_method = :parse_content_address
+        elsif line == OVERRIDES
+          @overrides = []
+          @parse_method = :parse_override
         elsif line == PLATFORMS
           @parse_method = :parse_platform
         elsif line == RUBY
@@ -270,6 +280,12 @@ module Bundler
       @dependencies[dep.name] = dep
     end
 
+    def parse_override(line)
+      raise ArgumentError, "invalid override in lockfile: #{line.inspect}" unless line.start_with?("  ") && line[2] != " "
+
+      @overrides << Override.from_lock(line[2..])
+    end
+
     def parse_checksum(line)
       return unless line =~ NAME_VERSION
 

data/lib/bundler/man/gemfile.5

@@ -521,32 +521,41 @@ gem "rails", "~> 7\.0"
 .fi
 .IP "" 0
 .P
-The override only affects resolution and the install\-time Ruby/RubyGems compatibility checks; \fBGemfile\.lock\fR continues to reflect the resolved versions, not the rewritten requirements\. When resolution still fails, Bundler appends the active overrides (with their Gemfile location) to the error message so it is clear which override shaped the constraint set\.
+The override only affects resolution and the install\-time Ruby/RubyGems compatibility checks; the gems in \fBGemfile\.lock\fR continue to reflect the resolved versions, not the rewritten requirements\. The overrides themselves are recorded in the lockfile's \fBOVERRIDES\fR section, one line per field, sorted:
+.IP "" 4
+.nf
+OVERRIDES
+  "rails", version: ">= 8\.0"
+  :all, required_ruby_version: :ignore_upper
+.fi
+.IP "" 0
+.P
+Requirements are recorded in normalized form, so \fB">=8\.0"\fR and \fB">= 8\.0"\fR are the same override\. A frozen install fails when the Gemfile's overrides differ from the recorded ones\. Adding or removing a \fB:all\fR or metadata override rewrites the section and keeps the locked versions\. The exception is a locked gem that is not installed and whose metadata rejects the current Ruby\. Bundler re\-resolves it, as it does without the override\. Run \fBbundle update\fR to re\-resolve under the override\. When resolution still fails, Bundler appends the active overrides (with their Gemfile location) to the error message so it is clear which override shaped the constraint set\.
 .SS "DROPPING OR REPLACING A DEPENDENCY"
-\fBfrom:\fR and \fBto:\fR rewrite a single dependency of a single gem:
+\fBwith:\fR and \fBin:\fR rewrite a single dependency of a single gem:
 .IP "" 4
 .nf
-override <target>, from: <gem>, to: nil
-override <target>, from: <gem>, to: <replacement>, version: <requirement>
+override <target>, with: nil, in: <gem>
+override <target>, with: <replacement>, in: <gem>, version: <requirement>
 .fi
 .IP "" 0
 .P
-\fBto: nil\fR removes the dependency of \fB<gem>\fR on \fB<target>\fR, so \fB<target>\fR is not installed unless something else still requires it\. \fBto: <replacement>\fR makes \fB<gem>\fR depend on \fB<replacement>\fR instead of \fB<target>\fR\. The requirement \fB<gem>\fR put on \fB<target>\fR is discarded, and the optional \fBversion:\fR gives the replacement its own\. Both forms apply whether \fB<gem>\fR is a direct or a transitive dependency\.
+\fBwith: nil\fR removes the dependency of \fB<gem>\fR on \fB<target>\fR, so \fB<target>\fR is not installed unless something else still requires it\. \fBwith: <replacement>\fR makes \fB<gem>\fR depend on \fB<replacement>\fR instead of \fB<target>\fR\. The requirement \fB<gem>\fR put on \fB<target>\fR is discarded, and the optional \fBversion:\fR gives the replacement its own\. Both forms apply whether \fB<gem>\fR is a direct or a transitive dependency\.
 .P
-\fBfrom:\fR is required, and so is \fBto:\fR once \fBfrom:\fR is given\. To rewrite the same dependency of several gems, write one \fBoverride\fR per gem\. It is an error to declare the same \fB<target>\fR and \fBfrom:\fR twice, to drop a gem that the Gemfile requires directly, or to replace a gem that another gem still requires, since both would then be in the bundle\.
+\fBin:\fR is required, and so is \fBwith:\fR once \fBin:\fR is given\. To rewrite the same dependency of several gems, write one \fBoverride\fR per gem\. It is an error to declare the same \fB<target>\fR and \fBin:\fR twice, to drop a gem that the Gemfile requires directly, or to replace a gem that another gem still requires, since both would then be in the bundle\.
 .IP "" 4
 .nf
 # jekyll only loads em\-websocket for `jekyll serve \-\-livereload`\.
-override "em\-websocket", from: "jekyll", to: nil
+override "em\-websocket", with: nil, in: "jekyll"
 
 # Use an API\-compatible gem that provides the same files\.
-override "foo", from: "bar", to: "foo\-lite"
+override "foo", with: "foo\-lite", in: "bar"
 .fi
 .IP "" 0
 .P
 Bundler does not check what a gem loads at runtime\. If \fB<gem>\fR requires \fB<target>\fR unconditionally, dropping it makes that require raise \fBLoadError\fR, as with jekyll's dependency on jekyll\-sass\-converter or the adapters that faraday 1\.x requires on load\. A replacement only works when it provides the files \fB<gem>\fR requires, and it does not take over the name of \fB<target>\fR: \fBGem\.loaded_specs\fR has no entry for \fB<target>\fR, and \fBgem "<target>"\fR fails\.
 .P
-\fBGemfile\.lock\fR keeps listing \fB<target>\fR under \fB<gem>\fR as the gem publishes it, while the locked gems leave \fB<target>\fR out or include \fB<replacement>\fR\. A frozen install accepts that lockfile as long as the Gemfile still has the override\. Removing the override makes Bundler resolve \fB<target>\fR again\.
+\fBGemfile\.lock\fR keeps listing \fB<target>\fR under \fB<gem>\fR as the gem publishes it, while the locked gems leave \fB<target>\fR out or include \fB<replacement>\fR, and the \fBOVERRIDES\fR section records the rewrite so tools that read the lockfile can apply it\. A frozen install accepts that lockfile as long as the Gemfile still has the override\. Removing the override makes Bundler resolve \fB<target>\fR again\.
 .SH "SOURCE PRIORITY"
 When attempting to locate a gem to satisfy a gem requirement, bundler uses the following priority order:
 .IP "1." 4

data/lib/bundler/man/gemfile.5.ronn

@@ -623,36 +623,49 @@ Declaring the same `target` and `field` twice is an error.
     gem "rails", "~> 7.0"
 
 The override only affects resolution and the install-time Ruby/RubyGems
-compatibility checks; `Gemfile.lock` continues to reflect the resolved
-versions, not the rewritten requirements. When resolution still fails,
+compatibility checks; the gems in `Gemfile.lock` continue to reflect the
+resolved versions, not the rewritten requirements. The overrides themselves are
+recorded in the lockfile's `OVERRIDES` section, one line per field, sorted:
+
+    OVERRIDES
+      "rails", version: ">= 8.0"
+      :all, required_ruby_version: :ignore_upper
+
+Requirements are recorded in normalized form, so `">=8.0"` and `">= 8.0"` are
+the same override. A frozen install fails when the Gemfile's overrides differ
+from the recorded ones. Adding or removing a `:all` or metadata override
+rewrites the section and keeps the locked versions. The exception is a locked
+gem that is not installed and whose metadata rejects the current Ruby. Bundler
+re-resolves it, as it does without the override. Run `bundle update` to
+re-resolve under the override. When resolution still fails,
 Bundler appends the active overrides (with their Gemfile location) to the
 error message so it is clear which override shaped the constraint set.
 
 ### DROPPING OR REPLACING A DEPENDENCY
 
-`from:` and `to:` rewrite a single dependency of a single gem:
+`with:` and `in:` rewrite a single dependency of a single gem:
 
-    override <target>, from: <gem>, to: nil
-    override <target>, from: <gem>, to: <replacement>, version: <requirement>
+    override <target>, with: nil, in: <gem>
+    override <target>, with: <replacement>, in: <gem>, version: <requirement>
 
-`to: nil` removes the dependency of `<gem>` on `<target>`, so `<target>` is
-not installed unless something else still requires it. `to: <replacement>`
+`with: nil` removes the dependency of `<gem>` on `<target>`, so `<target>` is
+not installed unless something else still requires it. `with: <replacement>`
 makes `<gem>` depend on `<replacement>` instead of `<target>`. The requirement
 `<gem>` put on `<target>` is discarded, and the optional `version:` gives the
 replacement its own. Both forms apply whether `<gem>` is a direct or a
 transitive dependency.
 
-`from:` is required, and so is `to:` once `from:` is given. To rewrite the
+`in:` is required, and so is `with:` once `in:` is given. To rewrite the
 same dependency of several gems, write one `override` per gem. It is an error
-to declare the same `<target>` and `from:` twice, to drop a gem that the
+to declare the same `<target>` and `in:` twice, to drop a gem that the
 Gemfile requires directly, or to replace a gem that another gem still
 requires, since both would then be in the bundle.
 
     # jekyll only loads em-websocket for `jekyll serve --livereload`.
-    override "em-websocket", from: "jekyll", to: nil
+    override "em-websocket", with: nil, in: "jekyll"
 
     # Use an API-compatible gem that provides the same files.
-    override "foo", from: "bar", to: "foo-lite"
+    override "foo", with: "foo-lite", in: "bar"
 
 Bundler does not check what a gem loads at runtime. If `<gem>` requires
 `<target>` unconditionally, dropping it makes that require raise `LoadError`,
@@ -662,9 +675,10 @@ files `<gem>` requires, and it does not take over the name of `<target>`:
 `Gem.loaded_specs` has no entry for `<target>`, and `gem "<target>"` fails.
 
 `Gemfile.lock` keeps listing `<target>` under `<gem>` as the gem publishes it,
-while the locked gems leave `<target>` out or include `<replacement>`. A
-frozen install accepts that lockfile as long as the Gemfile still has the
-override. Removing the override makes Bundler resolve `<target>` again.
+while the locked gems leave `<target>` out or include `<replacement>`, and the
+`OVERRIDES` section records the rewrite so tools that read the lockfile can
+apply it. A frozen install accepts that lockfile as long as the Gemfile still
+has the override. Removing the override makes Bundler resolve `<target>` again.
 
 ## SOURCE PRIORITY
 

data/lib/bundler/match_platform.rb

@@ -27,9 +27,18 @@ module Bundler
     end
 
     def self.prefer_content_addressable(matching)
-      addressable, non_addressable = matching.partition {|s| Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false) }
-      return matching if addressable.empty?
-
+      first = matching.index {|s| Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false) }
+      return matching unless first
+
+      addressable = [matching[first]]
+      non_addressable = matching.take(first)
+      matching.drop(first + 1).each do |s|
+        if Gem::ContentAddress.content_addressed?(s, validate_ruby_abi: false)
+          addressable << s
+        else
+          non_addressable << s
+        end
+      end
       compatible = addressable.select(&:matches_current_metadata?)
       return compatible if compatible.any?