rubygems-update 3.2.16 → 3.2.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ccd219adf38f48a5bf473e99fc307d14829f6fcef8cd1a74cf1da058ab7e82a0
-  data.tar.gz: fb9a36d286fcb7dd940495c5abdbe92bc5008ab736ebc581568b12e46984e746
+  metadata.gz: dcfc421015c33e4d4d5d8239aa5ba4f8355677b0509a7e83cb8e13fd22a8ef27
+  data.tar.gz: b535b85781ca843a1a876770a42a495f2384bf698d1d2e8dbabba15a5e0e0ea0
 SHA512:
-  metadata.gz: 6fb98ef231fdb44f615927ff27be6b92b42306eb5f4a89df105775dbe45d632c596fb5f41359a94b6488952a595f7707bf29811d228732125edb638616185aef
-  data.tar.gz: 90aa71948495dd12cbcf701827e85a523521dbe08774729e4de857a60c9be2c180781fa98172100a71025169690f7f9ffffa82ca30d288b421c7f59691c501ec
+  metadata.gz: 13c39ab5f867862e4a4b54e592fb8e7cddc2832dd2d57b54698887b618ff5785f33e06860129c9c85bc8ed63fb87a9dbb4789532c6824f44dbbbb3068307e613
+  data.tar.gz: 780f6bab25cdb0c7fc4f328c632dcaaa60275e0bb823b5b4b891780a69df3dc6cf1b3ee8488dd4472f6c03cb382daf5069584b39ba756d115f23ba9bfae70e9d

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+# 3.2.17 / 2021-05-05
+
+## Enhancements:
+
+* Only print month & year in deprecation messages. Pull request #3085 by
+  Schwad
+* Make deprecate method support ruby3's keyword arguments. Pull request
+  #4558 by mame
+* Update the default bindir on macOS. Pull request #4524 by nobu
+* Prefer File.open instead of Kernel#open. Pull request #4529 by mame
+
+## Documentation:
+
+* Fix usage messages to reflect the current POSIX-compatible behaviour.
+  Pull request #4551 by graywolf-at-work
+
 # 3.2.16 / 2021-04-08
 
 ## Bug fixes:
@@ -723,7 +739,7 @@
 * Clean which command. Pull request #2801 by Luis Sagastume.
 * Upgrading S3 source signature to AWS SigV4. Pull request #2807 by
   Alexander Pakulov.
-* Remove missleading comment, no reason to move Gem.host to Gem::Util.
+* Remove misleading comment, no reason to move Gem.host to Gem::Util.
   Pull request #2811 by Luis Sagastume.
 * Drop support for 'gem env packageversion'. Pull request #2813 by Luis
   Sagastume.
@@ -1723,7 +1739,7 @@ Security fixes:
 * Clean up the PathSupport object. Pull request #1094 by Aaron Patterson.
 * Join with File::PATH_SEPARATOR in Gem.use_paths. Pull request #1476 by
   Samuel E. Giddins.
-* Handle when the gem home and gem path arent set in the config file. Pull
+* Handle when the gem home and gem path aren't set in the config file. Pull
   request #1478 by Samuel E. Giddins.
 * Terminate TimeoutHandler. Pull request #1479 by Nobuyoshi Nakada.
 * Remove redundant cache. Pull request #1482 by Eileen M. Uchitelle.
@@ -2068,7 +2084,7 @@ This release was sponsored by Ruby Central.
 * Fixed activating gems from a Gemfile for default gems.  Issue #991 by khoan.
 * Fixed windows stub script generation for Cygwin.  Issue #1000 by Brett
   DiFrischia.
-* Allow gem bindir and ruby.exe to live in separate diretories.  Pull request
+* Allow gem bindir and ruby.exe to live in separate directories.  Pull request
   #942 by Ian Flynn.
 * Fixed handling of gemspec in gem dependencies files to match Bundler
   behavior.  Issue #1020 by Michal Papis.
@@ -2162,7 +2178,7 @@ This release was sponsored by Ruby Central.
 * Gem.use_gemdeps now accepts an argument specifying the path of the gem
   dependencies file.  When the file is not found an ArgumentError is raised.
 * Writing a .lock file for a gem dependencies file is now controlled by the
-  --[no-]lock option.  Pull reuqest #774 by Jeremy Evans.
+  --[no-]lock option.  Pull request #774 by Jeremy Evans.
 * Suggestion of alternate names and spelling corrections during install can be
   suppressed with the --no-suggestions option.  Issue #867 by Jimmy Cuadra.
 * Added mswin64 support.  Pull request #881 by U. Nakamura.
@@ -2261,7 +2277,7 @@ This release was sponsored by Ruby Central.
 * Check for nil extensions as BasicSpecification does not initialize them.
   Pull request #882 by André Arko.
 * Fixed Gem::BasicSpecification#require_paths receives a String for
-  @require_paths. Pull requrest #904 by @danielpclark
+  @require_paths. Pull request #904 by @danielpclark
 * Fixed circular require warnings.  Bug #908 by Zachary Scott.
 * Gem::Specification#require_paths can no longer accidentally be an Array.
   Pull requests #904, #909 by Daniel P. Clark.
@@ -3697,7 +3713,7 @@ build arguments.
   * Fixed `gem contents` to work with the lightweight specifications
   * Fixed `gem update --system x.y.z` where x.y.z == latest version. (MGPalmer)
   * Fixed gem contents sorting and tests. (MGPalmer)
-  * Fixed intermittant problem in `gem fetch` with --platform specified (quix)
+  * Fixed intermittent problem in `gem fetch` with --platform specified (quix)
   * Fixed lightweight specifications so `gem rdoc` will generate proper
     documentation
   * MockGemUI#terminate_interaction should not raise Gem::SystemExitException.
@@ -4378,7 +4394,7 @@ For a full list of changes to RubyGems, see the ChangeLog file.
   installation
 * Multi-version diamond dependencies only are installed once
 * Processing a YAML bulk index update takes less memory
-* `gem install -i` makes sure all depenencies are installed
+* `gem install -i` makes sure all dependencies are installed
 * `gem update --system` reinstalls into the prefix it was originally installed
   in
 * `gem update --system` respects --no-rdoc and --no-ri flags
@@ -4418,7 +4434,7 @@ Special thanks to:
 
 If you are experiencing problems with the source index (e.g. strange
 "No Method" errors), or problems with zlib (e.g. "Buffer Error"
-messsage), we recommend upgrading to RubyGems 0.9.4.
+message), we recommend upgrading to RubyGems 0.9.4.
 
 ## Bug fixes:
 

data/CONTRIBUTING.md

@@ -114,7 +114,7 @@ listed in rough  progression order from submitted to closed.
 *   **ready** - An issue that is available for collaboration. This issue
     should have existing discussion on the problem, and a description of how
     to go about solving it.
-*   **working** - An issue that has a specific invidual assigned to and
+*   **working** - An issue that has a specific individual assigned to and
     planning to do work on it.
 *   **user feedback required** - The issue/pull request is blocked pending
     more feedback from an end user
@@ -132,7 +132,7 @@ closed reason labels are maroon `closed: *`.
 
 *   **duplicate** - This is a duplicate of an existing bug. The comments must
     reference the existing issue.
-*   **abandonded** - This is an issue/pull request that has aged off, is no
+*   **abandoned** - This is an issue/pull request that has aged off, is no
     longer applicable or similar.
 *   **declined** - An issue that won't be fixed/implemented or a pull request
     that is not accepted.

data/Rakefile

@@ -7,12 +7,12 @@ require 'psych'
 
 desc "Setup Rubygems dev environment"
 task :setup do
-  sh "ruby", "bundler/spec/support/bundle.rb", "install", "--gemfile=dev_gems.rb"
+  sh "ruby", "-I", "lib", "bundler/spec/support/bundle.rb", "install", "--gemfile=dev_gems.rb"
 end
 
 desc "Update Rubygems dev environment"
 task :update do |_, args|
-  sh "ruby", "bundler/spec/support/bundle.rb", "update", *args, "--gemfile=dev_gems.rb"
+  sh "ruby", "-I", "lib", "bundler/spec/support/bundle.rb", "update", *args, "--gemfile=dev_gems.rb"
 end
 
 desc "Update the locked bundler version in dev environment"

data/bundler/CHANGELOG.md

@@ -1,10 +1,34 @@
+# 2.2.17 (May 5, 2021)
+
+## Enhancements:
+
+  - Improve authentication required error message to include an alternative using `ENV` [#4565](https://github.com/rubygems/rubygems/pull/4565)
+  - Discard partial range responses without etag [#4563](https://github.com/rubygems/rubygems/pull/4563)
+  - Fix configuring ENV for a gem server with a name including dashes [#4571](https://github.com/rubygems/rubygems/pull/4571)
+  - Redact credentials from `bundle env` and `bundle config` [#4566](https://github.com/rubygems/rubygems/pull/4566)
+  - Redact all sources in verbose mode [#4564](https://github.com/rubygems/rubygems/pull/4564)
+  - Improve `bundle pristine` error if `BUNDLE_GEMFILE` does not exist [#4536](https://github.com/rubygems/rubygems/pull/4536)
+  - [CurrentRuby] Add 3.0 as a known minor [#4535](https://github.com/rubygems/rubygems/pull/4535)
+  - Prefer File.read instead of IO.read [#4530](https://github.com/rubygems/rubygems/pull/4530)
+  - Add space after open curly bracket in Gemfile and gems.rb template [#4518](https://github.com/rubygems/rubygems/pull/4518)
+
+## Bug fixes:
+
+  - Make sure specs are fetched from the right source when materializing [#4562](https://github.com/rubygems/rubygems/pull/4562)
+  - Fix `bundle cache` with an up-to-date lockfile and specs not already installed [#4554](https://github.com/rubygems/rubygems/pull/4554)
+  - Ignore `deployment` setting in inline mode [#4523](https://github.com/rubygems/rubygems/pull/4523)
+
+## Performance:
+
+  - Don't materialize resolutions when not necessary [#4556](https://github.com/rubygems/rubygems/pull/4556)
+
 # 2.2.16 (April 8, 2021)
 
 ## Enhancements:
 
   - Add `--github-username` option and config to `bundle gem` [#3687](https://github.com/rubygems/rubygems/pull/3687)
   - Bump vendored `tmpdir` library copy [#4506](https://github.com/rubygems/rubygems/pull/4506)
-  - Add `rake build:checksum` task to build cheksums for a gem package [#4156](https://github.com/rubygems/rubygems/pull/4156)
+  - Add `rake build:checksum` task to build checksums for a gem package [#4156](https://github.com/rubygems/rubygems/pull/4156)
   - Enable bundler-cache for GitHub Actions template [#4498](https://github.com/rubygems/rubygems/pull/4498)
   - Improve `bundle info` error when gem is on a "disabled" group [#4492](https://github.com/rubygems/rubygems/pull/4492)
   - Small tweak to yank message [#4494](https://github.com/rubygems/rubygems/pull/4494)
@@ -472,7 +496,7 @@
   - Ignore `frozen` setting in inline mode ([#7125](https://github.com/rubygems/bundler/pull/7125))
   - Fix incorrect "bundler attempted to update GEM but version stayed the same" message when updating git sourced gems ([#6325](https://github.com/rubygems/bundler/pull/6325))
   - Don't check for existence of a writable home directory if `BUNDLE_USER_HOME` is set ([#6885](https://github.com/rubygems/bundler/pull/6885))
-  - Fix error message when server would respond to a bad username/password requiest with a 401 ([#6928](https://github.com/rubygems/bundler/pull/6928))
+  - Fix error message when server would respond to a bad username/password request with a 401 ([#6928](https://github.com/rubygems/bundler/pull/6928))
   - Fix `bundle outdated` pluralization when multiple groups are requested ([#7063](https://github.com/rubygems/bundler/pull/7063))
   - Fix `bundle install` not updating conservatively when gemspec is changed ([#7143](https://github.com/rubygems/bundler/pull/7143))
   - Fix `bundle exec` not respecting custom process titles inside scripts ([#7140](https://github.com/rubygems/bundler/pull/7140))
@@ -2117,7 +2141,7 @@ Changes
   - fix Bundler.which for directories ([#2697](https://github.com/rubygems/bundler/issues/2697), @rhysd)
   - properly require `Capistrano::Version` ([#2690](https://github.com/rubygems/bundler/issues/2690), @steveklabnik)
   - search for git.exe and git
-  - fix the bug that downloads every spec when API fetcher encouters an error
+  - fix the bug that downloads every spec when API fetcher encounters an error
   - only retry network requests
 
 # 1.4.0.rc.1 (September 29, 2013)
@@ -2741,7 +2765,7 @@ Changes
 
   - Implement `to_ary` to avoid calls to method_missing (@tenderlove, [#1274](https://github.com/rubygems/bundler/issues/1274))
   - bundle clean removes old .gem files (@cldwalker, [#1293](https://github.com/rubygems/bundler/issues/1293))
-  - Correcly identify missing child dependency in error message
+  - Correctly identify missing child dependency in error message
   - Run pre-install, post-build, and post-install gem hooks for git gems (@warhammerkid, [#1120](https://github.com/rubygems/bundler/issues/1120))
   - create Gemfile.lock for empty Gemfile ([#1218](https://github.com/rubygems/bundler/issues/1218))
 
@@ -2892,7 +2916,7 @@ Changes
 
   - Performance fix for MRI 1.9 (@efficientcloud, [#1288](https://github.com/rubygems/bundler/issues/1288))
   - Shortcuts (like `bundle i`) for all commands (@amatsuda)
-  - Correcly identify missing child dependency in error message
+  - Correctly identify missing child dependency in error message
 
 ## Bug fixes:
 
@@ -3128,7 +3152,7 @@ Changes
 
   - Various bugfixes to the built-in rake helpers
   - Fix a bug where shortrefs weren't unique enough and were
-    therfore colliding
+    therefore colliding
   - Fix a small bug involving checking whether a local git
     clone is up to date
   - Correctly handle explicit '=' dependencies with gems

data/bundler/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2021-04-09".freeze
-    @git_commit_sha = "3d7bfaff25".freeze
+    @built_at = "2021-05-05".freeze
+    @git_commit_sha = "69cbd6e10e".freeze
     @release = true
     # end ivars
 

data/bundler/lib/bundler/cli.rb

@@ -504,8 +504,8 @@ module Bundler
       By default, setting a configuration value sets it for all projects
       on the machine.
 
-      If a global setting is superceded by local configuration, this command
-      will show the current value, as well as any superceded values and
+      If a global setting is superseded by local configuration, this command
+      will show the current value, as well as any superseded values and
       where they were specified.
     D
     require_relative "cli/config"

data/bundler/lib/bundler/cli/common.rb

@@ -94,6 +94,8 @@ module Bundler
     end
 
     def self.ensure_all_gems_in_lockfile!(names, locked_gems = Bundler.locked_gems)
+      return unless locked_gems
+
       locked_names = locked_gems.specs.map(&:name).uniq
       names.-(locked_names).each do |g|
         raise GemNotFound, gem_not_found_message(g, locked_names)

data/bundler/lib/bundler/compact_index_client/updater.rb

@@ -50,16 +50,20 @@ module Bundler
 
           content = response.body
 
-          SharedHelpers.filesystem_access(local_temp_path) do
+          etag = (response["ETag"] || "").gsub(%r{\AW/}, "")
+          correct_response = SharedHelpers.filesystem_access(local_temp_path) do
             if response.is_a?(Net::HTTPPartialContent) && local_temp_path.size.nonzero?
               local_temp_path.open("a") {|f| f << slice_body(content, 1..-1) }
+
+              etag_for(local_temp_path) == etag
             else
               local_temp_path.open("wb") {|f| f << content }
+
+              etag.length.zero? || etag_for(local_temp_path) == etag
             end
           end
 
-          etag = (response["ETag"] || "").gsub(%r{\AW/}, "")
-          if etag.length.zero? || etag_for(local_temp_path) == etag
+          if correct_response
             SharedHelpers.filesystem_access(local_path) do
               FileUtils.mv(local_temp_path, local_path)
             end
@@ -92,11 +96,11 @@ module Bundler
 
       def checksum_for_file(path)
         return nil unless path.file?
-        # This must use IO.read instead of Digest.file().hexdigest
+        # This must use File.read instead of Digest.file().hexdigest
         # because we need to preserve \n line endings on windows when calculating
         # the checksum
         SharedHelpers.filesystem_access(path, :read) do
-          SharedHelpers.digest(:MD5).hexdigest(IO.read(path))
+          SharedHelpers.digest(:MD5).hexdigest(File.read(path))
         end
       end
     end

data/bundler/lib/bundler/current_ruby.rb

@@ -20,6 +20,7 @@ module Bundler
       2.5
       2.6
       2.7
+      3.0
     ].freeze
 
     KNOWN_MAJOR_VERSIONS = KNOWN_MINOR_VERSIONS.map {|v| v.split(".", 2).first }.uniq.freeze

data/bundler/lib/bundler/definition.rb

@@ -161,16 +161,14 @@ module Bundler
     end
 
     def resolve_with_cache!
-      raise "Specs already loaded" if @specs
       sources.cached!
-      specs
+      resolve
     end
 
     def resolve_remotely!
-      return if @specs
       @remote = true
       sources.remote!
-      specs
+      resolve
     end
 
     # For given dependency list returns a SpecSet with Gemspec of all the required

data/bundler/lib/bundler/fetcher.rb

@@ -47,7 +47,8 @@ module Bundler
         remote_uri = filter_uri(remote_uri)
         super "Authentication is required for #{remote_uri}.\n" \
           "Please supply credentials for this source. You can do this by running:\n" \
-          " bundle config set --global #{remote_uri} username:password"
+          "`bundle config set --global #{remote_uri} username:password`\n" \
+          "or by storing the credentials in the `#{Settings.key_for(remote_uri)}` environment variable"
       end
     end
     # This error is raised if HTTP authentication is provided, but incorrect.

data/bundler/lib/bundler/fetcher/downloader.rb

@@ -14,8 +14,10 @@ module Bundler
       def fetch(uri, headers = {}, counter = 0)
         raise HTTPError, "Too many redirects" if counter >= redirect_limit
 
+        filtered_uri = URICredentialsFilter.credential_filtered_uri(uri)
+
         response = request(uri, headers)
-        Bundler.ui.debug("HTTP #{response.code} #{response.message} #{uri}")
+        Bundler.ui.debug("HTTP #{response.code} #{response.message} #{filtered_uri}")
 
         case response
         when Net::HTTPSuccess, Net::HTTPNotModified
@@ -40,7 +42,7 @@ module Bundler
           raise BadAuthenticationError, uri.host if uri.userinfo
           raise AuthenticationRequiredError, uri.host
         when Net::HTTPNotFound
-          raise FallbackError, "Net::HTTPNotFound: #{URICredentialsFilter.credential_filtered_uri(uri)}"
+          raise FallbackError, "Net::HTTPNotFound: #{filtered_uri}"
         else
           raise HTTPError, "#{response.class}#{": #{response.body}" unless response.body.empty?}"
         end
@@ -49,7 +51,9 @@ module Bundler
       def request(uri, headers)
         validate_uri_scheme!(uri)
 
-        Bundler.ui.debug "HTTP GET #{uri}"
+        filtered_uri = URICredentialsFilter.credential_filtered_uri(uri)
+
+        Bundler.ui.debug "HTTP GET #{filtered_uri}"
         req = Net::HTTP::Get.new uri.request_uri, headers
         if uri.user
           user = CGI.unescape(uri.user)
@@ -69,7 +73,7 @@ module Bundler
           raise NetworkDownError, "Could not reach host #{uri.host}. Check your network " \
             "connection and try again."
         else
-          raise HTTPError, "Network error while fetching #{URICredentialsFilter.credential_filtered_uri(uri)}" \
+          raise HTTPError, "Network error while fetching #{filtered_uri}" \
             " (#{e})"
         end
       end

data/bundler/lib/bundler/injector.rb

@@ -128,7 +128,7 @@ module Bundler
     # evaluates a gemfile to remove the specified gem
     # from it.
     def remove_deps(gemfile_path)
-      initial_gemfile = IO.readlines(gemfile_path)
+      initial_gemfile = File.readlines(gemfile_path)
 
       Bundler.ui.info "Removing gems from #{gemfile_path}"
 
@@ -181,7 +181,7 @@ module Bundler
       patterns = /gem\s+(['"])#{Regexp.union(gems)}\1|gem\s*\((['"])#{Regexp.union(gems)}\2\)/
       new_gemfile = []
       multiline_removal = false
-      IO.readlines(gemfile_path).each do |line|
+      File.readlines(gemfile_path).each do |line|
         match_data = line.match(patterns)
         if match_data && is_not_within_comment?(line, match_data)
           multiline_removal = line.rstrip.end_with?(",")

data/bundler/lib/bundler/inline.rb

@@ -52,7 +52,7 @@ def gemfile(install = false, options = {}, &gemfile)
     builder.instance_eval(&gemfile)
     builder.check_primary_source_safety
 
-    Bundler.settings.temporary(:frozen => false) do
+    Bundler.settings.temporary(:deployment => false, :frozen => false) do
       definition = builder.to_definition(nil, true)
       def definition.lock(*); end
       definition.validate_runtime!

data/bundler/lib/bundler/man/bundle-config.1

@@ -199,7 +199,7 @@ The following is a list of all configuration keys and their purpose\. You can le
 \fBfrozen\fR (\fBBUNDLE_FROZEN\fR): Disallow changes to the \fBGemfile\fR\. When the \fBGemfile\fR is changed and the lockfile has not been updated, running Bundler commands will be blocked\. Defaults to \fBtrue\fR when \fB\-\-deployment\fR is used\.
 .
 .IP "\(bu" 4
-\fBgem\.github_username\fR (\fBBUNDLE_GEM__GITHUB_USERNAME\fR): Sets a GitHub username or organization to be used in \fBREADME\fR file when you create a new gem via \fBbundle gem\fR command\. It can be overriden by passing an explicit \fB\-\-github\-username\fR flag to \fBbundle gem\fR\.
+\fBgem\.github_username\fR (\fBBUNDLE_GEM__GITHUB_USERNAME\fR): Sets a GitHub username or organization to be used in \fBREADME\fR file when you create a new gem via \fBbundle gem\fR command\. It can be overridden by passing an explicit \fB\-\-github\-username\fR flag to \fBbundle gem\fR\.
 .
 .IP "\(bu" 4
 \fBgem\.push_key\fR (\fBBUNDLE_GEM__PUSH_KEY\fR): Sets the \fB\-\-key\fR parameter for \fBgem push\fR when using the \fBrake release\fR command with a private gemstash server\.
@@ -470,6 +470,23 @@ export BUNDLE_GITHUB__COM=abcd0123generatedtoken:x\-oauth\-basic
 .
 .IP "" 0
 .
+.P
+Note that any configured credentials will be redacted by informative commands such as \fBbundle config list\fR or \fBbundle config get\fR, unless you use the \fB\-\-parseable\fR flag\. This is to avoid unintentially leaking credentials when copy\-pasting bundler output\.
+.
+.P
+Also note that to guarantee a sane mapping between valid environment variable names and valid host names, bundler makes the following transformations:
+.
+.IP "\(bu" 4
+Any \fB\-\fR characters in a host name are mapped to a triple dash (\fB___\fR) in the corresponding enviroment variable\.
+.
+.IP "\(bu" 4
+Any \fB\.\fR characters in a host name are mapped to a double dash (\fB__\fR) in the corresponding environment variable\.
+.
+.IP "" 0
+.
+.P
+This means that if you have a gem server named \fBmy\.gem\-host\.com\fR, you\'ll need to use the \fBBUNDLE_MY__GEM___HOST__COM\fR variable to configure credentials for it through ENV\.
+.
 .SH "CONFIGURE BUNDLER DIRECTORIES"
 Bundler\'s home, config, cache and plugin directories are able to be configured through environment variables\. The default location for Bundler\'s home directory is \fB~/\.bundle\fR, which all directories inherit from by default\. The following outlines the available environment variables and their default values
 .

data/bundler/lib/bundler/man/bundle-config.1.ronn

@@ -196,7 +196,7 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
    Defaults to `true` when `--deployment` is used.
 * `gem.github_username` (`BUNDLE_GEM__GITHUB_USERNAME`):
    Sets a GitHub username or organization to be used in `README` file when you
-   create a new gem via `bundle gem` command. It can be overriden by passing an
+   create a new gem via `bundle gem` command. It can be overridden by passing an
    explicit `--github-username` flag to `bundle gem`.
 * `gem.push_key` (`BUNDLE_GEM__PUSH_KEY`):
    Sets the `--key` parameter for `gem push` when using the `rake release`
@@ -376,6 +376,23 @@ where you can use personal OAuth tokens:
 
     export BUNDLE_GITHUB__COM=abcd0123generatedtoken:x-oauth-basic
 
+Note that any configured credentials will be redacted by informative commands
+such as `bundle config list` or `bundle config get`, unless you use the
+`--parseable` flag. This is to avoid unintentially leaking credentials when
+copy-pasting bundler output.
+
+Also note that to guarantee a sane mapping between valid environment variable
+names and valid host names, bundler makes the following transformations:
+
+* Any `-` characters in a host name are mapped to a triple dash (`___`) in the
+  corresponding enviroment variable.
+
+* Any `.` characters in a host name are mapped to a double dash (`__`) in the
+  corresponding environment variable.
+
+This means that if you have a gem server named `my.gem-host.com`, you'll need to
+use the `BUNDLE_MY__GEM___HOST__COM` variable to configure credentials for it
+through ENV.
 
 ## CONFIGURE BUNDLER DIRECTORIES
 

data/bundler/lib/bundler/plugin.rb

@@ -164,7 +164,7 @@ module Bundler
     end
 
     # To be called from Cli class to pass the command and argument to
-    # approriate plugin class
+    # appropriate plugin class
     def exec_command(command, args)
       raise UndefinedCommandError, "Command `#{command}` not found" unless command? command
 
@@ -183,7 +183,7 @@ module Bundler
       !index.source_plugin(name.to_s).nil?
     end
 
-    # @return [Class] that handles the source. The calss includes API::Source
+    # @return [Class] that handles the source. The class includes API::Source
     def source(name)
       raise UnknownSourceError, "Source #{name} not found" unless source? name
 

data/bundler/lib/bundler/retry.rb

@@ -49,7 +49,7 @@ module Bundler
         raise e
       end
       return true unless name
-      Bundler.ui.info "" unless Bundler.ui.debug? # Add new line incase dots preceded this
+      Bundler.ui.info "" unless Bundler.ui.debug? # Add new line in case dots preceded this
       Bundler.ui.warn "Retrying #{name} due to error (#{current_run.next}/#{total_runs}): #{e.class} #{e.message}", Bundler.ui.debug?
     end
 

data/bundler/lib/bundler/settings.rb

@@ -13,6 +13,7 @@ module Bundler
       auto_install
       cache_all
       cache_all_platforms
+      clean
       default_install_uses_path
       deployment
       deployment_means_frozen
@@ -26,11 +27,14 @@ module Bundler
       force_ruby_platform
       forget_cli_options
       frozen
+      gem.changelog
       gem.coc
       gem.mit
+      git.allow_insecure
       global_gem_cache
       ignore_messages
       init_gems_rb
+      inline
       no_install
       no_prune
       path_relative_to_cwd
@@ -60,6 +64,22 @@ module Bundler
       without
     ].freeze
 
+    STRING_KEYS = %w[
+      bin
+      cache_path
+      console
+      gem.ci
+      gem.github_username
+      gem.linter
+      gem.rubocop
+      gem.test
+      gemfile
+      path
+      shebang
+      system_bindir
+      trust-policy
+    ].freeze
+
     DEFAULT_CONFIG = {
       "BUNDLE_SILENCE_DEPRECATIONS" => false,
       "BUNDLE_DISABLE_VERSION_CHECK" => true,
@@ -125,8 +145,8 @@ module Bundler
       keys = @temporary.keys | @global_config.keys | @local_config.keys | @env_config.keys
 
       keys.map do |key|
-        key.sub(/^BUNDLE_/, "").gsub(/__/, ".").downcase
-      end
+        key.sub(/^BUNDLE_/, "").gsub(/___/, "-").gsub(/__/, ".").downcase
+      end.sort
     end
 
     def local_overrides
@@ -172,19 +192,19 @@ module Bundler
       locations = []
 
       if value = @temporary[key]
-        locations << "Set for the current command: #{converted_value(value, exposed_key).inspect}"
+        locations << "Set for the current command: #{printable_value(value, exposed_key).inspect}"
       end
 
       if value = @local_config[key]
-        locations << "Set for your local app (#{local_config_file}): #{converted_value(value, exposed_key).inspect}"
+        locations << "Set for your local app (#{local_config_file}): #{printable_value(value, exposed_key).inspect}"
       end
 
       if value = @env_config[key]
-        locations << "Set via #{key}: #{converted_value(value, exposed_key).inspect}"
+        locations << "Set via #{key}: #{printable_value(value, exposed_key).inspect}"
       end
 
       if value = @global_config[key]
-        locations << "Set for the current user (#{global_config_file}): #{converted_value(value, exposed_key).inspect}"
+        locations << "Set for the current user (#{global_config_file}): #{printable_value(value, exposed_key).inspect}"
       end
 
       return ["You have not configured a value for `#{exposed_key}`"] if locations.empty?
@@ -276,9 +296,7 @@ module Bundler
     end
 
     def key_for(key)
-      key = Settings.normalize_uri(key).to_s if key.is_a?(String) && /https?:/ =~ key
-      key = key.to_s.gsub(".", "__").upcase
-      "BUNDLE_#{key}"
+      self.class.key_for(key)
     end
 
     private
@@ -313,6 +331,10 @@ module Bundler
       BOOL_KEYS.include?(name.to_s) || BOOL_KEYS.include?(parent_setting_for(name.to_s))
     end
 
+    def is_string(name)
+      STRING_KEYS.include?(name.to_s) || name.to_s.start_with?("local.") || name.to_s.start_with?("mirror.") || name.to_s.start_with?("build.")
+    end
+
     def to_bool(value)
       case value
       when nil, /\A(false|f|no|n|0|)\z/i, false
@@ -330,6 +352,14 @@ module Bundler
       ARRAY_KEYS.include?(key.to_s)
     end
 
+    def is_credential(key)
+      key == "gem.push_key"
+    end
+
+    def is_userinfo(value)
+      value.include?(":")
+    end
+
     def to_array(value)
       return [] unless value
       value.split(":").map(&:to_sym)
@@ -376,6 +406,21 @@ module Bundler
       end
     end
 
+    def printable_value(value, key)
+      converted = converted_value(value, key)
+      return converted unless converted.is_a?(String)
+
+      if is_string(key)
+        converted
+      elsif is_credential(key)
+        "[REDACTED]"
+      elsif is_userinfo(converted)
+        converted.gsub(/:.*$/, ":[REDACTED]")
+      else
+        converted
+      end
+    end
+
     def global_config_file
       if ENV["BUNDLE_CONFIG"] && !ENV["BUNDLE_CONFIG"].empty?
         Pathname.new(ENV["BUNDLE_CONFIG"])
@@ -415,6 +460,12 @@ module Bundler
         \z
       /ix.freeze
 
+    def self.key_for(key)
+      key = normalize_uri(key).to_s if key.is_a?(String) && /https?:/ =~ key
+      key = key.to_s.gsub(".", "__").gsub("-", "___").upcase
+      "BUNDLE_#{key}"
+    end
+
     # TODO: duplicates Rubygems#normalize_uri
     # TODO: is this the correct place to validate mirror URIs?
     def self.normalize_uri(uri)

data/bundler/lib/bundler/source/rubygems.rb

@@ -423,11 +423,11 @@ module Bundler
       def fetch_names(fetchers, dependency_names, index, override_dupes)
         fetchers.each do |f|
           if dependency_names
-            Bundler.ui.info "Fetching gem metadata from #{f.uri}", Bundler.ui.debug?
+            Bundler.ui.info "Fetching gem metadata from #{URICredentialsFilter.credential_filtered_uri(f.uri)}", Bundler.ui.debug?
             index.use f.specs_with_retry(dependency_names, self), override_dupes
             Bundler.ui.info "" unless Bundler.ui.debug? # new line now that the dots are over
           else
-            Bundler.ui.info "Fetching source index from #{f.uri}"
+            Bundler.ui.info "Fetching source index from #{URICredentialsFilter.credential_filtered_uri(f.uri)}"
             index.use f.specs_with_retry(nil, self), override_dupes
           end
         end

data/bundler/lib/bundler/spec_set.rb

@@ -78,11 +78,17 @@ module Bundler
 
     def materialize(deps, missing_specs = nil)
       materialized = self.for(deps, [], false, true, !missing_specs).to_a
-      deps = materialized.map(&:name).uniq
+
+      materialized.group_by(&:source).each do |source, specs|
+        next unless specs.any?{|s| s.is_a?(LazySpecification) }
+
+        source.local!
+        names = -> { specs.map(&:name).uniq }
+        source.double_check_for(names)
+      end
+
       materialized.map! do |s|
         next s unless s.is_a?(LazySpecification)
-        s.source.dependency_names = deps if s.source.respond_to?(:dependency_names=)
-        s.source.local!
         spec = s.__materialize__
         unless spec
           unless missing_specs
@@ -99,12 +105,17 @@ module Bundler
     # This is in contrast to how for does platform filtering (and specifically different from how `materialize` calls `for` only for the current platform)
     # @return [Array<Gem::Specification>]
     def materialized_for_all_platforms
-      names = @specs.map(&:name).uniq
+      @specs.group_by(&:source).each do |source, specs|
+        next unless specs.any?{|s| s.is_a?(LazySpecification) }
+
+        source.local!
+        source.remote!
+        names = -> { specs.map(&:name).uniq }
+        source.double_check_for(names)
+      end
+
       @specs.map do |s|
         next s unless s.is_a?(LazySpecification)
-        s.source.dependency_names = names if s.source.respond_to?(:dependency_names=)
-        s.source.local!
-        s.source.remote!
         spec = s.__materialize__
         raise GemNotFound, "Could not find #{s.full_name} in any of the sources" unless spec
         spec

data/bundler/lib/bundler/templates/Gemfile

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
+git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
 # gem "rails"

data/bundler/lib/bundler/templates/gems.rb

@@ -3,6 +3,6 @@
 # A sample gems.rb
 source "https://rubygems.org"
 
-git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
+git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
 # gem "rails"

data/bundler/lib/bundler/vendor/molinillo/lib/molinillo/modules/specification_provider.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Bundler::Molinillo
-  # Provides information about specifcations and dependencies to the resolver,
+  # Provides information about specifications and dependencies to the resolver,
   # allowing the {Resolver} class to remain generic while still providing power
   # and flexibility.
   #

data/bundler/lib/bundler/vendor/thor/lib/thor/actions/file_manipulation.rb

@@ -252,7 +252,7 @@ class Bundler::Thor
     # flag<Regexp|String>:: the regexp or string to be replaced
     # replacement<String>:: the replacement, can be also given as a block
     # config<Hash>:: give :verbose => false to not log the status, and
-    #                :force => true, to force the replacement regardles of runner behavior.
+    #                :force => true, to force the replacement regardless of runner behavior.
     #
     # ==== Example
     #

data/bundler/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "2.2.16".freeze
+  VERSION = "2.2.17".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= VERSION.split(".").first.to_i

data/lib/rubygems.rb

@@ -8,7 +8,7 @@
 require 'rbconfig'
 
 module Gem
-  VERSION = "3.2.16".freeze
+  VERSION = "3.2.17".freeze
 end
 
 # Must be first since it unloads the prelude from 1.9.2
@@ -626,7 +626,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
       # Try requiring the gem version *or* stdlib version of psych.
       require 'psych'
     rescue ::LoadError
-      # If we can't load psych, thats fine, go on.
+      # If we can't load psych, that's fine, go on.
     else
       # If 'yaml' has already been required, then we have to
       # be sure to switch it over to the newly loaded psych.
@@ -813,7 +813,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
   ##
   # Safely write a file in binary mode on all platforms.
   def self.write_binary(path, data)
-    open(path, 'wb') do |io|
+    File.open(path, 'wb') do |io|
       begin
         io.flock(File::LOCK_EX)
       rescue *WRITE_BINARY_ERRORS
@@ -824,7 +824,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
     if Thread.main != Thread.current
       raise
     else
-      open(path, 'wb') do |io|
+      File.open(path, 'wb') do |io|
         io.write data
       end
     end

data/lib/rubygems/commands/install_command.rb

@@ -127,7 +127,7 @@ You can use `i` command instead of `install`.
   end
 
   def usage # :nodoc:
-    "#{program_name} GEMNAME [GEMNAME ...] [options] -- --build-flags"
+    "#{program_name} [options] GEMNAME [GEMNAME ...] -- --build-flags"
   end
 
   def check_install_dir # :nodoc:

data/lib/rubygems/commands/open_command.rb

@@ -36,7 +36,7 @@ class Gem::Commands::OpenCommand < Gem::Command
   end
 
   def usage # :nodoc:
-    "#{program_name} GEMNAME [-e COMMAND]"
+    "#{program_name} [-e COMMAND] GEMNAME"
   end
 
   def get_env_editor

data/lib/rubygems/commands/yank_command.rb

@@ -24,7 +24,7 @@ data you will need to change them immediately and yank your gem.
   end
 
   def usage # :nodoc:
-    "#{program_name} GEM -v VERSION [-p PLATFORM] [--key KEY_NAME] [--host HOST]"
+    "#{program_name} -v VERSION [-p PLATFORM] [--key KEY_NAME] [--host HOST] GEM"
   end
 
   def initialize

data/lib/rubygems/defaults.rb

@@ -198,7 +198,7 @@ module Gem
 
   def self.default_bindir
     if defined? RUBY_FRAMEWORK_VERSION # mac framework support
-      '/usr/bin'
+      '/usr/local/bin'
     else # generic install
       RbConfig::CONFIG['bindir']
     end

data/lib/rubygems/deprecate.rb

@@ -60,12 +60,13 @@ module Gem::Deprecate
         target = klass ? "#{self}." : "#{self.class}#"
         msg = [ "NOTE: #{target}#{name} is deprecated",
                 repl == :none ? " with no replacement" : "; use #{repl} instead",
-                ". It will be removed on or after %4d-%02d-01." % [year, month],
+                ". It will be removed on or after %4d-%02d." % [year, month],
                 "\n#{target}#{name} called from #{Gem.location_of_caller.join(":")}",
         ]
         warn "#{msg.join}." unless Gem::Deprecate.skip
         send old, *args, &block
       end
+      ruby2_keywords name if respond_to?(:ruby2_keywords, true)
     end
   end
 
@@ -90,6 +91,7 @@ module Gem::Deprecate
         warn "#{msg.join}." unless Gem::Deprecate.skip
         send old, *args, &block
       end
+      ruby2_keywords name if respond_to?(:ruby2_keywords, true)
     end
   end
 

data/lib/rubygems/indexer.rb

@@ -136,7 +136,7 @@ class Gem::Indexer
     say "Generating #{name} index"
 
     Gem.time "Generated #{name} index" do
-      open(file, 'wb') do |io|
+      File.open(file, 'wb') do |io|
         specs = index.map do |*spec|
           # We have to splat here because latest_specs is an array, while the
           # others are hashes.

data/lib/rubygems/resolver/molinillo/lib/molinillo/modules/specification_provider.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Gem::Resolver::Molinillo
-  # Provides information about specifcations and dependencies to the resolver,
+  # Provides information about specifications and dependencies to the resolver,
   # allowing the {Resolver} class to remain generic while still providing power
   # and flexibility.
   #

data/lib/rubygems/test_utilities.rb

@@ -76,7 +76,7 @@ class Gem::FakeFetcher
 
   def cache_update_path(uri, path = nil, update = true)
     if data = fetch_path(uri)
-      open(path, 'wb') {|io| io.write data } if path and update
+      File.open(path, 'wb') {|io| io.write data } if path and update
       data
     else
       Gem.read_binary(path) if path

data/rubygems-update.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |s|
   s.name = "rubygems-update"
-  s.version = "3.2.16"
+  s.version = "3.2.17"
   s.authors = ["Jim Weirich", "Chad Fowler", "Eric Hodel", "Luis Lavena", "Aaron Patterson", "Samuel Giddins", "André Arko", "Evan Phoenix", "Hiroshi SHIBATA"]
   s.email = ["", "", "drbrain@segment7.net", "luislavena@gmail.com", "aaron@tenderlovemaking.com", "segiddins@segiddins.me", "andre@arko.net", "evan@phx.io", "hsbt@ruby-lang.org"]
 

data/test/rubygems/test_deprecate.rb

@@ -49,6 +49,22 @@ class TestDeprecate < Gem::TestCase
       @message = "bar"
     end
     rubygems_deprecate :foo, :bar
+
+    def foo_arg(msg)
+      @message = "foo" + msg
+    end
+    def bar_arg(msg)
+      @message = "bar" + msg
+    end
+    rubygems_deprecate :foo_arg, :bar_arg
+
+    def foo_kwarg(message:)
+      @message = "foo" + message
+    end
+    def bar_kwarg(message:)
+      @message = "bar" + message
+    end
+    rubygems_deprecate :foo_kwarg, :bar_kwarg
   end
 
   class OtherThing
@@ -61,6 +77,22 @@ class TestDeprecate < Gem::TestCase
       @message = "bar"
     end
     deprecate :foo, :bar, 2099, 3
+
+    def foo_arg(msg)
+      @message = "foo" + msg
+    end
+    def bar_arg(msg)
+      @message = "bar" + msg
+    end
+    deprecate :foo_arg, :bar_arg, 2099, 3
+
+    def foo_kwarg(message:)
+      @message = "foo" + message
+    end
+    def bar_kwarg(message:)
+      @message = "bar" + message
+    end
+    deprecate :foo_kwarg, :bar_kwarg, 2099, 3
   end
 
   def test_deprecated_method_calls_the_old_method
@@ -68,6 +100,10 @@ class TestDeprecate < Gem::TestCase
       thing = Thing.new
       thing.foo
       assert_equal "foo", thing.message
+      thing.foo_arg("msg")
+      assert_equal "foomsg", thing.message
+      thing.foo_kwarg(message: "msg")
+      assert_equal "foomsg", thing.message
     end
   end
 
@@ -75,10 +111,14 @@ class TestDeprecate < Gem::TestCase
     out, err = capture_io do
       thing = Thing.new
       thing.foo
+      thing.foo_arg("msg")
+      thing.foo_kwarg(message: "msg")
     end
 
     assert_equal "", out
     assert_match(/Thing#foo is deprecated; use bar instead\./, err)
+    assert_match(/Thing#foo_arg is deprecated; use bar_arg instead\./, err)
+    assert_match(/Thing#foo_kwarg is deprecated; use bar_kwarg instead\./, err)
     assert_match(/in Rubygems [0-9]+/, err)
   end
 
@@ -104,10 +144,14 @@ class TestDeprecate < Gem::TestCase
     out, err = capture_io do
       thing = OtherThing.new
       thing.foo
+      thing.foo_arg("msg")
+      thing.foo_kwarg(message: "msg")
     end
 
     assert_equal "", out
-    assert_match(/Thing#foo is deprecated; use bar instead\./, err)
-    assert_match(/on or after 2099-03-01/, err)
+    assert_match(/OtherThing#foo is deprecated; use bar instead\./, err)
+    assert_match(/OtherThing#foo_arg is deprecated; use bar_arg instead\./, err)
+    assert_match(/OtherThing#foo_kwarg is deprecated; use bar_kwarg instead\./, err)
+    assert_match(/on or after 2099-03/, err)
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubygems-update
 version: !ruby/object:Gem::Version
-  version: 3.2.16
+  version: 3.2.17
 platform: ruby
 authors:
 - Jim Weirich
@@ -16,7 +16,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-09 00:00:00.000000000 Z
+date: 2021-05-05 00:00:00.000000000 Z
 dependencies: []
 description: |-
   A package (also known as a library) contains a set of functionality
@@ -769,7 +769,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.16
+rubygems_version: 3.2.17
 signing_key: 
 specification_version: 4
 summary: RubyGems is a package management framework for Ruby.