rubygems-update 4.0.19 → 4.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fea8148baa9550b989b52e1b5a5bdd0331ce3f3658acd4e6a8655b4aca669d05
-  data.tar.gz: d6873bcf37f0e87a7c35663e446b5a907a833d469270fce61e06e5c384b26b64
+  metadata.gz: 1c5b9e451752787719ea243e41b423937313b296fe80fcdb9e2278c47bce0311
+  data.tar.gz: 40407c5dda968a596b10a34cfe59e6884ed03a2224c43934aaf1b2dc86c7d0f3
 SHA512:
-  metadata.gz: 959ce199999beef457228f6ca8ef0d74f6cd19cb433fe5fdf21ec42961df13b81b98209a21bb2c6c298521b201cf2f64161be7efd5a3ac92d155a6c0c17876d0
-  data.tar.gz: eb602763996a439e8f8598b14c08ead139b527a814e11c9acdae89c4c1556ede07fed87cdde079509b124510f5f3844e394ef74e69e3a532c1900b271d684b14
+  metadata.gz: a98a6944def23e28a4f45a8be9d1d7fa36b488cf1add3e542ffae3ca9ace3adfde5499ddd36a0e1a15ad0baf363ab05509d4bcfd7d714d4209c6fcba1dc2a6b2
+  data.tar.gz: 5f399d26a853785b4ead62f67c12f84f7225af52cb700fb39fd50e8895e481d91c667b51d9b2c8df925f3c46477044d9704039c86a67bcdaeaff80c529f97f64

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 4.0.20 / 2026-09-02
+
+### Enhancements:
+
+* Print a release notes link instead of the whole changelog on `gem update --system`. Pull request [#9794](https://github.com/ruby/rubygems/pull/9794) by hsbt
+* Installs bundler 4.0.20 as a default gem.
+
+### Bug fixes:
+
+* Only coerce exact true and false gemrc values to booleans. Pull request [#9822](https://github.com/ruby/rubygems/pull/9822) by hsbt
+* Make the gem CLI work under RUBY_BOX=1. Pull request [#9810](https://github.com/ruby/rubygems/pull/9810) by hsbt
+
+### Documentation:
+
+* Document and test all available gemrc configuration keys. Pull request [#9568](https://github.com/ruby/rubygems/pull/9568) by junaruga
+
 ## 4.0.19 / 2026-08-20
 
 ### Enhancements:

data/bundler/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 4.0.20 / 2026-09-02
+
+### Enhancements:
+
+* Avoid duplicate relative path prefix in bundle exec. Pull request [#9596](https://github.com/ruby/rubygems/pull/9596) by samuel-williams-shopify
+* Follow renamed default branch in git sources. Pull request [#9813](https://github.com/ruby/rubygems/pull/9813) by hsbt
+* Bundler::Source::Git: avoid re-fetching the repo. Pull request [#9806](https://github.com/ruby/rubygems/pull/9806) by byroot
+* Show the newest out-of-cooldown version in bundle outdated. Pull request [#9803](https://github.com/ruby/rubygems/pull/9803) by hsbt
+
+### Bug fixes:
+
+* Error out when `bundle init --gemspec` gets no specification. Pull request [#9818](https://github.com/ruby/rubygems/pull/9818) by hsbt
+* Fix relative gemspec paths being expanded twice. Pull request [#9814](https://github.com/ruby/rubygems/pull/9814) by hsbt
+* Fix gemspec evaluation under Ruby::Box. Pull request [#9809](https://github.com/ruby/rubygems/pull/9809) by hsbt
+* Fix release date extraction for the current changelog header format. Pull request [#9767](https://github.com/ruby/rubygems/pull/9767) by meganemura
+* Resolve globbed entries literally in Gem::Util.glob_files_in_dir. Pull request [#9802](https://github.com/ruby/rubygems/pull/9802) by hsbt
+* Preserve native extensions during implicit clean. Pull request [#9800](https://github.com/ruby/rubygems/pull/9800) by sjh9714
+
+### Documentation:
+
+* Clarify :path expectations and cross-link platform docs in man pages. Pull request [#9724](https://github.com/ruby/rubygems/pull/9724) by hsbt
+
 ## 4.0.19 / 2026-08-20
 
 ### Enhancements:

data/bundler/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = nil
-    @git_commit_sha = "2d0e3df43a".freeze
+    @built_at = "2026-09-02".freeze
+    @git_commit_sha = "7f2502dc32b".freeze
     # end ivars
 
     # A hash representation of the build metadata.

data/bundler/lib/bundler/cli/doctor/diagnose.rb

@@ -53,7 +53,7 @@ module Bundler
     end
 
     def bundles_for_gem(spec)
-      Dir.glob("#{spec.full_gem_path}/**/*.bundle")
+      SharedHelpers.glob_files_in_dir("**/*.bundle", spec.full_gem_path)
     end
 
     def lookup_with_fiddle(path)

data/bundler/lib/bundler/cli/exec.rb

@@ -23,7 +23,7 @@ module Bundler
           bin_path.delete_suffix!(".bat") if Gem.win_platform?
           kernel_load(bin_path, *args)
         else
-          bin_path = "./" + bin_path unless File.absolute_path?(bin_path)
+          bin_path = explicit_path(bin_path)
           kernel_exec(bin_path, *args)
         end
       else
@@ -71,6 +71,20 @@ module Bundler
       "#{file} #{args.join(" ")}".strip
     end
 
+    def explicit_path(path)
+      if File.absolute_path?(path) || explicit_relative_path?(path)
+        path
+      else
+        ".#{File::SEPARATOR}#{path}"
+      end
+    end
+
+    def explicit_relative_path?(path)
+      [File::SEPARATOR, File::ALT_SEPARATOR].compact.any? do |separator|
+        path.start_with?(".#{separator}", "..#{separator}")
+      end
+    end
+
     def directly_loadable?(file)
       if Gem.win_platform?
         script_wrapper?(file)

data/bundler/lib/bundler/cli/init.rb

@@ -26,6 +26,10 @@ module Bundler
         end
 
         spec = Bundler.load_gemspec_uncached(gemspec)
+        unless spec
+          Bundler.ui.error "Gem specification #{gemspec} did not produce a specification"
+          exit 1
+        end
 
         File.open(gemfile, "wb") do |file|
           file << "# Generated from #{gemspec}\n"

data/bundler/lib/bundler/cli/outdated.rb

@@ -158,11 +158,29 @@ module Bundler
 
       return active_spec if strict
 
-      active_specs = active_spec.source.specs.search(current_spec.name).select {|spec| spec.installable_on_platform?(current_spec.platform) }.sort_by(&:version)
-      if !current_spec.version.prerelease? && !options[:pre] && active_specs.size > 1
-        active_specs.delete_if {|b| b.respond_to?(:version) && b.version.prerelease? }
+      matching_specs(active_spec, current_spec).last
+    end
+
+    def matching_specs(active_spec, current_spec)
+      @matching_specs ||= {}
+      @matching_specs[[active_spec.source, current_spec.name, current_spec.platform]] ||= begin
+        active_specs = active_spec.source.specs.search(current_spec.name).select {|spec| spec.installable_on_platform?(current_spec.platform) }.sort_by(&:version)
+        if !current_spec.version.prerelease? && !options[:pre] && active_specs.size > 1
+          active_specs.delete_if {|b| b.respond_to?(:version) && b.version.prerelease? }
+        end
+        active_specs
       end
-      active_specs.last
+    end
+
+    # The newest version the cooldown setting would let bundler adopt right
+    # now, when the newest overall version is still inside the window. Only a
+    # version strictly between the installed one and the newest one is an
+    # adoptable update worth showing.
+    def newest_out_of_cooldown(active_spec, current_spec)
+      newest = matching_specs(active_spec, current_spec).reverse_each.find {|spec| cooldown_days_remaining(spec).nil? }
+      return unless newest
+      return if newest.version >= active_spec.version || newest.version <= current_spec.version
+      newest
     end
 
     def print_gems(gems_list)
@@ -208,7 +226,11 @@ module Bundler
       spec_outdated_info += ", released #{release_date}" unless release_date.empty?
 
       remaining = cooldown_days_remaining(active_spec)
-      spec_outdated_info += ", in cooldown for #{remaining} more day#{"s" if remaining > 1}" if remaining
+      if remaining
+        spec_outdated_info += ", in cooldown for #{remaining} more day#{"s" if remaining > 1}"
+        adoptable = newest_out_of_cooldown(active_spec, current_spec)
+        spec_outdated_info += ", newest out of cooldown #{adoptable.version}" if adoptable
+      end
 
       spec_outdated_info += ")"
 
@@ -227,7 +249,11 @@ module Bundler
       current_version = "#{current_spec.version}#{current_spec.git_version}"
       spec_version = "#{active_spec.version}#{active_spec.git_version}"
       remaining = cooldown_days_remaining(active_spec)
-      spec_version += " (cooldown #{remaining}d)" if remaining
+      if remaining
+        adoptable = newest_out_of_cooldown(active_spec, current_spec)
+        adoptable_note = adoptable ? ", #{adoptable.version} out of cooldown" : ""
+        spec_version += " (cooldown #{remaining}d#{adoptable_note})"
+      end
       dependency = dependency.requirement if dependency
 
       ret_val = [active_spec.name, current_version, spec_version, dependency.to_s, groups.to_s]
@@ -236,7 +262,7 @@ module Bundler
       ret_val
     end
 
-    def cooldown_days_remaining(spec, now = Time.now)
+    def cooldown_days_remaining(spec, now = cooldown_now)
       return nil unless spec.respond_to?(:created_at) && spec.created_at
       return nil unless spec.respond_to?(:remote) && spec.remote
       days = spec.remote.effective_cooldown
@@ -245,6 +271,10 @@ module Bundler
       remaining > 0 ? remaining.ceil : nil
     end
 
+    def cooldown_now
+      @cooldown_now ||= Time.now
+    end
+
     def check_for_deployment_mode!
       return unless Bundler.frozen_bundle?
       suggested_command = if Bundler.settings.locations("frozen").keys.&([:global, :local]).any?

data/bundler/lib/bundler/dsl.rb

@@ -68,7 +68,7 @@ module Bundler
       development_group = opts[:development_group] || :development
       expanded_path     = gemfile_root.join(path)
 
-      gemspecs = Gem::Util.glob_files_in_dir("{,*}.gemspec", expanded_path).filter_map {|g| Bundler.load_gemspec(g) }
+      gemspecs = SharedHelpers.glob_files_in_dir("{,*}.gemspec", expanded_path).filter_map {|g| Bundler.load_gemspec(g) }
       gemspecs.reject! {|s| s.name != name } if name
       specs_by_name_and_version = gemspecs.group_by {|s| [s.name, s.version] }
 

data/bundler/lib/bundler/gem_helper.rb

@@ -32,7 +32,7 @@ module Bundler
 
     def initialize(base = nil, name = nil)
       @base = File.expand_path(base || SharedHelpers.pwd)
-      gemspecs = name ? [File.join(@base, "#{name}.gemspec")] : Gem::Util.glob_files_in_dir("{,*}.gemspec", @base)
+      gemspecs = name ? [File.join(@base, "#{name}.gemspec")] : SharedHelpers.glob_files_in_dir("{,*}.gemspec", @base)
       raise "Unable to determine name from existing gemspec. Use :name => 'gemname' in #install_tasks to manually set it." unless gemspecs.size == 1
       @spec_path = gemspecs.first
       @gemspec = Bundler.load_gemspec(@spec_path)
@@ -124,7 +124,7 @@ module Bundler
     end
 
     def built_gem_path
-      Gem::Util.glob_files_in_dir("#{name}-*.gem", base).sort_by {|f| File.mtime(f) }.last
+      SharedHelpers.glob_files_in_dir("#{name}-*.gem", base).sort_by {|f| File.mtime(f) }.last
     end
 
     def git_push(remote = nil)

data/bundler/lib/bundler/man/bundle-outdated.1

@@ -55,7 +55,7 @@ Only list patch newer versions\.
 Only list gems specified in your Gemfile, not their dependencies\.
 .TP
 \fB\-\-cooldown=<number>\fR
-Annotate (rather than hide) versions that are still inside the cooldown window of \fInumber\fR days\. The prose output appends "in cooldown for Nd more days" and the table form adds "(cooldown Nd)" to the Latest column\. See \fBcooldown\fR in bundle\-config(1)\.
+Annotate (rather than hide) versions that are still inside the cooldown window of \fInumber\fR days\. The prose output appends "in cooldown for Nd more days" and the table form adds "(cooldown Nd)" to the Latest column\. When a version outside the window is newer than the installed one, the prose output also appends "newest out of cooldown X" and the table form becomes "(cooldown Nd, X out of cooldown)"\. With \fB\-\-filter\-strict\fR (or \fB\-\-patch\fR, \fB\-\-minor\fR, \fB\-\-major\fR, which imply it), "newest" is already the cooldown\-filtered resolved version, so none of these annotations appear\. See \fBcooldown\fR in bundle\-config(1)\.
 .SH "PATCH LEVEL OPTIONS"
 See bundle update(1) \fIbundle\-update\.1\.html\fR for details\.
 .SH "FILTERING OUTPUT"

data/bundler/lib/bundler/man/bundle-outdated.1.ronn

@@ -76,7 +76,13 @@ are up to date, Bundler will exit with a status of 0. Otherwise, it will exit 1.
   Annotate (rather than hide) versions that are still inside the
   cooldown window of <number> days. The prose output appends "in
   cooldown for Nd more days" and the table form adds "(cooldown Nd)" to
-  the Latest column. See `cooldown` in bundle-config(1).
+  the Latest column. When a version outside the window is newer than the
+  installed one, the prose output also appends "newest out of cooldown
+  X" and the table form becomes "(cooldown Nd, X out of cooldown)".
+  With `--filter-strict` (or `--patch`, `--minor`, `--major`, which
+  imply it), "newest" is already the cooldown-filtered resolved version,
+  so none of these annotations appear. See `cooldown` in
+  bundle-config(1).
 
 ## PATCH LEVEL OPTIONS
 

data/bundler/lib/bundler/man/bundle-platform.1

@@ -38,6 +38,8 @@ Your current platform satisfies the Ruby version requirement\.
 .IP "" 0
 .P
 \fBplatform\fR lists all the platforms in your \fBGemfile\.lock\fR as well as the \fBruby\fR directive if applicable from your Gemfile(5)\. It also lets you know if the \fBruby\fR directive requirement has been met\. If \fBruby\fR directive doesn't match the running Ruby VM, it tells you what part does not\.
+.P
+For a detailed explanation of how bundler handles platforms, see the \fBPLATFORMS\fR section in Gemfile(5)\.
 .SH "OPTIONS"
 .TP
 \fB\-\-ruby\fR
@@ -45,5 +47,7 @@ It will display the ruby directive information, so you don't have to parse it fr
 .SH "SEE ALSO"
 .IP "\(bu" 4
 bundle\-lock(1) \fIbundle\-lock\.1\.html\fR
+.IP "\(bu" 4
+Gemfile(5) \fIgemfile\.5\.html\fR
 .IP "" 0
 

data/bundler/lib/bundler/man/bundle-platform.1.ronn

@@ -38,6 +38,9 @@ If you run `bundle platform` on Ruby 3.1.2, it displays the following output:
 if the `ruby` directive requirement has been met. If `ruby` directive doesn't
 match the running Ruby VM, it tells you what part does not.
 
+For a detailed explanation of how bundler handles platforms, see the
+`PLATFORMS` section in Gemfile(5).
+
 ## OPTIONS
 
 * `--ruby`:
@@ -47,3 +50,4 @@ match the running Ruby VM, it tells you what part does not.
 ## SEE ALSO
 
 * [bundle-lock(1)](bundle-lock.1.html)
+* [Gemfile(5)](gemfile.5.html)

data/bundler/lib/bundler/man/gemfile.5

@@ -392,7 +392,7 @@ gem "rails", git: "https://rails@bitbucket\.org/rails/rails\.git"
 .P
 Since the \fBbitbucket\fR method is a specialization of \fBgit_source\fR, it accepts a \fB:branch\fR named argument\.
 .SS "PATH"
-You can specify that a gem is located in a particular location on the file system\. Relative paths are resolved relative to the directory containing the \fBGemfile\fR\.
+You can specify that a gem is located in a particular location on the file system\. Relative paths are resolved relative to the directory containing the \fBGemfile\fR\. The path must point to a directory containing the gem's unpacked source code, not to a packaged \fB\.gem\fR file\.
 .P
 Similar to the semantics of the \fB:git\fR option, the \fB:path\fR option requires that the directory in question either contains a \fB\.gemspec\fR for the gem, or that you specify an explicit version that bundler should use\.
 .P

data/bundler/lib/bundler/man/gemfile.5.ronn

@@ -451,7 +451,9 @@ Since the `bitbucket` method is a specialization of `git_source`, it accepts a `
 
 You can specify that a gem is located in a particular location
 on the file system. Relative paths are resolved relative to the
-directory containing the `Gemfile`.
+directory containing the `Gemfile`. The path must point to a
+directory containing the gem's unpacked source code, not to a
+packaged `.gem` file.
 
 Similar to the semantics of the `:git` option, the `:path`
 option requires that the directory in question either contains

data/bundler/lib/bundler/runtime.rb

@@ -141,7 +141,7 @@ module Bundler
         end
       end
 
-      Gem::Util.glob_files_in_dir("*/.git", cache_path.to_s).each do |git_dir|
+      SharedHelpers.glob_files_in_dir("*/.git", cache_path.to_s).each do |git_dir|
         FileUtils.rm_rf(git_dir)
         FileUtils.touch(File.expand_path("../.bundlecache", git_dir))
       end
@@ -159,13 +159,13 @@ module Bundler
     end
 
     def clean(dry_run = false)
-      gem_bins             = Gem::Util.glob_files_in_dir("bin/*", Gem.dir)
-      git_dirs             = Gem::Util.glob_files_in_dir("bundler/gems/*", Gem.dir)
-      git_cache_dirs       = Gem::Util.glob_files_in_dir("cache/bundler/git/*", Gem.dir)
-      gem_dirs             = Gem::Util.glob_files_in_dir("gems/*", Gem.dir)
-      gem_files            = Gem::Util.glob_files_in_dir("cache/*.gem", Gem.dir)
-      gemspec_files        = Gem::Util.glob_files_in_dir("specifications/*.gemspec", Gem.dir)
-      extension_dirs       = Gem::Util.glob_files_in_dir("extensions/*/*/*", Gem.dir) + Gem::Util.glob_files_in_dir("bundler/gems/extensions/*/*/*", Gem.dir)
+      gem_bins             = SharedHelpers.glob_files_in_dir("bin/*", Gem.dir)
+      git_dirs             = SharedHelpers.glob_files_in_dir("bundler/gems/*", Gem.dir)
+      git_cache_dirs       = SharedHelpers.glob_files_in_dir("cache/bundler/git/*", Gem.dir)
+      gem_dirs             = SharedHelpers.glob_files_in_dir("gems/*", Gem.dir)
+      gem_files            = SharedHelpers.glob_files_in_dir("cache/*.gem", Gem.dir)
+      gemspec_files        = SharedHelpers.glob_files_in_dir("specifications/*.gemspec", Gem.dir)
+      extension_dirs       = SharedHelpers.glob_files_in_dir("extensions/*/*/*", Gem.dir) + SharedHelpers.glob_files_in_dir("bundler/gems/extensions/*/*/*", Gem.dir)
       spec_gem_paths       = []
       # need to keep git sources around
       spec_git_paths       = @definition.spec_git_paths
@@ -232,7 +232,7 @@ module Bundler
     private
 
     def prune_gem_cache(resolve, cache_path)
-      cached = Gem::Util.glob_files_in_dir("*.gem", cache_path.to_s)
+      cached = SharedHelpers.glob_files_in_dir("*.gem", cache_path.to_s)
 
       cached = cached.delete_if do |path|
         spec = Bundler.rubygems.spec_from_gem path
@@ -257,7 +257,7 @@ module Bundler
     end
 
     def prune_git_and_path_cache(resolve, cache_path)
-      cached = Gem::Util.glob_files_in_dir("*/.bundlecache", cache_path.to_s)
+      cached = SharedHelpers.glob_files_in_dir("*/.bundlecache", cache_path.to_s)
 
       cached = cached.delete_if do |path|
         name = File.basename(File.dirname(path))
@@ -283,7 +283,7 @@ module Bundler
       # Add man/ subdirectories from activated bundles to MANPATH for man(1)
       manuals = $LOAD_PATH.filter_map do |path|
         man_subdir = path.sub(/lib$/, "man")
-        man_subdir unless Dir.glob("man?/", base: man_subdir).empty?
+        man_subdir unless SharedHelpers.glob_files_in_dir("man?/", man_subdir).empty?
       end
 
       return if manuals.empty?

data/bundler/lib/bundler/shared_helpers.rb

@@ -231,6 +231,21 @@ module Bundler
       destination
     end
 
+    # Globs for entries matching +glob+ inside of +base_path+, returning
+    # absolute paths. Glob metacharacters in +base_path+ are not treated as
+    # part of the pattern, and matched entries are joined literally, so an
+    # entry starting with `~` is not expanded into the home directory.
+    #
+    # Bundler runs against whatever RubyGems the host provides, so this cannot
+    # delegate to Gem::Util.glob_files_in_dir, which only gained the literal
+    # join in RubyGems 4.1.
+    def glob_files_in_dir(glob, base_path)
+      expanded_path = nil
+      Dir.glob(glob, base: base_path).map! do |f|
+        File.join(expanded_path ||= File.expand_path(base_path), f)
+      end
+    end
+
     private
 
     def validate_bundle_path

data/bundler/lib/bundler/source/git/git_proxy.rb

@@ -193,7 +193,13 @@ module Bundler
             return out if status.success?
 
             if err.include?("couldn't find remote ref") || err.include?("not our ref")
-              raise MissingGitRevisionError.new(command_with_no_credentials, path, commit || explicit_ref, credential_filtered_uri)
+              default_branch = renamed_remote_default_branch if tracking_remote_default_branch?
+              if default_branch
+                out = follow_remote_default_branch(args, default_branch)
+                return out if out
+              end
+
+              raise MissingGitRevisionError.new(command_with_no_credentials, path, commit || explicit_ref || current_branch, credential_filtered_uri)
             else
               if shallow?
                 args -= depth_args
@@ -298,6 +304,61 @@ module Bundler
           branch_option || ref.nil?
         end
 
+        def tracking_remote_default_branch?
+          explicit_ref.nil? && commit.nil?
+        end
+
+        # Returns nil on any failure, leaving HEAD untouched so the caller reports
+        # the original fetch failure. Runs inside the retry block, so it must not
+        # touch the caller's command locals.
+        def follow_remote_default_branch(args, default_branch)
+          reference = "refs/heads/#{default_branch}"
+          command = fetch_command(args, "#{reference}:#{reference}")
+          check_allowed(command)
+
+          out, err, status = capture(command, path)
+          unless status.success?
+            Bundler.ui.debug "Could not fetch #{reference} from #{credential_filtered_uri}: #{err}"
+            return
+          end
+
+          previous_branch = current_branch
+          begin
+            git "symbolic-ref", "HEAD", reference, dir: path
+          rescue GitError => e
+            Bundler.ui.debug "Could not repoint the cached clone at #{reference}: #{e.message}"
+            return
+          end
+          @current_branch = nil
+          Bundler.ui.warn "#{credential_filtered_uri} no longer has #{previous_branch}, " \
+            "now following its default branch #{default_branch}"
+          out
+        end
+
+        # The cached clone's HEAD branch is gone from the remote, so the remote's
+        # own idea of its default branch is the only thing left to follow.
+        def renamed_remote_default_branch
+          default_branch = remote_default_branch
+          return if default_branch.nil? || default_branch == current_branch
+
+          default_branch
+        end
+
+        def remote_default_branch
+          command = ["ls-remote", "--symref", "--", configured_uri, "HEAD"]
+          check_allowed(command)
+
+          out, err, status = capture(command, path)
+          unless status.success?
+            Bundler.ui.debug "Could not ask #{credential_filtered_uri} for its default branch: #{err}"
+            return
+          end
+
+          # A remote is free to advertise a ref name that is not valid UTF-8, and
+          # matching that as text raises out of the GitError family.
+          out.b[%r{^ref:\s+refs/heads/(.+?)\s+HEAD}, 1]
+        end
+
         def pinned_to_full_sha?
           full_sha_revision?(ref)
         end
@@ -465,8 +526,8 @@ module Bundler
           args
         end
 
-        def fetch_command(args)
-          ["fetch", "--force", "--quiet", "--no-tags", *args, "--", configured_uri, refspec].compact
+        def fetch_command(args, spec = refspec)
+          ["fetch", "--force", "--quiet", "--no-tags", *args, "--", configured_uri, spec].compact
         end
 
         def clone_command(args)

data/bundler/lib/bundler/source/git.rb

@@ -91,9 +91,9 @@ module Bundler
 
       def to_s
         begin
-          at = humanized_ref || current_branch
-
-          rev = "at #{at}@#{shortref_for_display(revision)}"
+          at = humanized_ref
+          at = "#{at}@" if at
+          rev = "at #{at}#{shortref_for_display(revision)}"
         rescue GitError
           ""
         end
@@ -320,7 +320,7 @@ module Bundler
 
       def serialize_gemspecs_in(destination)
         destination = destination.expand_path(Bundler.root) if destination.relative?
-        Gem::Util.glob_files_in_dir(@glob, destination.to_s).each do |spec_path|
+        SharedHelpers.glob_files_in_dir(@glob, destination.to_s).each do |spec_path|
           # Evaluate gemspecs and cache the result. Gemspecs
           # in git might require git or other dependencies.
           # The gemspecs we cache should already be evaluated.

data/bundler/lib/bundler/source/path.rb

@@ -161,7 +161,7 @@ module Bundler
 
         if File.directory?(expanded_path)
           # We sort depth-first since `<<` will override the earlier-found specs
-          Gem::Util.glob_files_in_dir(@glob, expanded_path).sort_by {|p| -p.split(File::SEPARATOR).size }.each do |file|
+          SharedHelpers.glob_files_in_dir(@glob, expanded_path).sort_by {|p| -p.split(File::SEPARATOR).size }.each do |file|
             next unless spec = load_gemspec(file)
             spec.source = self
 

data/bundler/lib/bundler/source/rubygems.rb

@@ -406,7 +406,7 @@ module Bundler
         @cached_specs ||= begin
           idx = Index.new
 
-          Gem::Util.glob_files_in_dir("*.gem", cache_path.to_s).each do |gemfile|
+          SharedHelpers.glob_files_in_dir("*.gem", cache_path.to_s).each do |gemfile|
             s ||= Bundler.rubygems.spec_from_gem(gemfile)
             s.source = self
             idx << s

data/bundler/lib/bundler/stub_specification.rb

@@ -126,7 +126,9 @@ module Bundler
     def _remote_specification
       @_remote_specification ||= begin
         rs = stub.to_spec
-        if rs.equal?(self) # happens when to_spec gets the spec from Gem.loaded_specs
+        # Gem::StubSpecification#to_spec may return an activated specification
+        # with the same name and version from a different gem installation.
+        if rs.equal?(self) || rs.loaded_from != loaded_from
           rs = Gem::Specification.load(loaded_from)
           Bundler.rubygems.stub_set_spec(stub, rs)
         end

data/bundler/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.19".freeze
+  VERSION = "4.0.20".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

data/bundler/lib/bundler.rb

@@ -527,11 +527,11 @@ module Bundler
     end
 
     def load_gemspec_uncached(file, validate = false)
-      path = Pathname.new(file)
-      contents = read_file(file)
+      path = Pathname.new(file).expand_path
+      contents = read_file(path.to_s)
       spec = eval_gemspec(path, contents)
       return unless spec
-      spec.loaded_from = path.expand_path.to_s
+      spec.loaded_from = path.to_s
       Bundler.rubygems.validate(spec) if validate
       spec
     end
@@ -646,9 +646,19 @@ module Bundler
         eval_yaml_gemspec(path, contents)
       else
         # Eval the gemspec from its parent directory, because some gemspecs
-        # depend on "./" relative paths.
+        # depend on "./" relative paths. The caller expands `path` first, since
+        # expanding it here would resolve against the gemspec directory once
+        # the chdir is active.
         SharedHelpers.chdir(path.dirname.to_s) do
-          eval(contents, TOPLEVEL_BINDING.dup, path.expand_path.to_s)
+          # TOPLEVEL_BINDING always belongs to the main box, so inside a
+          # Ruby::Box use a binding from the box Bundler is loaded in, where
+          # Gem::Specification carries Bundler's own monkey patches.
+          eval_binding = if defined?(Ruby::Box) && Ruby::Box.enabled?
+            Ruby::Box.current.eval("binding")
+          else
+            TOPLEVEL_BINDING.dup
+          end
+          eval(contents, eval_binding, path.to_s)
         end
       end
     rescue ScriptError, StandardError => e

data/lib/rubygems/command.rb

@@ -440,7 +440,7 @@ class Gem::Command
   def handle_options(args)
     args = add_extra_args(args)
     check_deprecated_options(args)
-    @options = Marshal.load Marshal.dump @defaults # deep copy
+    @options = Gem::Util.deep_dup @defaults
     parser.parse!(args)
     @options[:args] = args
   end

data/lib/rubygems/commands/contents_command.rb

@@ -91,13 +91,21 @@ prefix or only the files that are requireable.
   end
 
   def files_in_gem(spec)
-    gem_path  = spec.full_gem_path
-    extra     = "/{#{spec.require_paths.join ","}}" if options[:lib_only]
-    glob      = "#{gem_path}#{extra}/**/*"
-    prefix_re = %r{#{Regexp.escape(gem_path)}/}
+    gem_path = spec.full_gem_path
 
-    Dir[glob].map do |file|
-      [gem_path, file.sub(prefix_re, "")]
+    if options[:lib_only]
+      # raw_require_paths rather than require_paths, since the latter prepends
+      # the absolute extension_dir, which would escape the glob base
+      require_paths = spec.raw_require_paths
+      return [] if require_paths.empty?
+
+      glob = "{#{require_paths.join ","}}/**/*"
+    else
+      glob = "**/*"
+    end
+
+    Dir.glob(glob, base: gem_path).map do |file|
+      [gem_path, file]
     end
   end
 

data/lib/rubygems/commands/exec_command.rb

@@ -79,7 +79,7 @@ to the same gem path as user-installed gems.
   def handle_options(args)
     args = add_extra_args(args)
     check_deprecated_options(args)
-    @options = Marshal.load Marshal.dump @defaults # deep copy
+    @options = Gem::Util.deep_dup @defaults
     parser.order!(args) do |v|
       # put the non-option back at the front of the list of arguments
       args.unshift(v)

data/lib/rubygems/commands/setup_command.rb

@@ -7,9 +7,6 @@ require_relative "../command"
 # RubyGems checkout or tarball.
 
 class Gem::Commands::SetupCommand < Gem::Command
-  HISTORY_HEADER = %r{^##\s*[\d.a-zA-Z]+\s*/\s*\d{4}-\d{2}-\d{2}\s*$}
-  VERSION_MATCHER = %r{^##\s*([\d.a-zA-Z]+)\s*/\s*\d{4}-\d{2}-\d{2}\s*$}
-
   ENV_PATHS = %w[/usr/bin/env /bin/env].freeze
 
   def initialize
@@ -23,7 +20,7 @@ class Gem::Commands::SetupCommand < Gem::Command
 
     add_option "--previous-version=VERSION",
                "Previous version of RubyGems",
-               "Used for changelog processing" do |version, options|
+               "Used for the release notes link" do |version, options|
       options[:previous_version] = version
     end
 
@@ -183,12 +180,6 @@ By default, this RubyGems will install gem as:
       say
     end
 
-    if options[:previous_version].empty?
-      options[:previous_version] = Gem::VERSION.sub(/[0-9]+$/, "0")
-    end
-
-    options[:previous_version] = Gem::Version.new(options[:previous_version])
-
     show_release_notes
 
     say
@@ -319,7 +310,7 @@ By default, this RubyGems will install gem as:
        (!File.exist?(rubygems_doc_dir) ||
         File.writable?(rubygems_doc_dir))
       say "Removing old RubyGems RDoc and ri" if @verbose
-      Dir[File.join(Gem.dir, "doc", "rubygems-[0-9]*")].each do |dir|
+      Gem::Util.glob_files_in_dir("rubygems-[0-9]*", gem_doc_dir).each do |dir|
         rm_rf dir
       end
 
@@ -552,34 +543,16 @@ abort "#{deprecation_message}"
   end
 
   def show_release_notes
-    release_notes = File.join Dir.pwd, "CHANGELOG.md"
-
-    release_notes =
-      if File.exist? release_notes
-        history = File.read release_notes
-
-        history.force_encoding Encoding::UTF_8
-
-        text = history.split(HISTORY_HEADER)
-        text.shift # correct an off-by-one generated by split
-        version_lines = history.scan(HISTORY_HEADER)
-        versions = history.scan(VERSION_MATCHER).flatten.map do |x|
-          Gem::Version.new(x)
-        end
+    ref = Gem::VERSION.include?(".dev") ? "master" : "v#{Gem::VERSION}"
+    link = "https://github.com/ruby/rubygems/blob/#{ref}/CHANGELOG.md"
 
-        history_string = ""
-
-        until versions.length == 0 ||
-              versions.shift <= options[:previous_version] do
-          history_string += version_lines.shift + text.shift
-        end
-
-        history_string
-      else
-        "Oh-no! Unable to find release notes!"
-      end
-
-    say release_notes
+    previous = options[:previous_version].to_s.strip
+    if previous.empty? || !Gem::Version.correct?(previous) ||
+       Gem::Version.new(previous) >= Gem::Version.new(Gem::VERSION)
+      say "See #{link} for the changes."
+    else
+      say "See #{link} for the changes since #{previous}."
+    end
   end
 
   def uninstall_old_gemcutter

data/lib/rubygems/commands/stale_command.rb

@@ -25,7 +25,7 @@ longer using.
     gem_to_atime = {}
     Gem::Specification.each do |spec|
       name = spec.full_name
-      Dir["#{spec.full_gem_path}/**/*.*"].each do |file|
+      Gem::Util.glob_files_in_dir("**/*.*", spec.full_gem_path).each do |file|
         next if File.directory?(file)
         stat = File.stat(file)
         gem_to_atime[name] ||= stat.atime

data/lib/rubygems/config_file.rb

@@ -26,9 +26,20 @@ require "rbconfig"
 # RubyGems options use symbol keys.  Valid options are:
 #
 # +:backtrace+:: See #backtrace
-# +:sources+:: Sets Gem::sources
+# +:bulk_threshold+:: See #bulk_threshold
 # +:verbose+:: See #verbose
+# +:update_sources+:: See #update_sources
 # +:concurrent_downloads+:: See #concurrent_downloads
+# +:cert_expiration_length_days+:: See #cert_expiration_length_days
+# +:install_extension_in_lib+:: See #install_extension_in_lib
+# +:ipv4_fallback_enabled+:: See #ipv4_fallback_enabled
+# +:gemhome+:: See #home
+# +:gempath+:: See #path
+# +:sources+:: Sets Gem::sources
+# +:disable_default_gem_server+:: See #disable_default_gem_server
+# +:ssl_verify_mode+:: See #ssl_verify_mode
+# +:ssl_ca_cert+:: See #ssl_ca_cert
+# +:ssl_client_cert+:: See #ssl_client_cert
 #
 # gemrc files may exist in various locations and are read and merged in
 # the following order:
@@ -193,8 +204,8 @@ class Gem::ConfigFile
     @install_extension_in_lib = DEFAULT_INSTALL_EXTENSION_IN_LIB
     @ipv4_fallback_enabled = ENV["IPV4_FALLBACK_ENABLED"] == "true" || DEFAULT_IPV4_FALLBACK_ENABLED
 
-    operating_system_config = Marshal.load Marshal.dump(OPERATING_SYSTEM_DEFAULTS)
-    platform_config = Marshal.load Marshal.dump(PLATFORM_DEFAULTS)
+    operating_system_config = Gem::Util.deep_dup(OPERATING_SYSTEM_DEFAULTS)
+    platform_config = Gem::Util.deep_dup(PLATFORM_DEFAULTS)
     system_config = load_file SYSTEM_WIDE_CONFIG_FILE
     user_config = load_file config_file_name
 
@@ -562,13 +573,13 @@ if you believe they were disclosed to a third party.
 
   def self.deep_transform_config_keys!(config)
     config.transform_keys! do |k|
-      if k.match?(/\A:(.*)\Z/)
+      if k.match?(/\A:(.*)\z/)
         k[1..-1].to_sym
-      elsif k.include?("__") || k.match?(%r{/\Z})
+      elsif k.include?("__") || k.end_with?("/")
         if k.is_a?(Symbol)
-          k.to_s.gsub(/__/,".").gsub(%r{/\Z}, "").to_sym
+          k.to_s.gsub(/__/,".").delete_suffix("/").to_sym
         else
-          k.dup.gsub(/__/,".").gsub(%r{/\Z}, "")
+          k.dup.gsub(/__/,".").delete_suffix("/")
         end
       else
         k
@@ -577,11 +588,11 @@ if you believe they were disclosed to a third party.
 
     config.transform_values! do |v|
       if v.is_a?(String)
-        if v.match?(/\A:(.*)\Z/)
+        if v.match?(/\A:(.*)\z/)
           v[1..-1].to_sym
-        elsif v.match?(/\A[+-]?\d+\Z/)
+        elsif v.match?(/\A[+-]?\d+\z/)
           v.to_i
-        elsif v.match?(/\Atrue|false\Z/)
+        elsif v.match?(/\A(?:true|false)\z/)
           v == "true"
         elsif v.empty?
           nil

data/lib/rubygems/ext/builder.rb

@@ -101,7 +101,9 @@ class Gem::Ext::Builder
 
       require "open3"
       # Set $SOURCE_DATE_EPOCH for the subprocess.
-      build_env = { "SOURCE_DATE_EPOCH" => Gem.source_date_epoch_string }.merge(env)
+      # Under Ruby::Box mkmf makes RbConfig.expand recurse until SystemStackError.
+      # Drop $RUBY_BOX last so no caller can restore it.
+      build_env = { "SOURCE_DATE_EPOCH" => Gem.source_date_epoch_string }.merge(env).merge("RUBY_BOX" => nil)
       # A single-element command would be parsed as a shell command line,
       # splitting an unquoted command path containing spaces. Use the
       # [cmdname, argv0] form to keep exec semantics.

data/lib/rubygems/security/signer.rb

@@ -109,9 +109,7 @@ class Gem::Security::Signer
     subject_alt_name = cert.extensions.find {|e| e.oid == "subjectAltName" }
 
     if subject_alt_name
-      /\Aemail:/ =~ subject_alt_name.value # rubocop:disable Performance/StartWith
-
-      $' || subject_alt_name.value
+      subject_alt_name.value.delete_prefix("email:")
     else
       cert.subject
     end

data/lib/rubygems/update_suggestion.rb

@@ -10,10 +10,14 @@ module Gem::UpdateSuggestion
   # Message to promote available RubyGems update with related gem update command.
 
   def update_suggestion
+    current = Gem.rubygems_version
+    latest = Gem.latest_rubygems_version
+
     <<-MESSAGE
 
-A new release of RubyGems is available: #{Gem.rubygems_version} → #{Gem.latest_rubygems_version}!
-Run `gem update --system #{Gem.latest_rubygems_version}` to update your installation.
+A new release of RubyGems is available: #{current} → #{latest}!
+See https://github.com/ruby/rubygems/blob/v#{latest}/CHANGELOG.md for the changes since #{current}.
+Run `gem update --system #{latest}` to update your installation.
 
     MESSAGE
   end

data/lib/rubygems/util.rb

@@ -75,15 +75,39 @@ module Gem::Util
   end
 
   ##
-  # Globs for files matching +pattern+ inside of +directory+,
-  # returning absolute paths to the matching files. Unlike a plain
-  # Dir.glob with an interpolated path, glob metacharacters in
-  # +base_path+ are not treated as part of the pattern.
+  # Globs for entries matching +glob+ inside of +base_path+, returning
+  # absolute paths to the matching files and directories. Unlike a plain
+  # Dir.glob with an interpolated path, glob metacharacters in +base_path+
+  # are not treated as part of the pattern. Matched entries are joined to
+  # +base_path+ literally, so an entry starting with `~` is not expanded
+  # into a home directory, and no other normalization is applied to them.
 
   def self.glob_files_in_dir(glob, base_path)
     expanded_path = nil
     Dir.glob(glob, base: base_path).map! do |f|
-      File.expand_path(f, expanded_path ||= File.expand_path(base_path))
+      # File.join instead of File.expand_path, so that matched entries
+      # starting with `~` are not expanded into the home directory
+      File.join(expanded_path ||= File.expand_path(base_path), f)
+    end
+  end
+
+  ##
+  # Duplicates +obj+ without Marshal, which cannot resolve Gem:: constants from
+  # the root box under Ruby::Box (RUBY_BOX=1). Hashes and arrays are copied
+  # recursively, anything else with a plain +dup+, so an object's internals stay
+  # shared with the original, as are hash keys. Shared references are not
+  # preserved, and a cyclic +obj+ raises SystemStackError.
+
+  def self.deep_dup(obj) # :nodoc:
+    case obj
+    when Hash then obj.to_h {|k, v| [k, deep_dup(v)] }
+    when Array then obj.map {|e| deep_dup(e) }
+    else
+      begin
+        obj.dup
+      rescue TypeError
+        obj
+      end
     end
   end
 

data/lib/rubygems.rb

@@ -9,7 +9,7 @@
 require "rbconfig"
 
 module Gem
-  VERSION = "4.0.19"
+  VERSION = "4.0.20"
 end
 
 require_relative "rubygems/defaults"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubygems-update
 version: !ruby/object:Gem::Version
-  version: 4.0.19
+  version: 4.0.20
 platform: ruby
 authors:
 - Jim Weirich
@@ -723,7 +723,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: RubyGems is a package management framework for Ruby. This gem is downloaded
   and installed by `gem update --system`, so that the `gem` CLI can update itself.