Track RubyGems 3.4.0dev and Bundler 2.4.0dev

Merged: https://github.com/ruby/ruby/pull/5350

lib/bundler/definition.rb

@@ -87,10 +87,11 @@ module Bundler
         @platforms = @locked_platforms.dup
         @locked_bundler_version = @locked_gems.bundler_version
         @locked_ruby_version = @locked_gems.ruby_version
+        @originally_locked_specs = SpecSet.new(@locked_gems.specs)
 
         if unlock != true
           @locked_deps    = @locked_gems.dependencies
-          @locked_specs   = SpecSet.new(@locked_gems.specs)
+          @locked_specs   = @originally_locked_specs
           @locked_sources = @locked_gems.sources
         else
           @unlock         = {}
@@ -688,14 +689,17 @@ module Bundler
     def converge_specs(specs)
       deps = []
       converged = []
+
+      @dependencies.each do |dep|
+        if specs[dep].any? {|s| s.satisfies?(dep) && (!dep.source || s.source.include?(dep.source)) }
+          deps << dep
+        end
+      end
+
       specs.each do |s|
         # Replace the locked dependency's source with the equivalent source from the Gemfile
         dep = @dependencies.find {|d| s.satisfies?(d) }
 
-        if dep && (!dep.source || s.source.include?(dep.source))
-          deps << dep
-        end
-
         s.source = (dep && dep.source) || sources.get(s.source) || sources.default_source unless Bundler.frozen_bundle?
 
         next if @unlock[:sources].include?(s.source.name)
@@ -827,7 +831,7 @@ module Bundler
 
     def additional_base_requirements_for_resolve
       return [] unless @locked_gems && unlocking? && !sources.expired_sources?(@locked_gems.sources)
-      converge_specs(@locked_gems.specs).map do |locked_spec|
+      converge_specs(@originally_locked_specs).map do |locked_spec|
         name = locked_spec.name
         dep = Gem::Dependency.new(name, ">= #{locked_spec.version}")
         DepProxy.get_proxy(dep, locked_spec.platform)

lib/bundler/dsl.rb

@@ -46,7 +46,7 @@ module Bundler
       @gemfile = expanded_gemfile_path
       @gemfiles << expanded_gemfile_path
       contents ||= Bundler.read_file(@gemfile.to_s)
-      instance_eval(contents.dup.tap{|x| x.untaint if Kernel.method_defined?(:untaint) }, gemfile.to_s, 1)
+      instance_eval(contents.dup.tap{|x| x.untaint if RUBY_VERSION < "2.7" }, gemfile.to_s, 1)
     rescue Exception => e # rubocop:disable Lint/RescueException
       message = "There was an error " \
         "#{e.is_a?(GemfileEvalError) ? "evaluating" : "parsing"} " \

lib/bundler/rubygems_ext.rb

@@ -29,7 +29,7 @@ module Gem
       # gems at that time, this method could be called inside another require,
       # thus raising with that constant being undefined. Better to check a method
       if source.respond_to?(:path) || (source.respond_to?(:bundler_plugin_api_source?) && source.bundler_plugin_api_source?)
-        Pathname.new(loaded_from).dirname.expand_path(source.root).to_s.tap{|x| x.untaint if Kernel.method_defined?(:untaint) }
+        Pathname.new(loaded_from).dirname.expand_path(source.root).to_s.tap{|x| x.untaint if RUBY_VERSION < "2.7" }
       else
         rg_full_gem_path
       end

lib/bundler/self_manager.rb

@@ -15,10 +15,6 @@ module Bundler
     def install_locked_bundler_and_restart_with_it_if_needed
       return unless needs_switching?
 
-      Bundler.ui.info \
-        "Bundler #{current_version} is running, but your lockfile was generated with #{lockfile_version}. " \
-        "Installing Bundler #{lockfile_version} and restarting using that version."
-
       install_and_restart_with_locked_bundler
     end
 
@@ -26,8 +22,14 @@ module Bundler
 
     def install_and_restart_with_locked_bundler
       bundler_dep = Gem::Dependency.new("bundler", lockfile_version)
+      spec = fetch_spec_for(bundler_dep)
+      return if spec.nil?
 
-      Gem.install(bundler_dep)
+      Bundler.ui.info \
+        "Bundler #{current_version} is running, but your lockfile was generated with #{lockfile_version}. " \
+        "Installing Bundler #{lockfile_version} and restarting using that version."
+
+      spec.source.install(spec)
     rescue StandardError => e
       Bundler.ui.trace e
       Bundler.ui.warn "There was an error installing the locked bundler version (#{lockfile_version}), rerun with the `--verbose` flag for more details. Going on using bundler #{current_version}."
@@ -35,6 +37,17 @@ module Bundler
       restart_with_locked_bundler
     end
 
+    def fetch_spec_for(bundler_dep)
+      source = Bundler::Source::Rubygems.new("remotes" => "https://rubygems.org")
+      source.remote!
+      source.add_dependency_names("bundler")
+      spec = source.specs.search(bundler_dep).first
+      if spec.nil?
+        Bundler.ui.warn "Your lockfile is locked to a version of bundler (#{lockfile_version}) that doesn't exist at https://rubygems.org/. Going on using #{current_version}"
+      end
+      spec
+    end
+
     def restart_with_locked_bundler
       configured_gem_home = ENV["GEM_HOME"]
       configured_gem_path = ENV["GEM_PATH"]

lib/bundler/shared_helpers.rb

@@ -13,13 +13,13 @@ module Bundler
     def root
       gemfile = find_gemfile
       raise GemfileNotFound, "Could not locate Gemfile" unless gemfile
-      Pathname.new(gemfile).tap{|x| x.untaint if Kernel.method_defined?(:untaint) }.expand_path.parent
+      Pathname.new(gemfile).tap{|x| x.untaint if RUBY_VERSION < "2.7" }.expand_path.parent
     end
 
     def default_gemfile
       gemfile = find_gemfile
       raise GemfileNotFound, "Could not locate Gemfile" unless gemfile
-      Pathname.new(gemfile).tap{|x| x.untaint if Kernel.method_defined?(:untaint) }.expand_path
+      Pathname.new(gemfile).tap{|x| x.untaint if RUBY_VERSION < "2.7" }.expand_path
     end
 
     def default_lockfile
@@ -28,7 +28,7 @@ module Bundler
       case gemfile.basename.to_s
       when "gems.rb" then Pathname.new(gemfile.sub(/.rb$/, ".locked"))
       else Pathname.new("#{gemfile}.lock")
-      end.tap{|x| x.untaint if Kernel.method_defined?(:untaint) }
+      end.tap{|x| x.untaint if RUBY_VERSION < "2.7" }
     end
 
     def default_bundle_dir
@@ -100,7 +100,7 @@ module Bundler
     #
     # @see {Bundler::PermissionError}
     def filesystem_access(path, action = :write, &block)
-      yield(path.dup.tap{|x| x.untaint if Kernel.method_defined?(:untaint) })
+      yield(path.dup.tap{|x| x.untaint if RUBY_VERSION < "2.7" })
     rescue Errno::EACCES
       raise PermissionError.new(path, action)
     rescue Errno::EAGAIN
@@ -236,7 +236,7 @@ module Bundler
 
     def search_up(*names)
       previous = nil
-      current  = File.expand_path(SharedHelpers.pwd).tap{|x| x.untaint if Kernel.method_defined?(:untaint) }
+      current  = File.expand_path(SharedHelpers.pwd).tap{|x| x.untaint if RUBY_VERSION < "2.7" }
 
       until !File.directory?(current) || current == previous
         if ENV["BUNDLER_SPEC_RUN"]

lib/bundler/source/git.rb

@@ -336,7 +336,7 @@ module Bundler
 
       def load_gemspec(file)
         stub = Gem::StubSpecification.gemspec_stub(file, install_path.parent, install_path.parent)
-        stub.full_gem_path = Pathname.new(file).dirname.expand_path(root).to_s.tap{|x| x.untaint if Kernel.method_defined?(:untaint) }
+        stub.full_gem_path = Pathname.new(file).dirname.expand_path(root).to_s.tap{|x| x.untaint if RUBY_VERSION < "2.7" }
         StubSpecification.from_stub(stub)
       end
 

lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "2.3.3".freeze
+  VERSION = "2.4.0.dev".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= VERSION.split(".").first.to_i

lib/rubygems.rb

@@ -8,7 +8,7 @@
 require 'rbconfig'
 
 module Gem
-  VERSION = "3.3.3".freeze
+  VERSION = "3.4.0.dev".freeze
 end
 
 # Must be first since it unloads the prelude from 1.9.2

spec/bundler/commands/binstubs_spec.rb

@@ -182,30 +182,26 @@ RSpec.describe "bundle binstubs <gem>" do
         end
 
         context "and the version is older and the same major" do
-          let(:system_bundler_version) { "55.1" }
+          let(:system_bundler_version) { "2.3.1" }
 
           before do
-            lockfile lockfile.gsub(/BUNDLED WITH\n   .*$/m, "BUNDLED WITH\n   55.0")
+            lockfile lockfile.gsub(/BUNDLED WITH\n   .*$/m, "BUNDLED WITH\n   2.3.0")
-
-            update_repo2 do
-              with_built_bundler("55.0") {|gem_path| FileUtils.mv(gem_path, gem_repo2("gems")) }
-            end
           end
 
           it "installs and runs the exact version of bundler", :rubygems => ">= 3.3.0.dev" do
-            sys_exec "bin/bundle install --verbose", :env => { "BUNDLER_SPEC_GEM_SOURCES" => file_uri_for(gem_repo2).to_s, "RUBYOPT" => "-r#{spec_dir}/support/hax.rb" }
+            sys_exec "bin/bundle install --verbose", :artifice => "vcr"
             expect(exitstatus).not_to eq(42)
-            expect(out).to include("Bundler 55.1 is running, but your lockfile was generated with 55.0. Installing Bundler 55.0 and restarting using that version.")
+            expect(out).to include("Bundler 2.3.1 is running, but your lockfile was generated with 2.3.0. Installing Bundler 2.3.0 and restarting using that version.")
-            expect(out).to include("Using bundler 55.0")
+            expect(out).to include("Using bundler 2.3.0")
-            expect(err).not_to include("Activating bundler (~> 55.0) failed:")
+            expect(err).not_to include("Activating bundler (~> 2.3.0) failed:")
           end
 
           it "runs the available version of bundler", :rubygems => "< 3.3.0.dev" do
             sys_exec "bin/bundle install --verbose"
             expect(exitstatus).not_to eq(42)
-            expect(out).not_to include("Bundler 55.1 is running, but your lockfile was generated with 55.0. Installing Bundler 55.0 and restarting using that version.")
+            expect(out).not_to include("Bundler 2.3.1 is running, but your lockfile was generated with 2.3.0. Installing Bundler 2.3.0 and restarting using that version.")
-            expect(out).to include("Using bundler 55.1")
+            expect(out).to include("Using bundler 2.3.1")
-            expect(err).not_to include("Activating bundler (~> 55.0) failed:")
+            expect(err).not_to include("Activating bundler (~> 2.3.0) failed:")
           end
         end
 

spec/bundler/commands/install_spec.rb

@@ -364,7 +364,9 @@ RSpec.describe "bundle install with gem sources" do
     end
 
     it "throws a warning if a gem is added twice in Gemfile without version requirements" do
-      install_gemfile <<-G, :raise_on_error => false
+      build_repo2
+
+      install_gemfile <<-G
         source "#{file_uri_for(gem_repo2)}"
         gem "rack"
         gem "rack"
@@ -376,7 +378,9 @@ RSpec.describe "bundle install with gem sources" do
     end
 
     it "throws a warning if a gem is added twice in Gemfile with same versions" do
-      install_gemfile <<-G, :raise_on_error => false
+      build_repo2
+
+      install_gemfile <<-G
         source "#{file_uri_for(gem_repo2)}"
         gem "rack", "1.0"
         gem "rack", "1.0"
@@ -387,6 +391,22 @@ RSpec.describe "bundle install with gem sources" do
       expect(err).to include("While it's not a problem now, it could cause errors if you change the version of one of them later.")
     end
 
+    it "throws a warning if a gem is added twice under different platforms and does not crash when using the generated lockfile" do
+      build_repo2
+
+      install_gemfile <<-G
+        source "#{file_uri_for(gem_repo2)}"
+        gem "rack", :platform => :jruby
+        gem "rack"
+      G
+
+      bundle "install"
+
+      expect(err).to include("Your Gemfile lists the gem rack (>= 0) more than once.")
+      expect(err).to include("Remove any duplicate entries and specify the gem only once.")
+      expect(err).to include("While it's not a problem now, it could cause errors if you change the version of one of them later.")
+    end
+
     it "does not throw a warning if a gem is added once in Gemfile and also inside a gemspec as a development dependency" do
       build_lib "my-gem", :path => bundled_app do |s|
         s.add_development_dependency "my-private-gem"

spec/bundler/lock/lockfile_spec.rb

@@ -80,12 +80,8 @@ RSpec.describe "the lockfile format" do
     G
   end
 
-  it "does not update the lockfile's bundler version if nothing changed during bundle install, but uses the locked version", :rubygems => ">= 3.3.0.a" do
+  it "does not update the lockfile's bundler version if nothing changed during bundle install, but uses the locked version", :rubygems => ">= 3.3.0.a", :realworld => true do
-    version = "#{Bundler::VERSION.split(".").first}.0.0.a"
+    version = "2.3.0"
-
-    update_repo2 do
-      with_built_bundler(version) {|gem_path| FileUtils.mv(gem_path, gem_repo2("gems")) }
-    end
 
     lockfile <<-L
       GEM
@@ -103,7 +99,7 @@ RSpec.describe "the lockfile format" do
          #{version}
     L
 
-    install_gemfile <<-G, :verbose => true, :env => { "BUNDLER_SPEC_GEM_SOURCES" => file_uri_for(gem_repo2).to_s }
+    install_gemfile <<-G, :verbose => true, :artifice => "vcr"
       source "#{file_uri_for(gem_repo2)}"
 
       gem "rack"
@@ -132,10 +128,6 @@ RSpec.describe "the lockfile format" do
   it "does not update the lockfile's bundler version if nothing changed during bundle install, and uses the latest version", :rubygems => "< 3.3.0.a" do
     version = "#{Bundler::VERSION.split(".").first}.0.0.a"
 
-    update_repo2 do
-      with_built_bundler(version) {|gem_path| FileUtils.mv(gem_path, gem_repo2("gems")) }
-    end
-
     lockfile <<-L
       GEM
         remote: #{file_uri_for(gem_repo2)}/
@@ -152,7 +144,7 @@ RSpec.describe "the lockfile format" do
          #{version}
     L
 
-    install_gemfile <<-G, :verbose => true, :env => { "BUNDLER_SPEC_GEM_SOURCES" => file_uri_for(gem_repo2).to_s }
+    install_gemfile <<-G, :verbose => true
       source "#{file_uri_for(gem_repo2)}"
 
       gem "rack"

spec/bundler/realworld/fixtures/warbler/Gemfile.lock

@@ -27,4 +27,4 @@ DEPENDENCIES
   warbler (~> 2.0)
 
 BUNDLED WITH
-   2.3.0.dev
+   2.4.0.dev

spec/bundler/runtime/self_management_spec.rb

@@ -1,15 +1,13 @@
 # frozen_string_literal: true
 
-RSpec.describe "Self management", :rubygems => ">= 3.3.0.dev" do
+RSpec.describe "Self management", :rubygems => ">= 3.3.0.dev", :realworld => true do
   describe "auto switching" do
-    let(:next_minor) do
+    let(:previous_minor) do
-      Bundler::VERSION.split(".").map.with_index {|s, i| i == 1 ? s.to_i + 1 : s }[0..2].join(".")
+      "2.3.0"
     end
 
     before do
-      build_repo2 do
+      build_repo2
-        with_built_bundler(next_minor) {|gem_path| FileUtils.mv(gem_path, gem_repo2("gems")) }
-      end
 
       gemfile <<-G
         source "#{file_uri_for(gem_repo2)}"
@@ -19,11 +17,11 @@ RSpec.describe "Self management", :rubygems => ">= 3.3.0.dev" do
     end
 
     it "installs locked version when using system path and uses it" do
-      lockfile_bundled_with(next_minor)
+      lockfile_bundled_with(previous_minor)
 
       bundle "config set --local path.system true"
-      bundle "install", :env => { "BUNDLER_SPEC_GEM_SOURCES" => file_uri_for(gem_repo2).to_s }
+      bundle "install", :artifice => "vcr"
-      expect(out).to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{next_minor}. Installing Bundler #{next_minor} and restarting using that version.")
+      expect(out).to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{previous_minor}. Installing Bundler #{previous_minor} and restarting using that version.")
 
       # It uninstalls the older system bundler
       bundle "clean --force"
@@ -31,21 +29,21 @@ RSpec.describe "Self management", :rubygems => ">= 3.3.0.dev" do
 
       # App now uses locked version
       bundle "-v"
-      expect(out).to end_with(next_minor[0] == "2" ? "Bundler version #{next_minor}" : next_minor)
+      expect(out).to end_with(previous_minor[0] == "2" ? "Bundler version #{previous_minor}" : previous_minor)
 
       # Subsequent installs use the locked version without reinstalling
       bundle "install --verbose"
-      expect(out).to include("Using bundler #{next_minor}")
+      expect(out).to include("Using bundler #{previous_minor}")
-      expect(out).not_to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{next_minor}. Installing Bundler #{next_minor} and restarting using that version.")
+      expect(out).not_to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{previous_minor}. Installing Bundler #{previous_minor} and restarting using that version.")
     end
 
     it "installs locked version when using local path and uses it" do
-      lockfile_bundled_with(next_minor)
+      lockfile_bundled_with(previous_minor)
 
       bundle "config set --local path vendor/bundle"
-      bundle "install", :env => { "BUNDLER_SPEC_GEM_SOURCES" => file_uri_for(gem_repo2).to_s }
+      bundle "install", :artifice => "vcr"
-      expect(out).to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{next_minor}. Installing Bundler #{next_minor} and restarting using that version.")
+      expect(out).to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{previous_minor}. Installing Bundler #{previous_minor} and restarting using that version.")
-      expect(vendored_gems("gems/bundler-#{next_minor}")).to exist
+      expect(vendored_gems("gems/bundler-#{previous_minor}")).to exist
 
       # It does not uninstall the locked bundler
       bundle "clean"
@@ -53,21 +51,21 @@ RSpec.describe "Self management", :rubygems => ">= 3.3.0.dev" do
 
       # App now uses locked version
       bundle "-v"
-      expect(out).to end_with(next_minor[0] == "2" ? "Bundler version #{next_minor}" : next_minor)
+      expect(out).to end_with(previous_minor[0] == "2" ? "Bundler version #{previous_minor}" : previous_minor)
 
       # Subsequent installs use the locked version without reinstalling
       bundle "install --verbose"
-      expect(out).to include("Using bundler #{next_minor}")
+      expect(out).to include("Using bundler #{previous_minor}")
-      expect(out).not_to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{next_minor}. Installing Bundler #{next_minor} and restarting using that version.")
+      expect(out).not_to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{previous_minor}. Installing Bundler #{previous_minor} and restarting using that version.")
     end
 
     it "installs locked version when using deployment option and uses it" do
-      lockfile_bundled_with(next_minor)
+      lockfile_bundled_with(previous_minor)
 
       bundle "config set --local deployment true"
-      bundle "install", :env => { "BUNDLER_SPEC_GEM_SOURCES" => file_uri_for(gem_repo2).to_s }
+      bundle "install", :artifice => "vcr"
-      expect(out).to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{next_minor}. Installing Bundler #{next_minor} and restarting using that version.")
+      expect(out).to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{previous_minor}. Installing Bundler #{previous_minor} and restarting using that version.")
-      expect(vendored_gems("gems/bundler-#{next_minor}")).to exist
+      expect(vendored_gems("gems/bundler-#{previous_minor}")).to exist
 
       # It does not uninstall the locked bundler
       bundle "clean"
@@ -75,16 +73,16 @@ RSpec.describe "Self management", :rubygems => ">= 3.3.0.dev" do
 
       # App now uses locked version
       bundle "-v"
-      expect(out).to end_with(next_minor[0] == "2" ? "Bundler version #{next_minor}" : next_minor)
+      expect(out).to end_with(previous_minor[0] == "2" ? "Bundler version #{previous_minor}" : previous_minor)
 
       # Subsequent installs use the locked version without reinstalling
       bundle "install --verbose"
-      expect(out).to include("Using bundler #{next_minor}")
+      expect(out).to include("Using bundler #{previous_minor}")
-      expect(out).not_to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{next_minor}. Installing Bundler #{next_minor} and restarting using that version.")
+      expect(out).not_to include("Bundler #{Bundler::VERSION} is running, but your lockfile was generated with #{previous_minor}. Installing Bundler #{previous_minor} and restarting using that version.")
     end
 
     it "does not try to install a development version" do
-      lockfile_bundled_with("#{next_minor}.dev")
+      lockfile_bundled_with("#{previous_minor}.dev")
 
       bundle "install --verbose"
       expect(out).not_to match(/restarting using that version/)
@@ -93,17 +91,13 @@ RSpec.describe "Self management", :rubygems => ">= 3.3.0.dev" do
       expect(out).to eq(Bundler::VERSION[0] == "2" ? "Bundler version #{Bundler::VERSION}" : Bundler::VERSION)
     end
 
-    it "shows a discreet message if locked bundler does not exist, and something more complete in `--verbose` mode" do
+    it "shows a discreet message if locked bundler does not exist" do
       missing_minor ="#{Bundler::VERSION[0]}.999.999"
 
       lockfile_bundled_with(missing_minor)
 
-      bundle "install"
+      bundle "install", :artifice => "vcr"
-      expect(err).to eq("There was an error installing the locked bundler version (#{missing_minor}), rerun with the `--verbose` flag for more details. Going on using bundler #{Bundler::VERSION}.")
+      expect(err).to eq("Your lockfile is locked to a version of bundler (#{missing_minor}) that doesn't exist at https://rubygems.org/. Going on using #{Bundler::VERSION}")
-
-      bundle "install --verbose"
-      expect(err).to include("There was an error installing the locked bundler version (#{missing_minor}), rerun with the `--verbose` flag for more details. Going on using bundler #{Bundler::VERSION}.")
-      expect(err).to include("Gem::UnsatisfiableDependencyError")
 
       bundle "-v"
       expect(out).to eq(Bundler::VERSION[0] == "2" ? "Bundler version #{Bundler::VERSION}" : Bundler::VERSION)

tool/bundler/rubocop_gems.rb.lock

@@ -60,4 +60,4 @@ DEPENDENCIES
   test-unit
 
 BUNDLED WITH
-   2.3.3
+   2.4.0.dev

tool/bundler/standard_gems.rb.lock

@@ -66,4 +66,4 @@ DEPENDENCIES
   test-unit
 
 BUNDLED WITH
-   2.3.3
+   2.4.0.dev

tool/bundler/test_gems.rb.lock

@@ -41,4 +41,4 @@ DEPENDENCIES
   webrick (= 1.7.0)
 
 BUNDLED WITH
-   2.3.3
+   2.4.0.dev