Merge pull request #7389 from rubygems/release/bundler_2.5.5_rubygems_3.5.5

Prepare RubyGems 3.5.5 and Bundler 2.5.5

Author: deivid-rodriguez

.changelog.yml

@@ -21,7 +21,7 @@ changelog_label_mapping:
   "rubygems: enhancement": "## Enhancements:"
   "rubygems: bug fix": "## Bug fixes:"
   "rubygems: documentation": "## Documentation:"
-  "rubygems: backport": null
+  "rubygems: skip changelog": null
 
 patch_level_labels:
   - "rubygems: security"
@@ -30,4 +30,4 @@ patch_level_labels:
   - "rubygems: bug fix"
   - "rubygems: performance"
   - "rubygems: documentation"
-  - "rubygems: backport"
+  - "rubygems: skip changelog"

.github/workflows/realworld-bundler.yml

@@ -57,7 +57,7 @@ jobs:
       - name: Run Test
         run: bin/rake spec:realworld
       - name: Upload used cassettes as artifact
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
         with:
           name: cassettes-bundler-${{ matrix.bundler.name }}-${{ matrix.os.value }}-${{ matrix.ruby.name }}
           path: ./bundler/spec/support/artifice/used_cassettes.txt
@@ -93,7 +93,7 @@ jobs:
       - name: Run Test
         run: bin/rake spec:realworld
       - name: Upload used cassettes as artifact
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
         with:
           name: cassettes-system-rubygems-bundler-${{ matrix.bundler.name }}-${{ matrix.ruby.name }}
           path: ./bundler/spec/support/artifice/used_cassettes.txt
@@ -111,7 +111,7 @@ jobs:
           ruby-version: 3.3.0
           bundler: none
       - name: Download all used cassettes as artifacts
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
         with:
           path: ./bundler/spec/support/artifice/used_vcr_cassettes
       - name: Check unused cassettes

.gitignore

@@ -1,5 +1,6 @@
 *.rbc
 *.swp
+.ruby-version
 .DS_Store
 /.idea
 /.rdoc

CHANGELOG.md

@@ -1,4 +1,25 @@
-# 3.5.4 / 2024-01-03
+# 3.5.5 / 2024-01-18
+
+## Enhancements:
+
+* Installs bundler 2.5.5 as a default gem.
+
+## Bug fixes:
+
+* Fix `require` activation conflicts when requiring default gems under
+  some situations. Pull request
+  [#7379](https://github.com/rubygems/rubygems/pull/7379) by
+  deivid-rodriguez
+* Use cache_home instead of data_home in default_spec_cache_dir. Pull
+  request [#7331](https://github.com/rubygems/rubygems/pull/7331) by mrkn
+
+## Documentation:
+
+* Use squiggly heredocs in `Gem::Specification#description` documentation,
+  so it doesn't add leading whitespace. Pull request
+  [#7373](https://github.com/rubygems/rubygems/pull/7373) by bravehager
+
+# 3.5.4 / 2024-01-04
 
 ## Enhancements:
 

POLICIES.md

@@ -79,11 +79,11 @@ changelog.
 If PRs don't have a proper label, they won't be backported to patch releases.
 
 If you want a PR to be backported to a patch level release, but don't want to
-include it in the changelog, you can use the special `rubygems: backport` and
-`bundler: backport` labels. For example, this is useful when backporting a PR
-generates conflicts that are solved by backporting another PR with no user
-visible changes. You can use these special labels to also backport the other PR
-and not get any conflicts.
+include it in the changelog, you can use the special `rubygems: skip changelog`
+and `bundler: skip changelog` labels. For example, this is useful when
+backporting a PR generates conflicts that are solved by backporting another PR
+with no user visible changes. You can use these special labels to also backport
+the other PR and not get any conflicts.
 
 ### Steps for patch releases
 

bundler/.changelog.yml

@@ -15,7 +15,7 @@ changelog_label_mapping:
   "bundler: enhancement": "## Enhancements:"
   "bundler: bug fix": "## Bug fixes:"
   "bundler: documentation": "## Documentation:"
-  "bundler: backport": null
+  "bundler: skip changelog": null
 
 patch_level_labels:
   - "bundler: security"
@@ -24,4 +24,4 @@ patch_level_labels:
   - "bundler: bug fix"
   - "bundler: performance"
   - "bundler: documentation"
-  - "bundler: backport"
+  - "bundler: skip changelog"

bundler/CHANGELOG.md

@@ -1,4 +1,15 @@
-# 2.5.4 (January 3, 2024)
+# 2.5.5 (January 18, 2024)
+
+## Bug fixes:
+
+  - Fix development dependency not being added if introduced by two gemspecs [#7358](https://github.com/rubygems/rubygems/pull/7358)
+  - Fix ETag quoting regression in If-None-Match header of compact index request [#7352](https://github.com/rubygems/rubygems/pull/7352)
+
+## Documentation:
+
+  - Refer to underscores as underscores [#7364](https://github.com/rubygems/rubygems/pull/7364)
+
+# 2.5.4 (January 4, 2024)
 
 ## Bug fixes:
 

bundler/doc/playbooks/MERGING_A_PR.md

@@ -30,8 +30,8 @@ release, make sure the following information is accurate:
   file.
 
   If for some reason you need a PR to be backported to a stable branch, but it
-  doesn't have any user visible changes, apply the "bundler: backport" label to
-  it so that our release scripts know about that.
+  doesn't have any user visible changes, apply the "bundler: skip changelog"
+  label to it so that our release scripts know about that.
 
 Finally, don't forget to review the changes in detail. Make sure you try them
 locally if they are not trivial and make sure you request changes and ask as

bundler/lib/bundler/compact_index_client/updater.rb

@@ -42,7 +42,7 @@ def append(remote_path, local_path, etag_path)
           else
             file.write(response.body)
           end
-          CacheFile.write(etag_path, etag(response))
+          CacheFile.write(etag_path, etag_from_response(response))
           true
         end
       end
@@ -53,13 +53,13 @@ def replace(remote_path, local_path, etag_path)
         response = @fetcher.call(remote_path, request_headers(etag))
         return true if response.is_a?(Gem::Net::HTTPNotModified)
         CacheFile.write(local_path, response.body, parse_digests(response))
-        CacheFile.write(etag_path, etag(response))
+        CacheFile.write(etag_path, etag_from_response(response))
       end
 
       def request_headers(etag, range_start = nil)
         headers = {}
         headers["Range"] = "bytes=#{range_start}-" if range_start
-        headers["If-None-Match"] = etag if etag
+        headers["If-None-Match"] = %("#{etag}") if etag
         headers
       end
 
@@ -77,7 +77,7 @@ def generate_etag(etag_path, file)
         etag
       end
 
-      def etag(response)
+      def etag_from_response(response)
         return unless response["ETag"]
         etag = response["ETag"].delete_prefix("W/")
         return if etag.delete_prefix!('"') && !etag.delete_suffix!('"')

bundler/lib/bundler/dsl.rb

@@ -102,9 +102,6 @@ def gem(name, *args)
 
       # if there's already a dependency with this name we try to prefer one
       if current = @dependencies.find {|d| d.name == dep.name }
-        # Always prefer the dependency from the Gemfile
-        @dependencies.delete(current) if current.gemspec_dev_dep?
-
         if current.requirement != dep.requirement
           current_requirement_open = current.requirements_list.include?(">= 0")
 
@@ -116,8 +113,6 @@ def gem(name, *args)
               Bundler.ui.warn "A gemspec development dependency (#{gemspec_dep.name}, #{gemspec_dep.requirement}) is being overridden by a Gemfile dependency (#{gemfile_dep.name}, #{gemfile_dep.requirement}).\n" \
                               "This behaviour may change in the future. Please remove either of them, or make sure they both have the same requirement\n"
             end
-
-            return if dep.gemspec_dev_dep?
           else
             update_prompt = ""
 
@@ -135,8 +130,13 @@ def gem(name, *args)
                            "You specified: #{current.name} (#{current.requirement}) and #{dep.name} (#{dep.requirement})" \
                            "#{update_prompt}"
           end
-        elsif current.gemspec_dev_dep? || dep.gemspec_dev_dep?
-          return if dep.gemspec_dev_dep?
+        end
+
+        # Always prefer the dependency from the Gemfile
+        if current.gemspec_dev_dep?
+          @dependencies.delete(current)
+        elsif dep.gemspec_dev_dep?
+          return
         elsif current.source != dep.source
           raise GemfileError, "You cannot specify the same gem twice coming from different sources.\n" \
                           "You specified that #{dep.name} (#{dep.requirement}) should come from " \