Prepare RubyGems 4.0.18 and Bundler 4.0.18

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 4.0.18 / 2026-08-05
+
+### Enhancements:
+
+* Check the resolved parent directory before extracting old format gems. Pull request [#9755](https://github.com/ruby/rubygems/pull/9755) by hsbt
+* Installs bundler 4.0.18 as a default gem.
+
+### Bug fixes:
+
+* Call Kernel.format explicitly in Gem::Deprecate wrapper. Pull request [#9714](https://github.com/ruby/rubygems/pull/9714) by hsbt
+
+### Documentation:
+
+* Point bundler.io URLs at guides.rubygems.org. Pull request [#9737](https://github.com/ruby/rubygems/pull/9737) by hsbt
+
 ## 4.0.17 / 2026-07-22
 
 ### Enhancements:

Rakefile

@@ -343,7 +343,7 @@ end
 
 directory "tmp/blog.rubygems.org" do
   sh "git", "clone",
-    "https://github.com/rubygems/rubygems.github.io.git",
+    "https://github.com/rubygems/blog.git",
      "tmp/blog.rubygems.org"
 end
 

bundler/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 4.0.18 / 2026-08-05
+
+### Enhancements:
+
+* Don't mask install errors when no Gemfile can be located. Pull request [#9757](https://github.com/ruby/rubygems/pull/9757) by hsbt
+* Warn when duplicate source declarations conflict on cooldown. Pull request [#9736](https://github.com/ruby/rubygems/pull/9736) by hsbt
+* Redact URI userinfo from settings names in Bundler User-Agent. Pull request [#9716](https://github.com/ruby/rubygems/pull/9716) by hsbt
+* Validate gem name before building compact index cache paths. Pull request [#9717](https://github.com/ruby/rubygems/pull/9717) by hsbt
+
+### Bug fixes:
+
+* Fail `bundle check` when frozen mode needs lockfile changes. Pull request [#9715](https://github.com/ruby/rubygems/pull/9715) by hsbt
+* Skip empty checksum values in compact index metadata. Pull request [#9713](https://github.com/ruby/rubygems/pull/9713) by hsbt
+
+### Security:
+
+* Add --cooldown flag to bundle lock and bundle cache. Pull request [#9725](https://github.com/ruby/rubygems/pull/9725) by hsbt
+
+### Documentation:
+
+* Point bundler.io URLs at guides.rubygems.org. Pull request [#9737](https://github.com/ruby/rubygems/pull/9737) by hsbt
+* Document Bundler checksum behavior for default gems. Pull request [#9735](https://github.com/ruby/rubygems/pull/9735) by p-linnane
+* List missing subcommands in bundle(1) UTILITIES section. Pull request [#9721](https://github.com/ruby/rubygems/pull/9721) by hsbt
+* Document pessimistic operator and eval_gemfile in gemfile(5). Pull request [#9719](https://github.com/ruby/rubygems/pull/9719) by hsbt
+
 ## 4.0.17 / 2026-07-22
 
 ### Enhancements:

bundler/lib/bundler.rb

@@ -26,7 +26,7 @@
 # or Bundler.setup to setup environment where only specified gems and their
 # specified versions could be used.
 #
-# See {Bundler website}[https://bundler.io/docs.html] for extensive documentation
+# See {Bundler documentation}[https://guides.rubygems.org/command-reference/bundle/] for extensive documentation
 # on gemfiles creation and Bundler usage.
 #
 # As a standard library inside project, Bundler could be used for introspection

bundler/lib/bundler/cli.rb

@@ -461,6 +461,7 @@ def fund
     method_option "path", type: :string, banner: "Specify a different path than the system default, namely, $BUNDLE_PATH or $GEM_HOME (removed)."
     method_option "quiet", type: :boolean, banner: "Only output warnings and errors."
     method_option "frozen", type: :boolean, banner: "Do not allow the Gemfile.lock to be updated after this bundle cache operation's install (removed)"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     long_desc <<-D
       The cache command will copy the .gem files for every gem in the bundle into the
       directory ./vendor/cache. If you then check that directory into your source
@@ -642,6 +643,7 @@ def inject(*)
     method_option "strict", type: :boolean, banner: "If updating, do not allow any gem to be updated past latest --patch | --minor | --major"
     method_option "conservative", type: :boolean, banner: "If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated"
     method_option "bundler", type: :string, lazy_default: "> 0.a", banner: "Update the locked version of bundler"
+    method_option "cooldown", type: :numeric, banner: "Only consider gem versions published at least N days ago. Use 0 to disable."
     def lock
       require_relative "cli/lock"
       Lock.new(options).run

bundler/lib/bundler/cli/check.rb

@@ -12,6 +12,7 @@ def run
       Bundler.settings.set_command_option_if_given :path, options[:path]
 
       definition = Bundler.definition
+      definition.ensure_equivalent_gemfile_and_lockfile
       definition.validate_runtime!
 
       begin
@@ -28,9 +29,6 @@ def run
         not_installed.each {|s| Bundler.ui.error " * #{s.name} (#{s.version})" }
         Bundler.ui.warn "Install missing gems with `bundle install`"
         exit 1
-      elsif !Bundler.default_lockfile.file? && Bundler.frozen_bundle?
-        Bundler.ui.error "This bundle has been frozen, but there is no #{SharedHelpers.relative_lockfile_path} present"
-        exit 1
       else
         definition.lock(true) unless options[:"dry-run"]
         Bundler.ui.info "The Gemfile's dependencies are satisfied"

bundler/lib/bundler/cli/issue.rb

@@ -13,10 +13,10 @@ def run
         https://github.com/ruby/rubygems/blob/master/doc/bundler/TROUBLESHOOTING.md
 
         2. Instructions for common Bundler uses can be found on the documentation
-        site: https://bundler.io/
+        site: https://guides.rubygems.org/
 
         3. Information about each Bundler command can be found in the Bundler
-        man pages: https://bundler.io/man/bundle.1.html
+        man pages: https://guides.rubygems.org/command-reference/bundle/
 
         Hopefully the troubleshooting steps above resolved your problem!  If things
         still aren't working the way you expect them to, please let us know so

bundler/lib/bundler/cli/lock.rb

@@ -16,6 +16,9 @@ def run
 
       check_for_conflicting_options
 
+      Bundler::CLI::Common.validate_cooldown!(options[:cooldown])
+      Bundler.settings.set_command_option_if_given :cooldown, options[:cooldown]
+
       print = options[:print]
       previous_output_stream = Bundler.ui.output_stream
       Bundler.ui.output_stream = :stderr if print

bundler/lib/bundler/compact_index_client/cache.rb

@@ -50,6 +50,7 @@ def versions_etag_path = directory.join("versions.etag")
 
       def info_path(name)
         name = name.to_s
+        validate_name!(name)
         # TODO: converge this into the info_root by hashing all filenames like info_etag_path
         if /[^a-z0-9_-]/.match?(name)
           name += "-#{SharedHelpers.digest(:MD5).hexdigest(name).downcase}"
@@ -61,9 +62,19 @@ def info_path(name)
 
       def info_etag_path(name)
         name = name.to_s
+        validate_name!(name)
         @info_etag_root.join("#{name}-#{SharedHelpers.digest(:MD5).hexdigest(name).downcase}")
       end
 
+      # Gem names come from the remote index and are not otherwise
+      # validated, so refuse anything that would escape the cache
+      # directory when used as a path component.
+      def validate_name!(name)
+        return if File.basename(name) == name
+
+        raise SecurityError, "malformed gem name: #{name.inspect}"
+      end
+
       def mkdir(name)
         directory.join(name).tap do |dir|
           SharedHelpers.filesystem_access(dir) do

bundler/lib/bundler/endpoint_specification.rb

@@ -153,8 +153,13 @@ def parse_metadata(data)
         next unless v
         case k.to_s
         when "checksum"
+          # Some registries send empty checksum values, treat them as if the
+          # checksum was not included at all
+          checksum = v.last
+          next unless checksum
+
           begin
-            @checksum = Checksum.from_api(v.last, @spec_fetcher.uri)
+            @checksum = Checksum.from_api(checksum, @spec_fetcher.uri)
           rescue ArgumentError => e
             raise ArgumentError, "Invalid checksum for #{full_name}: #{e.message}"
           end

bundler/lib/bundler/fetcher.rb

@@ -215,7 +215,13 @@ def user_agent
           agent << " #{ruby.engine}/#{ruby.versions_string(engine_version)}"
         end
 
-        agent << " options/#{Bundler.settings.all.join(",")}"
+        # Some settings keys embed a URI (e.g. `mirror.<uri>`) whose userinfo can
+        # carry credentials. Strip the userinfo before advertising the setting
+        # names so we don't leak secrets to every gem source we talk to.
+        options = Bundler.settings.all.map do |key|
+          key.include?("://") ? key.gsub(%r{//[^/@]+@}, "//") : key
+        end
+        agent << " options/#{options.join(",")}"
 
         agent << " ci/#{cis.join(",")}" if cis.any?
 

bundler/lib/bundler/installer/parallel_installer.rb

@@ -255,7 +255,15 @@ def handle_error
 
     def require_tree_for_spec(spec)
       tree = @spec_set.what_required(spec)
-      t = String.new("In #{File.basename(SharedHelpers.default_gemfile)}:\n")
+      gemfile_name = begin
+        File.basename(SharedHelpers.default_gemfile)
+      rescue GemfileNotFound
+        # This runs while reporting an install error. When no Gemfile can be
+        # located (e.g. Bundler used as a library), raising here would mask
+        # the original error, so fall back to a generic header instead.
+        "Gemfile"
+      end
+      t = String.new("In #{gemfile_name}:\n")
       tree.each_with_index do |s, depth|
         t << "  " * depth.succ << s.name
         unless tree.last == s

bundler/lib/bundler/man/bundle-add.1

@@ -76,4 +76,4 @@ You can assign the gem to more than one group\.
 \fBbundle add rails \-\-group "development, test"\fR
 .IP "" 0
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR, bundle\-remove(1) \fIbundle\-remove\.1\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR, bundle\-remove(1) \fIbundle\-remove\.1\.html\fR

bundler/lib/bundler/man/bundle-add.1.ronn

@@ -88,5 +88,5 @@ Adds the named gem to the [`Gemfile(5)`][Gemfile(5)] and run `bundle install`.
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html),
+[Gemfile(5)](https://guides.rubygems.org/gemfile/),
 [bundle-remove(1)](bundle-remove.1.html)

bundler/lib/bundler/man/bundle-cache.1

@@ -17,6 +17,9 @@ Include gems for all platforms present in the lockfile, not only the current one
 \fB\-\-cache\-path=CACHE\-PATH\fR
 Specify a different cache path than the default (vendor/cache)\.
 .TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving before caching\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
+.TP
 \fB\-\-gemfile=GEMFILE\fR
 Use the specified gemfile instead of Gemfile\.
 .TP

bundler/lib/bundler/man/bundle-cache.1.ronn

@@ -21,6 +21,12 @@ use the gems in the cache in preference to the ones on `rubygems.org`.
 * `--cache-path=CACHE-PATH`:
   Specify a different cache path than the default (vendor/cache).
 
+* `--cooldown=<number>`:
+  Only consider gem versions published at least <number> days ago when
+  resolving before caching. Pass `0` to disable cooldown for this run,
+  overriding any per-source or global configuration. See `cooldown` in
+  bundle-config(1).
+
 * `--gemfile=GEMFILE`:
   Use the specified gemfile instead of Gemfile.
 

bundler/lib/bundler/man/bundle-config.1

@@ -139,7 +139,7 @@ Cooldown filtering depends on the gem server providing a per\-version \fBcreated
 .IP "\(bu" 4
 \fBlockfile\fR (\fBBUNDLE_LOCKFILE\fR): The path to the lockfile that bundler should use\. By default, Bundler adds \fB\.lock\fR to the end of the \fBgemfile\fR entry\. Can be set to \fBfalse\fR in the Gemfile to disable lockfile creation entirely (see gemfile(5))\.
 .IP "\(bu" 4
-\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\.
+\fBlockfile_checksums\fR (\fBBUNDLE_LOCKFILE_CHECKSUMS\fR): Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources\. Defaults to true\. Bundler's own checksum is only included when its \fB\.gem\fR file is cached, which may not be the case when Bundler is installed as a default gem\.
 .IP "\(bu" 4
 \fBno_install\fR (\fBBUNDLE_NO_INSTALL\fR): Whether \fBbundle package\fR should skip installing gems\.
 .IP "\(bu" 4

bundler/lib/bundler/man/bundle-config.1.ronn

@@ -230,6 +230,8 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
    Gemfile to disable lockfile creation entirely (see gemfile(5)).
 * `lockfile_checksums` (`BUNDLE_LOCKFILE_CHECKSUMS`):
    Whether Bundler should include a checksums section in new lockfiles, to protect from compromised gem sources. Defaults to true.
+   Bundler's own checksum is only included when its `.gem` file is cached, which
+   may not be the case when Bundler is installed as a default gem.
 * `no_install` (`BUNDLE_NO_INSTALL`):
    Whether `bundle package` should skip installing gems.
 * `no_prune` (`BUNDLE_NO_PRUNE`):

bundler/lib/bundler/man/bundle-console.1

@@ -8,7 +8,7 @@
 .SH "DESCRIPTION"
 Starts an interactive Ruby console session in the context of the current bundle\.
 .P
-If no \fBGROUP\fR is specified, all gems in the \fBdefault\fR group in the Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR are preliminarily loaded\.
+If no \fBGROUP\fR is specified, all gems in the \fBdefault\fR group in the Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR are preliminarily loaded\.
 .P
 If \fBGROUP\fR is specified, all gems in the given group in the Gemfile in addition to the gems in \fBdefault\fR group are loaded\. Even if the given group does not exist in the Gemfile, IRB console starts without any warning or error\.
 .P
@@ -30,4 +30,4 @@ Resolving dependencies\|\.\|\.\|\.
 [1] pry(main)>
 .fi
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR

bundler/lib/bundler/man/bundle-console.1.ronn

@@ -9,7 +9,7 @@ bundle-console(1) -- Open an IRB session with the bundle pre-loaded
 
 Starts an interactive Ruby console session in the context of the current bundle.
 
-If no `GROUP` is specified, all gems in the `default` group in the [Gemfile(5)](https://bundler.io/man/gemfile.5.html) are
+If no `GROUP` is specified, all gems in the `default` group in the [Gemfile(5)](https://guides.rubygems.org/gemfile/) are
 preliminarily loaded.
 
 If `GROUP` is specified, all gems in the given group in the Gemfile in addition
@@ -36,4 +36,4 @@ the shell from the following:
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html)
+[Gemfile(5)](https://guides.rubygems.org/gemfile/)

bundler/lib/bundler/man/bundle-init.1

@@ -17,4 +17,4 @@ Use the specified name for the gemfile instead of \fBGemfile\fR
 .SH "FILES"
 Included in the default [\fBGemfile(5)\fR][Gemfile(5)] generated is the line \fB# frozen_string_literal: true\fR\. This is a magic comment supported for the first time in Ruby 2\.3\. The presence of this line results in all string literals in the file being implicitly frozen\.
 .SH "SEE ALSO"
-Gemfile(5) \fIhttps://bundler\.io/man/gemfile\.5\.html\fR
+Gemfile(5) \fIhttps://guides\.rubygems\.org/gemfile/\fR

bundler/lib/bundler/man/bundle-init.1.ronn

@@ -29,4 +29,4 @@ results in all string literals in the file being implicitly frozen.
 
 ## SEE ALSO
 
-[Gemfile(5)](https://bundler.io/man/gemfile.5.html)
+[Gemfile(5)](https://guides.rubygems.org/gemfile/)

bundler/lib/bundler/man/bundle-lock.1

@@ -4,7 +4,7 @@
 .SH "NAME"
 \fBbundle\-lock\fR \- Creates / Updates a lockfile without installing
 .SH "SYNOPSIS"
-\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative]
+\fBbundle lock\fR [\-\-update] [\-\-bundler[=BUNDLER]] [\-\-local] [\-\-print] [\-\-lockfile=PATH] [\-\-full\-index] [\-\-gemfile=GEMFILE] [\-\-add\-checksums] [\-\-add\-platform] [\-\-remove\-platform] [\-\-normalize\-platforms] [\-\-patch] [\-\-minor] [\-\-major] [\-\-pre] [\-\-strict] [\-\-conservative] [\-\-cooldown=NUMBER]
 .SH "DESCRIPTION"
 Lock the gems specified in Gemfile\.
 .SH "OPTIONS"
@@ -59,6 +59,9 @@ If updating, do not allow any gem to be updated past latest \-\-patch | \-\-mino
 .TP
 \fB\-\-conservative\fR
 If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated\.
+.TP
+\fB\-\-cooldown=<number>\fR
+Only consider gem versions published at least \fInumber\fR days ago when resolving\. Pass \fB0\fR to disable cooldown for this run, overriding any per\-source or global configuration\. See \fBcooldown\fR in bundle\-config(1)\.
 .SH "UPDATING ALL GEMS"
 If you run \fBbundle lock\fR with \fB\-\-update\fR option without list of gems, bundler will ignore any previously installed gems and resolve all dependencies again based on the latest versions of all gems available in the sources\.
 .SH "UPDATING A LIST OF GEMS"

bundler/lib/bundler/man/bundle-lock.1.ronn

@@ -20,6 +20,7 @@ bundle-lock(1) -- Creates / Updates a lockfile without installing
               [--pre]
               [--strict]
               [--conservative]
+              [--cooldown=NUMBER]
 
 ## DESCRIPTION
 
@@ -84,6 +85,11 @@ Lock the gems specified in Gemfile.
 * `--conservative`:
   If updating, use bundle install conservative update behavior and do not allow shared dependencies to be updated.
 
+* `--cooldown=<number>`:
+  Only consider gem versions published at least <number> days ago when
+  resolving. Pass `0` to disable cooldown for this run, overriding any
+  per-source or global configuration. See `cooldown` in bundle-config(1).
+
 ## UPDATING ALL GEMS
 
 If you run `bundle lock` with `--update` option without list of gems, bundler will

bundler/lib/bundler/man/bundle-plugin.1

@@ -71,6 +71,6 @@ Describe subcommands or one specific subcommand\.
 No options\.
 .SH "SEE ALSO"
 .IP "\(bu" 4
-How to write a Bundler plugin \fIhttps://bundler\.io/guides/bundler_plugins\.html\fR
+How to write a Bundler plugin \fIhttps://guides\.rubygems\.org/bundler_plugins/\fR
 .IP "" 0
 

bundler/lib/bundler/man/bundle-plugin.1.ronn

@@ -81,4 +81,4 @@ No options.
 
 ## SEE ALSO
 
-* [How to write a Bundler plugin](https://bundler.io/guides/bundler_plugins.html)
+* [How to write a Bundler plugin](https://guides.rubygems.org/bundler_plugins/)

bundler/lib/bundler/man/bundle.1

@@ -8,7 +8,7 @@
 .SH "DESCRIPTION"
 Bundler manages an \fBapplication's dependencies\fR through its entire life across many machines systematically and repeatably\.
 .P
-See the bundler website \fIhttps://bundler\.io\fR for information on getting started, and Gemfile(5) for more information on the \fBGemfile\fR format\.
+See the RubyGems guides \fIhttps://guides\.rubygems\.org/\fR for information on getting started, and Gemfile(5) for more information on the \fBGemfile\fR format\.
 .SH "OPTIONS"
 .TP
 \fB\-\-no\-color\fR

bundler/lib/bundler/man/bundle.1.ronn

@@ -10,7 +10,7 @@ bundle(1) -- Ruby Dependency Management
 Bundler manages an `application's dependencies` through its entire life
 across many machines systematically and repeatably.
 
-See [the bundler website](https://bundler.io) for information on getting
+See [the RubyGems guides](https://guides.rubygems.org/) for information on getting
 started, and Gemfile(5) for more information on the `Gemfile` format.
 
 ## OPTIONS