GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1989

Summary

Hosted gem rollback / remove no longer turn a gem reached only through a Bundler 4.1 override "other", with: "gem", in: "parent" into a new exact top-level pin. The Gemfile and Gemfile.lock now come back byte for byte, as they do for an ordinary transitive gem. Before this fix, the stray gem "vuln-gem", "1.0.0" pin blocked the project from updating past the vulnerable version.

Root cause

restore_one (crates/socket-patch-core/src/patch/redirect/upstream/gem.rs) only treats the appended Socket block as a transitive gem's when is_subdependency finds another locked spec depending on the gem. It checked only 6-space spec sub-lines. A Bundler 4.1 dependency override keeps the parent's original edge in the specs (parent (1.0.0) → other-dep) and records the replacement only in the lock's new OVERRIDES section. No sub-line names the gem, so the restore took the Decl::Direct arm.

Change

• is_subdependency also counts the with: target of any OVERRIDES entry, via a small override_targets reader.
• The reader parses the form Bundler writes (Override#to_lock joins inspected values with , ). That covers version: requirements containing , , and with: nil yields no target.
• Module docs for the provably-transitive rule now mention the OVERRIDES source.
• Vendored revert is unaffected: it records the pre-vendor DEPENDENCIES entry rather than inferring it. No wrapper (npm/, pypi/, gem/) changes are needed.

Test evidence

• The fixture's OVERRIDES shape was checked against a real lock written by bundle _4.1.0.beta3_ lock for the issue's Gemfile. It has the same section position and entry format.
• cargo fmt --all -- --check: clean.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo test -p socket-patch-core --all-features --lib: 6997 passed, 4 failed. The 4 also fail on unmodified main in this sandbox, because it runs as root (copy_tree::relax_loop_must_not_traverse_symlinked_root, vlt_heal::an_unremovable_hidden_lock_keeps_every_store_entry, pypi_poetry::wire_write_failure_…, pypi_requirements::wire_failure_…; same as Build: share one test RNG across randomized tests (#1868) #1882 and Build: share one test env guard in core (#1889) #1891).
• cargo test -p socket-patch-cli --all-features --lib --bins: 940 passed.
• cargo test -p socket-patch-cli --all-features --test e2e_redirect_gem_build --test e2e_vendor_gem_build -- --ignored with real Ruby 3.3.6 and Bundler: 37 + 11 passed.
• The full cargo test --workspace ran out of this sandbox's disk allowance while linking the ~100 CLI integration binaries, so CI covers the rest.

Review findings not fixed (/code-review high)

• "override_targets only recognizes one serialization": Bundler 4.1 writes exactly one form. Override#to_lock is [target.inspect, "with: #{op.inspect}", "in: #{from.inspect}", ...].join(", "), and its own LOCK_LINE parser accepts only that form.
• "a stale in: parent still counts": the existing sub-line rule takes the same risk. Both are only a secondary guard behind provably_appended (an option-less block after a blank line that the in-place rewrite cannot produce).
• "no global override without in:": Bundler rejects with: without in: (add_dependency_override raises).
• "re-scans section ranges": this is one extra linear pass per restored gem, so it's negligible.

Follow-ups

• No e2e leg runs Bundler 4.1 yet: CI pins Bundler ≤ 4.0.21, and 4.1 is still a beta. Once a 4.1 leg is added, the issue's zz_parent_unwind scenario belongs in e2e_redirect_gem_build.

Generated by Claude Code