GeezerVison

Assisted-by: Claude Code:claude-opus-5-5

Hosted mode wired the wrong gem files in two Bundler layouts, so the
scan reported success (and its VEX attested a patch) while Bundler
installed the unpatched gem or frozen installs failed:

- Bundler 4's custom lockfile (BUNDLE_LOCKFILE, env or .bundle/config)
  was ignored, so the lock Bundler reads was never pinned (#749). A
  lockfile naming anything but the pair's own default lock is now
  refused in hosted (redirect_gem_bundle_lockfile_unsupported) and
  vendored (gemfile_not_loaded) mode before any write.
- A Gemfile + gems.rb twin always followed Bundler >= 2 and wired
  gems.rb, but Bundler 1.x loads the Gemfile (#751). A twin whose locks
  say BUNDLED WITH 1.x is now wired through the Gemfile pair, and twin
  locks that disagree on the major are refused
  (redirect_gem_twin_bundler_versions_diverge).

Assisted-by: Claude Code:claude-opus-5-5

Two host capstones in e2e_redirect_gem_build: a Bundler 4 project with
`lockfile custom.lock` (and a leftover Gemfile.lock) redirects and
attests nothing and still installs frozen (#749), and a Bundler 1.x
Gemfile + gems.rb twin is wired through the Gemfile and a fresh
checkout installs the patched gem (#751). Each skips on the Bundler
line it does not apply to.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Release notes are written when a release is cut, from the merged PR
log and the code, so PRs no longer edit CHANGELOG.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Resolve the overlap with #577 (Bundler global config, #621): classify
gained the global tier, so with_lockfile takes it too. Bundler 4 reads
`lockfile` through Bundler.settings, which includes ~/.bundle/config,
so `bundle config set --global lockfile custom.lock` is now refused like
the env and app-config spellings instead of slipping past #749's guard.
BundlerEnv carries the global config path; main's positional
bundler_loaded_manifest_with_env call sites move to it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_018ULgrJMQMWEBAsiuprY449

…pair-model

#605 taught the name-keyed npm resolver to probe bundled store
trees, so it now finds aliased copies (node_modules/lp) and a nested
host's store peers itself. Two vex_consumed tests from #738 assumed
that set never held aliases, so main's CI went red after both merged.

The tests now feed the alias-free set explicitly to keep covering
alias expansion, and also check the resolver's own set reaches the
same copies with no duplicates. No production code changes.

Assisted-by: Claude Code:claude-opus-5-5
(cherry picked from commit 40dac07)

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Conflicts resolved:
- ruby_crawler.rs: kept this branch's BundlerEnv and main's (#736)
  bundler_loaded_manifest_in / bundler_loaded_lock_in. The memory branch
  of bundler_loaded_manifest_in now also layers BUNDLE_LOCKFILE
  (with_lockfile), and bundler_loaded_lock_in follows the #751 twin rule
  (Gemfile.lock for a bundler-1.x twin, no lock for a twin whose locks
  disagree on the major), so the lock readers main routed through it
  (inventory, ledger recovery, VEX) agree with the pair the rewriter wires.
- hosted/engine.rs: keep_bundler_loaded_gem_files uses main's shared
  resolver plus this branch's twin/lockfile handling.
- vex/discover/gem.rs: the "no loaded lock" diagnostic no longer blames
  only BUNDLE_GEMFILE.
- CLI_CONTRACT.md: both texts (main's Gradle confirmation sentence and this
  branch's new gem refusal codes).
- e2e_redirect_gem_build.rs: both sets of Driver variants.
- hosted_memory_engine.rs: both sets of tests. Since #736 the memory
  engine finds gem candidates only through the lock bundler loads, so a
  custom BUNDLE_LOCKFILE or a twin with diverging bundler majors yields
  no gem candidate (same as an unsupported BUNDLE_GEMFILE on main); those
  two tests now assert nothing is redirected/written, and the refusal
  warnings are covered by new engine unit tests.

Co-Authored-By: Claude <[email protected]>

Resolves the CLI_CONTRACT.md conflict by keeping main's new
redirect.patches[] text and this branch's two gem warning codes.

Assisted-by: Claude Code:claude-opus-5-5

Upstream moved setup-php's v2 tag, so the "# v2" comment on the
2.37.2 commit pin now fails the Audit GitHub Actions check
(ref-version-mismatch). Same change as #1118.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

A Gemfile + gems.rb twin whose other spelling is a symlink, an
unreadable file or not UTF-8 was not seen as a twin by hosted mode,
so the readable pair was still pinned although Bundler 2+ loads
gems.rb. Lock inventory already counted such a twin and warned
gem_lock_unsupported, so the scan both warned and rewrote. The twin
check now counts every spelling Bundler sees, readable or not.

Found by Bugbot on #768.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

A Gemfile + gems.rb twin whose second spelling is a regular file the
scan cannot read (permission denied, I/O error) left no trace in the
read lists, so hosted mode still pinned the readable pair. The twin
check now also asks the project view whether the file exists, the
same File.file? test lock inventory uses.

Found by Bugbot on #768.

Assisted-by: Claude Code:claude-opus-5-5

Hosted file-set scans see a git symlink Gemfile or gems.rb as a
symlink marker with no target. Lock inventory took that as absent, so
a Gemfile + gems.rb twin was inventoried from the regular spelling's
lock with no gem_lock_unsupported warning, although Bundler follows
the link and may load the other pair. The twin check now fails closed
on a symlinked spelling.

Found by the security review on #768.

Assisted-by: Claude Code:claude-opus-5-5

cursor Bot left a comment