ruby / ruby/rubygems

`bundle update` ignoring the `bundler` version specified by `BUNDLED WITH`

Open
#8,302 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bundler
Dominant language
Ruby
Stars
4k
Forks
1.9k
Avg merge
1d 2h
Merged PRs (30d)
81

Description

Describe the problem as clearly as you can

When running bundle update with a different version of bundler on the system than the one used to generate the lock file, bundler will ignore the BUNDLED WITH variable, proceed the update, and update the BUNDLED WITH variable to the current version of bundler present on the system.

That's a different behavior than when specifying the bundler version in the Gemfilewith gem "bundler", "= X.X.X" where it will raise an exception and seems to not align with https://github.com/duckinator/rfcs/blob/bundler-version-locking/text/0000-bundler-version-locking.md.

This can cause issue in automated workflow that upgrade dependencies (eg: renovate) where the actions will use the bundler version shipped with ruby, and will go straight to bundle update without running bundle install.

What were you expecting to happen?

I would have expected two scenarios:

  • either bundle update is aligned with bundle install and installs the required version of bundler automatically
  • or it's aligned with the behavior when the version is specified in the Gemfile (raising an exception).
What actually happened?

https://github.com/user-attachments/assets/92b0bae1-e353-47d4-9bf5-d3cb731ce248

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce bundle update with a Bundler version different from the one recorded under BUNDLED WITH in the lock file. Compare its behavior with bundle install and with a Gemfile-pinned Bundler version, then verify that the selected behavior preserves or correctly updates BUNDLED WITH and handles automated dependency-update workflows.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.