`bundle update` ignoring the `bundler` version specified by `BUNDLED WITH`
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 4k
- Forks
- 1.9k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 81
Description
Describe the problem as clearly as you can
When running bundle update with a different version of bundler on the system than the one used to generate the lock file, bundler will ignore the BUNDLED WITH variable, proceed the update, and update the BUNDLED WITH variable to the current version of bundler present on the system.
That's a different behavior than when specifying the bundler version in the Gemfilewith gem "bundler", "= X.X.X" where it will raise an exception and seems to not align with https://github.com/duckinator/rfcs/blob/bundler-version-locking/text/0000-bundler-version-locking.md.
This can cause issue in automated workflow that upgrade dependencies (eg: renovate) where the actions will use the bundler version shipped with ruby, and will go straight to bundle update without running bundle install.
What were you expecting to happen?
I would have expected two scenarios:
- either
bundle updateis aligned withbundle installand installs the required version ofbundlerautomatically - or it's aligned with the behavior when the version is specified in the
Gemfile(raising an exception).
What actually happened?
https://github.com/user-attachments/assets/92b0bae1-e353-47d4-9bf5-d3cb731ce248
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce bundle update with a Bundler version different from the one recorded under BUNDLED WITH in the lock file. Compare its behavior with bundle install and with a Gemfile-pinned Bundler version, then verify that the selected behavior preserves or correctly updates BUNDLED WITH and handles automated dependency-update workflows.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100