Cooldown drops the locked version of a gem named in bundle lock --update or bundle update
Los mantenedores suelen responder en 1 día
Evaluación
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Aptitud para principiantes
- 35/100
Línea de trabajo
Start with the cooldown handling for locked versions and compare the named-gem path with the full bundle lock --update behavior described in the issue, including the related context in #9619. Reproduce with the Gemfile and commands in the report; done means updating a named gem can keep its locked version when all newer candidates are within the cooldown, while still preventing it from moving to a version inside the window.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Describe the problem as clearly as you can
When a gem is named on the command line, cooldown removes its locked version from the candidates. If no older version meets the requirements, resolution fails, even though keeping the locked version adopts nothing new.
A full bundle lock --update unlocks the same gem and passes, because #9619 exempts lockfile versions there. #9619 kept named gems under the cooldown on purpose, so a named gem cannot move to a version inside the window. It also stops a named gem from staying where it is.
This breaks tools that name transitive gems to unlock them. Dependabot's Bundler helper builds Bundler::Definition.build(gemfile, lockfile, gems: [dependency, *subdependencies], conservative: true). Every update then fails with this error until the fresh transitive gem leaves the window.
Did you try upgrading rubygems & bundler?
Yes. It fails on Bundler 4.0.15 through 4.0.23 and on 4.1.0.beta3, with Ruby 4.0.7.
Post steps to reproduce the problem
loofah 2.25.3 and rails-html-sanitizer 1.7.2 were published on 2026-11-02, so with cooldown: 30 this reproduces until 2026-12-02.
# Gemfile
source "https://rubygems.org", cooldown: 30
gem "rails-html-sanitizer", "1.7.2" # requires loofah >= 2.25.3
BUNDLE_COOLDOWN=0 bundle lock # locks loofah 2.25.3
bundle lock --update loofah # fails
Which command did you run?
bundle lock --update loofah. bundle update loofah and --conservative fail the same way.
What were you expecting to happen?
Bundler keeps loofah 2.25.3, the locked version, and the lockfile doesn't change. The cooldown should stop a named gem from moving to a version inside the window, not from staying at the version it already has.
What happened instead?
Could not find compatible versions
Because rails-html-sanitizer >= 1.7.2 depends on loofah >= 2.25.3, < 3.A
and loofah >= 2.25.3, < 3.A could not be found in rubygems repository
https://rubygems.org/ or installed locally for any resolution platforms (...)
(1 version excluded by the cooldown setting; pass `--cooldown 0` to bypass),
rails-html-sanitizer >= 1.7.2 cannot be used.
So, because Gemfile depends on rails-html-sanitizer = 1.7.2,
version solving has failed.
Results for the same lockfile:
| Bundler | lock |
--update crass (unnamed) |
--update loofah |
--update loofah --conservative |
--update (all) |
|---|---|---|---|---|---|
| 4.0.13 | ok | ok | ok | ok | fail |
| 4.0.14 | ok | fail | fail | fail | ok |
| 4.0.15 to 4.0.23 | ok | ok | fail | fail | ok |
| 4.1.0.beta3 | ok | ok | fail | fail | ok |
Related: #9613, #9619, #9603.
- Lenguaje dominante
- Ruby
- Estrellas
- 4k
- Forks
- 2k
- Merge medio
- 1 d 17 h
- PR fusionados (30 d)
- 50
Preparar el entorno
Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de ruby/rubygems
-
Bundler 4.0.x fails on Ruby 4.1 when .bundle/config is "---"Posiblemente ocupada Un pull request vinculado a esta issue está abierto o ya se fusionó. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 73/100
Los mantenedores suelen responder en 1 día
-
Profiling `require "bundler/setup"` in a 450-gem app: 13 findings, a series of small PRsPosiblemente ocupada Un pull request vinculado a esta issue está abierto o ya se fusionó. Abierto
Dificultad 4/5 3-5 días Aptitud para principiantes 15/100
Los mantenedores suelen responder en 1 día
-
Gem::Package::TarReader silently ignores pax/GNU extension headersPosiblemente ocupada @akasakariko la tomó hace 8 días. AbiertoRubyGems
Dificultad 3/5 1-2 días Aptitud para principiantes 55/100
ruby/rubygems#9988 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
`Gem::Version.new`, `#bump`, and `#release` do not work in ractorPosiblemente ocupada @mmporong la tomó hace 12 días. AbiertoRubyGems
Dificultad 3/5 Medio día Aptitud para principiantes 55/100
Los mantenedores suelen responder en 1 día
-
Gem.load_plugins loads same plugin multiple times from different Gem.path entriesPosiblemente ocupada @sourya2704 la tomó hace 13 días. Abierto
Dificultad 5/5 Más de una semana Aptitud para principiantes 25/100
ruby/rubygems#9945 · 4 comentarios · 3 reacciones ·
Los mantenedores suelen responder en 1 día
Todos los issues de ruby/rubygems
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
openhab/openhab-jruby#571 ·
-
Bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
chatwoot/chatwoot#16591 · 1 comentario ·
Los mantenedores suelen responder en 2 días
-
Tags Listing Shows Paging CountAbiertogood first issue User Interface
Dificultad 2/5 1-3 horas Aptitud para principiantes 64/100
rubyforgood/skillrx#740 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
rubys/roundhouse#1917 ·
-
Store credit application selects a payment method from another storePosiblemente ocupada @beobungbu la tomó hoy. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
Los mantenedores suelen responder en 1 día