Cooldown drops the locked version of a gem named in bundle lock --update or bundle update

オープン
  • 何か問題がありますか？
#10,015 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@senid231 がすでに取り組んでいます。

2026年11月3日 から。

  • #10016 @senid231 による — オープン

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
ruby
領域
backend, devtools

調査の方向性

Start with the cooldown handling for locked versions and compare the named-gem path with the full bundle lock --update behavior described in the issue, including the related context in #9619. Reproduce with the Gemfile and commands in the report; done means updating a named gem can keep its locked version when all newer candidates are within the cooldown, while still preventing it from moving to a version inside the window.

索引モデルが issue の本文から書いたものです。

説明

Describe the problem as clearly as you can

When a gem is named on the command line, cooldown removes its locked version from the candidates. If no older version meets the requirements, resolution fails, even though keeping the locked version adopts nothing new.

A full bundle lock --update unlocks the same gem and passes, because #9619 exempts lockfile versions there. #9619 kept named gems under the cooldown on purpose, so a named gem cannot move to a version inside the window. It also stops a named gem from staying where it is.

This breaks tools that name transitive gems to unlock them. Dependabot's Bundler helper builds Bundler::Definition.build(gemfile, lockfile, gems: [dependency, *subdependencies], conservative: true). Every update then fails with this error until the fresh transitive gem leaves the window.

Did you try upgrading rubygems & bundler?

Yes. It fails on Bundler 4.0.15 through 4.0.23 and on 4.1.0.beta3, with Ruby 4.0.7.

Post steps to reproduce the problem

loofah 2.25.3 and rails-html-sanitizer 1.7.2 were published on 2026-11-02, so with cooldown: 30 this reproduces until 2026-12-02.

# Gemfile
source "https://rubygems.org", cooldown: 30

gem "rails-html-sanitizer", "1.7.2" # requires loofah >= 2.25.3

BUNDLE_COOLDOWN=0 bundle lock   # locks loofah 2.25.3
bundle lock --update loofah     # fails
Which command did you run?

bundle lock --update loofah. bundle update loofah and --conservative fail the same way.

What were you expecting to happen?

Bundler keeps loofah 2.25.3, the locked version, and the lockfile doesn't change. The cooldown should stop a named gem from moving to a version inside the window, not from staying at the version it already has.

What happened instead?
Could not find compatible versions

Because rails-html-sanitizer >= 1.7.2 depends on loofah >= 2.25.3, < 3.A
and loofah >= 2.25.3, < 3.A could not be found in rubygems repository
https://rubygems.org/ or installed locally for any resolution platforms (...)
(1 version excluded by the cooldown setting; pass `--cooldown 0` to bypass),
  rails-html-sanitizer >= 1.7.2 cannot be used.
So, because Gemfile depends on rails-html-sanitizer = 1.7.2,
  version solving has failed.

Results for the same lockfile:

Bundler lock --update crass (unnamed) --update loofah --update loofah --conservative --update (all)
4.0.13 ok ok ok ok fail
4.0.14 ok fail fail fail ok
4.0.15 to 4.0.23 ok ok fail fail ok
4.1.0.beta3 ok ok fail fail ok

Related: #9613, #9619, #9603.

主要言語
Ruby
スター
4k
フォーク
2k
平均マージ
1日 11時間
マージ済み PR（30日）
48

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

ruby/rubygems のほかの issue

ruby/rubygems の issue をすべて見る

似ている issue

Ruby の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。