Skip to content

Backport 9614 to 4.0#9621

Open
hsbt wants to merge 3 commits into
4.0from
backport-9614-to-4.0
Open

Backport 9614 to 4.0#9621
hsbt wants to merge 3 commits into
4.0from
backport-9614-to-4.0

Conversation

@hsbt

@hsbt hsbt commented Jun 12, 2026

Copy link
Copy Markdown
Member

Backport of #9620 to the 4.0 branch, fixing #9614.

Make sure the following tasks are checked

hsbt and others added 2 commits June 12, 2026 13:47
An inert placeholder source that stands in for a plugin source whose
handling plugin is not loaded, so that a lockfile referencing it can
still be parsed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Third-party tools like bundler-audit read lockfiles through
Bundler::LockfileParser without evaluating the Gemfile, and a PLUGIN
SOURCE block whose plugin isn't installed locally aborted the whole
parse with UnknownSourceError, taking even DEPENDENCIES down with it.
Fall back to the inert UnloadedSource placeholder instead, which also
lets bundle install converge away a plugin source that was removed
from the Gemfile.

#9614

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings June 12, 2026 04:56

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR backports the fix from #9620 onto the 4.0 branch to ensure Bundler::LockfileParser can parse lockfiles containing PLUGIN SOURCE entries even when the corresponding source plugin is not installed locally (addressing #9614).

Changes:

  • Add Bundler::Plugin::UnloadedSource as an inert placeholder for plugin-handled sources when the plugin isn’t available.
  • Update Bundler::Plugin.from_lock to fall back to UnloadedSource instead of raising UnknownSourceError during lockfile parsing.
  • Add specs to cover the new fallback behavior in both Plugin.from_lock and LockfileParser.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file
File Description
Manifest.txt Includes the newly added unloaded_source.rb file in the manifest.
bundler/lib/bundler/plugin.rb Makes from_lock return UnloadedSource when a plugin source type isn’t installed.
bundler/lib/bundler/plugin/unloaded_source.rb Adds placeholder source class with ==/hash including source type.
bundler/spec/bundler/plugin_spec.rb Adds unit coverage for Plugin.from_lock fallback to UnloadedSource.
bundler/spec/bundler/lockfile_parser_spec.rb Adds integration coverage ensuring parsing continues and specs/deps are readable.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants