Update dependency bundler to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
bundler (source, changelog)	"~> 2.3" → "~> 4.0"

---

Release Notes

ruby/rubygems (bundler)

v4.0.17

Compare Source

Enhancements:

• Validate spec name before writing to the spec cache. Pull request #​9690 by hsbt
• Installs bundler 4.0.17 as a default gem.

Bug fixes:

• Unquote Gem.ruby when spawning it as a separate argv element. Pull request #​9695 by hsbt
• Escape glob metacharacters in install paths when globbing. Pull request #​9687 by hsbt
• Preserve Windows editor paths in gem open and bundle open. Pull request #​9694 by hsbt
• Preserve Windows paths in MAKE and rake environment variables. Pull request #​9693 by hsbt
• Fix bundle binstub broken by gem update --system on Homebrew ruby. Pull request #​9688 by hsbt

v4.0.16

Compare Source

Enhancements:

• Installs bundler 4.0.16 as a default gem.

Bug fixes:

• Skip the make job server when using BSD make. Pull request #​9676 by flavorjones

v4.0.15

Compare Source

Enhancements:

• Rubygems: Fix Gem::Request for PQC support, adding integration connection tests. Pull request #​9615 by junaruga
• Reduce peak memory usage of full index loading and bundle install. Pull request #​9618 by hsbt
• Installs bundler 4.0.15 as a default gem.

Bug fixes:

• Forward security policy to old-format gems. Pull request #​9611 by hsbt

v4.0.14

Compare Source

Enhancements:

• Add executables and bindir validation to the gem installer. Pull request #​9595 by hsbt
• Strip C1 control characters from displayed gem text. Pull request #​9597 by hsbt
• Installs bundler 4.0.14 as a default gem.

v4.0.13

Compare Source

Enhancements:

• Prevent extraction from escaping destination_dir via pre-existing symlinks. Pull request #​9493 by thesmartshadow
• Close stdin immediately when using popen2e. Pull request #​9540 by rwstauner
• Fallback to copy symlinks on Windows. Pull request #​9296 by larskanis
• Installs bundler 4.0.13 as a default gem.

v4.0.12

Compare Source

Enhancements:

• Remove cygwin from WIN_PATTERNS. Pull request #​9527 by fd00
• Installs bundler 4.0.12 as a default gem.

Bug fixes:

• Fall back to lockfile version when BUNDLE_VERSION is "lockfile". Pull request #​9545 by hsbt
• Read BUNDLE_VERSION env var in BundlerVersionFinder. Pull request #​9538 by hsbt

v4.0.11

Compare Source

Enhancements:

• Add commented-out rubygems_mfa_required to bundle gem template. Pull request #​9487 by MatheusRich
• Clarify the name and meaning of the first argument to gem spec. Pull request #​9476 by eregon
• Installs bundler 4.0.11 as a default gem.

v4.0.10

Compare Source

Enhancements:

• Ignore warnings with spec different platforms. Pull request #​8508 by hsbt
• Better algorithm for sorting gem version. Pull request #​9421 by Edouard-chin
• Update SPDX license list as of 2026-02-20. Pull request #​9434 by hsbt
• Installs bundler 4.0.10 as a default gem.

Bug fixes:

• Register native extension files in default spec map. Pull request #​9431 by hsbt
• Fix NoMethodError in Gem.try_activate when activation conflicts occur. Pull request #​9404 by hsbt

v4.0.9

Compare Source

Enhancements:

• Fix: include owner role in gem owner. Pull request #​9403 by gjtorikian
• Installs bundler 4.0.9 as a default gem.

Bug fixes:

• Fix: Ensure trailing slash is added to source URIs added via gem sources. Pull request #​9055 by zirni

Documentation:

• [DOC] Fix link. Pull request #​9409 by BurdetteLamar

v4.0.8

Compare Source

Enhancements:

• Use JSON for cargo metadata parsing. Pull request
  #​9373 by hsbt
• Fix NameError in Gem::Request.get_proxy_from_env when requiring
  rubygems/request directly. Pull request
  #​9362 by afurm
• Installs bundler 4.0.8 as a default gem.

Documentation:

• Unify Compact Index API naming. Pull request
  #​9372 by simi

v4.0.7

Compare Source

Enhancements:

• Add Gem.disable_system_update_message in setup.rb. Pull request
  #​9020 by hyuraku
• Print message when signing in with an existing API key. Pull request
  #​9312 by hsbt
• Installs bundler 4.0.7 as a default gem.

Documentation:

• Document gemspecs must be deterministic. Pull request
  #​9321 by fxn
• Remove "##" from a comment to require. Pull request
  #​9306 by tompng

v4.0.6

Compare Source

Enhancements:

• Update vendored resolv to 0.7.0. Pull request
  #​9298 by hsbt
• Installs bundler 4.0.6 as a default gem.

v4.0.5

Compare Source

Enhancements:

• Removed unused deprecate loading. Pull request
  #​9266 by hsbt
• Validate executable names for invalid characters. Pull request
  #​9257 by hsbt
• Installs bundler 4.0.5 as a default gem.

Bug fixes:

• Fix RubyGems not able to require the right gem:. Pull request
  #​9246 by Edouard-chin
• Remove special behavior for rake. Pull request
  #​9245 by JasonLunn

Documentation:

• Added another usage of pristine command. Pull request
  #​9255 by hsbt

v4.0.4

Compare Source

Enhancements:

• Remove date require from rebuild command. Pull request
  #​9232 by jeremyevans
• Installs bundler 4.0.4 as a default gem.

Bug fixes:

• Add a missing "require 'etc'" statement:. Pull request
  #​9242 by Edouard-chin

v4.0.3

Compare Source

Enhancements:

• Installs bundler 4.0.3 as a default gem.

Documentation:

• Fix broken documentation links. Pull request
  #​9208 by eileencodes

v4.0.2

Compare Source

Enhancements:

• Pass down value of BUNDLE_JOBS to RubyGems before compiling &
  introduce a new gem install -j flag. Pull request
  #​9171 by Edouard-chin
• Installs bundler 4.0.2 as a default gem.

v4.0.1

Compare Source

Enhancements:

• Installs bundler 4.0.16 as a default gem.

Bug fixes:

• Skip the make job server when using BSD make. Pull request #​9676 by flavorjones

v4.0.0

Compare Source

Features:

• Undeprecate Gem::Version.new(nil). Pull request
  #​9086 by tenderlove
• Add pattern matching support to Gem::NameTuple. Pull request
  #​9064 by baweaver
• Add pattern matching support to Gem::Platform. Pull request
  #​9062 by baweaver

Performance:

• Add MAKEFLAGS=-j by default before compiling. Pull request
  #​9131 by Edouard-chin
• Remove some memoization. Pull request
  #​9017 by tenderlove
• Pull Gem.win_platform? out of a hot path. Pull request
  #​8983 by tenderlove
• Stop trying to remove every file on extraction. Pull request
  #​8974 by tenderlove
• Use IO.copy_stream with IO object directly. Pull request
  #​8970 by tenderlove
• Pass a file size to IO.copy_stream. Pull request
  #​8966 by tenderlove
• Use File#chmod rather than FileUtils.chmod. Pull request
  #​8965 by tenderlove

Enhancements:

• Update all vendored libraries to latest version. Pull request
  #​9089 by hsbt
• Removed unused Gem::Deprecate. Pull request
  #​9090 by hsbt
• Add debug logging information to see the time it took to download and
  install a gem. Pull request
  #​9066 by Edouard-chin
• Fix constants in TAR to be frozen. Pull request
  #​9041 by tenderlove
• Remove open-ended and prerelease dependency warnings when building gems.
  Pull request #​9050 by
  jeremyevans
• Revamp CmakeBuilder. Pull request
  #​8753 by cfis
• Restrict what schemes are acceptable in the remote fetcher. Pull request
  #​9022 by tenderlove
• gem sources --prepend and --append allow finer grained control of
  sources. Pull request #​8901
  by martinemde
• Improve gem sources --remove output. Pull request
  #​8909 by deivid-rodriguez
• Make gem sources output more clear. Pull request
  #​8938 by deivid-rodriguez
• Don't fail if there is no makefile, simply don't do anything. Pull
  request #​8879 by ioquatix
• Use IMDSv2 for S3 instance credentials. Pull request
  #​7709 by folbricht-stripe
• Fix regression in presence of RVM gems. Pull request
  #​8854 by deivid-rodriguez
• Restore parsing "--" as an unknown platform rather than crashing. Pull
  request #​8846 by
  deivid-rodriguez
• Installs bundler 4.0.0 as a default gem.

Bug fixes:

• Fix test failure of mswin and nmake. Pull request
  #​9135 by hsbt
• Respect BUNDLE_VERSION config at Gem::BundlerVersionFinder. Pull
  request #​9106 by hsbt
• Fix "did you mean" suggestions for unknown commands. Pull request
  #​8948 by deivid-rodriguez
• Fix trailing slashes not considered by gem sources --remove. Pull
  request #​8939 by
  deivid-rodriguez

Security:

• Bump up vendored URI to 1.0.4. Pull request
  #​9031 by hsbt

Breaking changes:

• Removed deprecated -C option from gem build. Pull request
  #​9088 by hsbt
• Removed deprecated Gem::Specification#has_rdoc, has_rdoc= and has_rdoc?.
  Pull request #​9084 by hsbt
• Removed deprecated gem query command. Pull request
  #​9083 by hsbt
• Removed deprecated Gem::DependencyInstaller#find_gems_with_sources. Pull
  request #​9082 by hsbt
• Remove deprecated methods of RubyGems. Pull request
  #​9081 by hsbt
• Make verification methods private. Pull request
  #​9051 by tenderlove
• Deprecate --default option from install command. Pull request
  #​7588 by hsbt
• Removed compatibility.rb for RG 4.0. Pull request
  #​8899 by hsbt

Deprecations:

• Deprecate Gem::Specification#datadir. Pull request
  #​8900 by hsbt

Documentation:

• Unified UPGRADING.md and extract blog.rubygems.org. Pull request
  #​9148 by hsbt
• Remove italic formatting from changelog section headers. Pull request
  #​9128 by hsbt
• [DOC] Fix the location of Gem::Deprecate document. Pull request
  #​9065 by nobu
• Fix typo. Pull request
  #​9012 by etiennebarrie
• Added document for Gem::Uninstaller. Pull request
  #​8904 by hsbt
• Use mailto link in Code of Conduct. Pull request
  #​8849 by deivid-rodriguez
• Update Code of Conduct email to conduct@rubygems.org. Pull request
  #​8848 by indirect

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.