chore(deps): update dependency bundler to v2 [security]

[sc-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
bundler (source, changelog)	"~> 1.0" → "~> 2.2", ">= 2.2.33"

GitHub Vulnerability Alerts

CVE-2019-3881

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2021-43809

In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself. However, if the Gemfile includes gem entries that use the git option with invalid, but seemingly harmless, values with a leading dash, this can be false.

To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as git clone. These commands are being constructed using user input (e.g. the repository URL). When building the
commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (-) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables.

Since this value comes from the Gemfile file, it can contain any character, including a leading dash.

Exploitation

To exploit this vulnerability, an attacker has to craft a directory containing a Gemfile file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of -u./payload. This URL
will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as bundle lock, inside.

Impact

This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, as explained above, the exploitability is very low, because it requires a lot of user interaction. It still could put developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by manually reviewing the Gemfile (although they would need the weird URL with a leading dash to not raise any flags).

This kind of attack vector has been used in the past to target security researchers by sending them projects to collaborate on.

Patches

Bundler 2.2.33 has patched this problem by inserting -- as an argument before any positional arguments to those Git commands that were affected by this issue.

Workarounds

Regardless of whether users can upgrade or not, they should review any untrustred Gemfile's before running any bundler commands that may read them, since they can contain arbitrary ruby code.

References

https://cwe.mitre.org/data/definitions/88.html

Severity

• CVSS Score: 6.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CVE-2016-7954

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

---

Release Notes

ruby/rubygems (bundler)

v2.2.33

Compare Source

Deprecations:

• Deprecate typo name. Pull request #​5109 by nobu

Enhancements:

• Add login & logout alias for the signin & signout commands. Pull request
  #​5133 by colby-swandale
• Fix race conditions when reading & writing gemspecs concurrently. Pull
  request #​4408 by deivid-rodriguez
• Installs bundler 2.2.33 as a default gem.

Bug fixes:

• Fix ruby setup.rb trying to write outside of --destdir. Pull request
  #​5053 by deivid-rodriguez

Documentation:

• Move required_ruby_version gemspec attribute to recommended section.
  Pull request #​5130 by simi
• Ignore to generate the documentation from vendored libraries. Pull
  request #​5118 by hsbt

v2.2.32

Compare Source

Enhancements:

• Refactor installer thread safety protections. Pull request #​5050 by
  deivid-rodriguez
• Allow gem activation from operating_system.rb. Pull request #​5044 by
  deivid-rodriguez
• Installs bundler 2.2.32 as a default gem.

v2.2.31

Compare Source

Enhancements:

• Don't pass empty DESTDIR to nmake since it works differently from
  standard make. Pull request #​5057 by hsbt
• Fix gem install vs gem fetch inconsistency. Pull request #​5037 by
  deivid-rodriguez
• Lazily load and vendor optparse. Pull request #​4881 by
  deivid-rodriguez
• Use a vendored copy of tsort internally. Pull request #​5027 by
  deivid-rodriguez
• Install bundler 2.2.31 as a default gem.

Bug fixes:

• Fix ruby setup.rb when --prefix is passed. Pull request #​5051 by
  deivid-rodriguez
• Don't apply --destdir twice when running setup.rb. Pull request
  #​2768 by alyssais

v2.2.30

Compare Source

Enhancements:

• Add support to build and sign certificates with multiple key algorithms.
  Pull request #​4991 by doodzik
• Avoid loading the digest gem unnecessarily. Pull request #​4979 by
  deivid-rodriguez
• Prefer require_relative for all internal requires. Pull request #​4978
  by deivid-rodriguez
• Add missing require of time within
  Gem::Request.verify_certificate_message. Pull request #​4975 by nobu
• Install bundler 2.2.30 as a default gem.

Performance:

• Speed up gem install, specially under Windows. Pull request #​4960 by
  deivid-rodriguez

v2.2.29

Compare Source

Enhancements:

• Only disallow FIXME/TODO for first word of gemspec description. Pull
  request #​4937 by duckinator
• Install bundler 2.2.29 as a default gem.

Bug fixes:

• Fix wordy method in SourceFetchProblem changing the password of
  source. Pull request #​4910 by Huangxiaodui

Performance:

• Improve require performance, particularly on systems with a lot of
  gems installed. Pull request #​4951 by pocke

v2.2.28

Compare Source

Enhancements:

• Support MINGW-UCRT. Pull request #​4925 by hsbt
• Only check if descriptions start with FIXME/TODO. Pull request #​4841
  by duckinator
• Avoid loading uri unnecessarily when activating gems. Pull request
  #​4897 by deivid-rodriguez
• Install bundler 2.2.28 as a default gem.

Bug fixes:

• Fix redacted credentials being sent to gemserver. Pull request #​4919 by
  jdliss

v2.2.27

Compare Source

Enhancements:

• Redact credentials when printing URI. Pull request #​4868 by intuxicated
• Prefer require_relative to require for internal requires. Pull
  request #​4858 by deivid-rodriguez
• Prioritise gems with higher version for fetching metadata, and stop
  fetching once we find a valid candidate. Pull request #​4843 by intuxicated
• Install bundler 2.2.27 as a default gem.

v2.2.26

Compare Source

Enhancements:

• Enhance the error handling for loading the
  rubygems/defaults/operating_system file. Pull request #​4824 by
  intuxicated
• Ignore RUBYGEMS_GEMDEPS for the bundler gem. Pull request #​4532 by
  deivid-rodriguez
• Install bundler 2.2.26 as a default gem.

Bug fixes:

• Also load user installed rubygems plugins. Pull request #​4829 by
  deivid-rodriguez

v2.2.25

Compare Source

Enhancements:

• Don't load the base64 library since it's not used. Pull request #​4785
  by deivid-rodriguez
• Don't load the resolv library since it's not used. Pull request #​4784
  by deivid-rodriguez
• Lazily load shellwords library. Pull request #​4783 by deivid-rodriguez
• Check requirements class before loading marshalled requirements. Pull
  request #​4651 by nobu
• Install bundler 2.2.25 as a default gem.

Bug fixes:

• Add missing require 'fileutils' in Gem::ConfigFile. Pull request
  #​4768 by ybiquitous

v2.2.24

Compare Source

Enhancements:

• Install bundler 2.2.24 as a default gem.

Bug fixes:

• Fix contradictory message about deletion of default gem. Pull request
  #​4739 by jaredbeck

Documentation:

• Add a description about GEM_HOST_OTP_CODE to help text. Pull request
  #​4742 by ybiquitous

v2.2.23

Compare Source

Enhancements:

• Rewind IO source to allow working with contents in memory. Pull request
  #​4729 by drcapulet
• Install bundler 2.2.23 as a default gem.

v2.2.22

Compare Source

Enhancements:

• Allow setting --otp via GEM_HOST_OTP_CODE. Pull request #​4697 by
  CGA1123
• Fixes for the edge case when openssl library is missing. Pull request
  #​4695 by rhenium
• Install bundler 2.2.22 as a default gem.

v2.2.21

Compare Source

Enhancements:

• Fix typo in OpenSSL detection. Pull request #​4679 by osyoyu
• Add the most recent licenses from spdx.org. Pull request #​4662 by nobu
• Simplify setup.rb code to allow installing rubygems from source on
  truffleruby 21.0 and 21.1. Pull request #​4624 by deivid-rodriguez
• Install bundler 2.2.21 as a default gem.

Bug fixes:

• Create credentials folder when setting API keys if not there yet. Pull
  request #​4665 by deivid-rodriguez

v2.2.20

Compare Source

Security fixes:

• Verify platform before installing to avoid potential remote code
  execution. Pull request #​4667 by sonalkr132

Enhancements:

• Add better specification policy error description. Pull request #​4658 by
  ceritium
• Install bundler 2.2.20 as a default gem.

v2.2.19

Compare Source

Enhancements:

• Fix gem help build output format. Pull request #​4613 by tnir
• Install bundler 2.2.19 as a default gem.

v2.2.18

Compare Source

Enhancements:

• Don't leave temporary directory around when building extensions to
  improve build reproducibility. Pull request #​4610 by baloo
• Install bundler 2.2.18 as a default gem.

v2.2.17

Compare Source

Enhancements:

• Only print month & year in deprecation messages. Pull request #​3085 by
  Schwad
• Make deprecate method support ruby3's keyword arguments. Pull request
  #​4558 by mame
• Update the default bindir on macOS. Pull request #​4524 by nobu
• Prefer File.open instead of Kernel#open. Pull request #​4529 by mame
• Install bundler 2.2.17 as a default gem.

Documentation:

• Fix usage messages to reflect the current POSIX-compatible behaviour.
  Pull request #​4551 by graywolf-at-work

v2.2.16

Compare Source

Enhancements:

• Install bundler 2.2.16 as a default gem.

Bug fixes:

• Correctly handle symlinks. Pull request #​2836 by voxik

v2.2.15

Compare Source

Enhancements:

• Prevent downgrades to untested rubygems versions. Pull request #​4460 by
  deivid-rodriguez
• Install bundler 2.2.15 as a default gem.

Bug fixes:

• Fix missing require breaking gem cert. Pull request #​4464 by lukehinds

v2.2.14

Compare Source

Enhancements:

• Less wrapping of network errors. Pull request #​4064 by deivid-rodriguez
• Install bundler 2.2.14 as a default gem.

Bug fixes:

• Revert addition of support for musl variants to restore graceful
  fallback on Alpine. Pull request #​4434 by deivid-rodriguez

v2.2.13

Compare Source

Enhancements:

• Install bundler 2.2.13 as a default gem.

Bug fixes:

• Support non-gnu libc linux platforms. Pull request #​4082 by lloeki

v2.2.12

Compare Source

Enhancements:

• Install bundler 2.2.12 as a default gem.

Bug fixes:

• Restore the ability to manually install extension gems. Pull request
  #​4384 by cfis

v2.2.11

Compare Source

Enhancements:

• Optionally fallback to IPv4 when IPv6 is unreachable. Pull request #​2662
  by sonalkr132
• Install bundler 2.2.11 as a default gem.

v2.2.10

Compare Source

Enhancements:

• Install bundler 2.2.10 as a default gem.

Documentation:

• Add a gem push example to gem help. Pull request #​4373 by
  deivid-rodriguez
• Improve documentation for required_ruby_version. Pull request #​4343 by
  AlexWayfer

v2.2.9

Compare Source

Enhancements:

• Install bundler 2.2.9 as a default gem.

Bug fixes:

• Fix error message when underscore selection can't find bundler. Pull
  request #​4363 by deivid-rodriguez
• Fix Gem::Specification.stubs_for returning wrong named specs. Pull
  request #​4356 by tompng
• Don't error out when activating a binstub unless necessary. Pull request
  #​4351 by deivid-rodriguez
• Fix gem outdated incorrectly handling platform specific gems. Pull
  request #​4248 by deivid-rodriguez

v2.2.8

Compare Source

Enhancements:

• Install bundler 2.2.8 as a default gem.

Bug fixes:

• Fix gem install crashing on gemspec with nil required_ruby_version.
  Pull request #​4334 by pbernays

v2.2.7

Compare Source

Enhancements:

• Install bundler 2.2.7 as a default gem.

Bug fixes:

• Generate plugin wrappers with relative requires. Pull request #​4317 by
  deivid-rodriguez

v2.2.6

Compare Source

Enhancements:

• Fix Gem::Platform#inspect showing duplicate information. Pull request
  #​4276 by deivid-rodriguez
• Install bundler 2.2.6 as a default gem.

Bug fixes:

• Swallow any system call error in ensure_gem_subdirs to support jruby
  embedded paths. Pull request #​4291 by kares
• Restore accepting custom make command with extra options as the make
  env variable. Pull request #​4271 by terceiro

v2.2.5

Compare Source

Enhancements:

• Install bundler 2.2.5 as a default gem.

Bug fixes:

• Don't load more specs after the whole set of specs has been setup. Pull
  request #​4262 by deivid-rodriguez
• Fix broken bundler executable after gem update --system. Pull
  request #​4221 by deivid-rodriguez

v2.2.4

Compare Source

Enhancements:

• Use a CHANGELOG in markdown for rubygems. Pull request #​4168 by
  deivid-rodriguez
• Never spawn subshells when building extensions. Pull request #​4190 by
  deivid-rodriguez
• Install bundler 2.2.4 as a default gem.

Bug fixes:

• Fix fallback to the old index and installation from it not working. Pull
  request #​4213 by deivid-rodriguez
• Fix installing from source on truffleruby. Pull request #​4201 by
  deivid-rodriguez

v2.2.3

Compare Source

Deprecations:

• Deprecate typo name. Pull request #​5109 by nobu

Enhancements:

• Add login & logout alias for the signin & signout commands. Pull request
  #​5133 by colby-swandale
• Fix race conditions when reading & writing gemspecs concurrently. Pull
  request #​4408 by deivid-rodriguez
• Installs bundler 2.2.33 as a default gem.

Bug fixes:

• Fix ruby setup.rb trying to write outside of --destdir. Pull request
  #​5053 by deivid-rodriguez

Documentation:

• Move required_ruby_version gemspec attribute to recommended section.
  Pull request #​5130 by simi
• Ignore to generate the documentation from vendored libraries. Pull
  request #​5118 by hsbt

v2.2.2

Compare Source

Enhancements:

• Only disallow FIXME/TODO for first word of gemspec description. Pull
  request #​4937 by duckinator
• Install bundler 2.2.29 as a default gem.

Bug fixes:

• Fix wordy method in SourceFetchProblem changing the password of
  source. Pull request #​4910 by Huangxiaodui

Performance:

• Improve require performance, particularly on systems with a lot of
  gems installed. Pull request #​4951 by pocke

v2.2.1

Compare Source

Enhancements:

• Fix gem help build output format. Pull request #​4613 by tnir
• Install bundler 2.2.19 as a default gem.

v2.2.0

Compare Source

Enhancements:

• Do not override Kernel#warn when there is no need. Pull request #​4075 by
  eregon
• Update endpoint of gem signin command. Pull request #​3840 by sonalkr132
• Omit deprecated commands from command help output. Pull request #​4023 by
  landongrindheim
• Suggest alternatives in gem query deprecation. Pull request #​4021 by
  landongrindheim
• Lazily load time, cgi, and zlib. Pull request #​4010 by
  deivid-rodriguez
• Don't hit the network when installing dependencyless local gemspec. Pull
  request #​3968 by deivid-rodriguez
• Add --force option to gem sources command. Pull request #​3956 by
  andy-smith-msm
• Lazily load openssl. Pull request #​3850 by deivid-rodriguez
• Pass more information when comparing platforms. Pull request #​3817 by
  eregon
• Install bundler 2.2.0 as a default gem.

Bug fixes:

• Use better owner & group for files in rubygems package. Pull request
  #​4065 by deivid-rodriguez
• Improve gem build -C flag. Pull request #​3983 by bronzdoc
• Handle unexpected behavior with URI#merge and subpaths missing trailing
  slashes. Pull request #​3123 by drcapulet
• Add missing fileutils require in rubygems installer. Pull request
  #​4036 by deivid-rodriguez
• Fix --platform option to gem specification being ignored. Pull
  request #​4043 by deivid-rodriguez
• Expose --no-minimal-deps flag to install the latest version of
  dependencies. Pull request #​4030 by deivid-rodriguez
• Fix "stack level too deep" error when overriding Warning.warn. Pull
  request #​3987 by eregon
• Append '.gemspec' extension only when it is not present. Pull request
  #​3988 by voxik
• Install to correct plugins dir when using --build-root. Pull request
  #​3972 by deivid-rodriguez
• Fix --build-root flag under Windows. Pull request #​3975 by
  deivid-rodriguez
• Fix typo_squatting? false positive for rubygems.org itself. Pull
  request #​3951 by andy-smith-msm
• Make --default and --install-dir options to gem install play nice
  together. Pull request #​3906 by deivid-rodriguez

Deprecations:

• Deprecate server command. Pull request #​3868 by bronzdoc

Performance:

• Don't change ruby process CWD when building extensions. Pull request
  #​3498 by deivid-rodriguez

v2.1.4

Compare Source

Bug fixes:

• gem uninstall foo --all now force-uninstalls all versions of foo. Issue
  #​650 by Kyle (remkade).
• Fixed uninstalling gems installed in the home directory (as in
  --user-install). Issue #​653 by Lin Jen-Shin.

v2.1.3

Compare Source

Bug fixes:

• Gems with files entries starting with "./" no longer install 0 files. Issue
  #​644 by Darragh Curran, #​645 by Brandon Turner, #​646 by Alex Tambellini

v2.1.2

Compare Source

Bug fixes:

• Restore concurrent requires following the fix for ruby bug #​8374. Pull
  request #​637 and issue #​640 by Charles Nutter.
• Gems with extensions are now installed correctly when the --install-dir
  option is used. Issue #​642 by Lin Jen-Shin.
• Gem fetch now fetches the newest (not oldest) gem when --version is given.
  Issue #​643 by Brian Shirai.

v2.1.1

Bug fixes:

• Gem::Specification::remove_spec no longer checks for existence of the spec
  to be removed. Issue #​698 by Tiago Macedo.
• Restored wildcard handling when installing gems. Issue #​697 by Chuck Remes.
• Added DigiCert High Assurance EV Root CA certificate for the cloudfront.net
  certificate change.
• The Gem::RemoteFetcher tests now choose the test server port more reliably.
  Pull Request #​706 by akr.

v2.1.0

Enhancements:

• Try to use bundler-2.1.0.pre.2. Pull request #​2923 by SHIBATA Hiroshi.
• [Require] Ensure -I beats a default gem. Pull request #​1868 by Samuel
  Giddins.
• [Specification] Prefer user-installed gems to default gems. Pull request
  #​2112 by Samuel Giddins.
• Multifactor authentication for yank command. Pull request #​2514 by Qiu
  Chaofan.
• Autoswitch to exact bundler version if present. Pull request #​2583 by
  David Rodríguez.
• Fix Gem::Requirement equality comparison when ~> operator is used. Pull
  request #​2554 by Grey Baker.
• Don't use a proxy if https_proxy env var is empty. Pull request #​2567 by
  Luis Sagastume.
• Fix typo in specs warning. Pull request #​2585 by Rui.
• Bin/gem: remove initial empty line. Pull request #​2602 by Kenyon Ralph.
• Avoid rdoc hook when it's failed to load rdoc library. Pull request
  #​2604 by SHIBATA Hiroshi.
• Refactor get_proxy_from_env logic. Pull request #​2611 by Luis Sagastume.
• Allow to easily bisect flaky failures. Pull request #​2626 by David
  Rodríguez.
• Fix --ignore-dependencies flag not installing platform specific gems.
  Pull request #​2631 by David Rodríguez.
• Make gem install --explain list platforms. Pull request #​2634 by David
  Rodríguez.
• Make gem update --explain list platforms. Pull request #​2635 by David
  Rodríguez.
• Refactoring install and update explanations. Pull request #​2643 by David
  Rodríguez.
• Restore transitiveness of version comparison. Pull request #​2651 by
  David Rodríguez.
• Undo requirement sorting. Pull request #​2652 by David Rodríguez.
• Update dummy version of Bundler for #​2581. Pull request #​2584 by SHIBATA
  Hiroshi.
• Ignore to handle the different platform. Pull request #​2672 by SHIBATA
  Hiroshi.
• Make Gem::Specification.default_stubs to public methods. Pull request
  #​2675 by SHIBATA Hiroshi.
• Sort files and test_files in specifications. Pull request #​2524 by
  Christopher Baines.
• Fix comment of Gem::Specification#required_ruby_version=. Pull request
  #​2732 by Alex Junger.
• Config_file.rb - update path separator in ENV['GEMRC'] logic. Pull
  request #​2735 by MSP-Greg.
• Fix ruby setup.rb warnings. Pull request #​2737 by David Rodríguez.
• Don't use regex delimiters when searching for a dependency. Pull request
  #​2738 by Luis Sagastume.
• Refactor query command. Pull request #​2739 by Luis Sagastume.
• Don't remove default spec files from mapping after require. Pull request
  #​2741 by David Rodríguez.
• Cleanup base test case. Pull request #​2742 by David Rodríguez.
• Simplify Specification#gems_dir. Pull request #​2745 by David Rodríguez.
• Fix test warning. Pull request #​2746 by David Rodríguez.
• Extract an add_to_load_path method. Pull request #​2749 by David
  Rodríguez.
• Fix setup command if format_executable is true by default. Pull request
  #​2766 by Jeremy Evans.
• Update the certificate files to make the test pass on Debian 10. Pull
  request #​2777 by Yusuke Endoh.
• Write to the correct config file(.gemrc). Pull request #​2779 by Luis
  Sagastume.
• Fix for large values in UID/GID fields in tar archives. Pull request
  #​2780 by Alexey Shein.
• Lazy require stringio. Pull request #​2781 by Luis Sagastume.
• Make Gem::Specification#ruby_code handle OpenSSL::PKey::RSA objects.
  Pull request #​2782 by Luis Sagastume.
• Fix setup command test for bundler with program_suffix. Pull request
  #​2783 by Sorah Fukumori.
• Make sure rake package works. Pull request #​2787 by David Rodríguez.
• Synchronize access to the Gem::Specification::LOAD_CACHE Hash. Pull
  request #​2789 by Benoit Daloze.
• Task to install rubygems to local system. Pull request #​2795 by David
  Rodríguez.
• Add an attr_reader to Gem::Installer for the package instance variable.
  Pull request #​2796 by Daniel Berger.
• Switch CI script to bash. Pull request #​2799 by David Rodríguez.
• Move gemcutter utilities code to Gem::Command. Pull request #​2803 by
  Luis Sagastume.
• Add raw spec method to gem package. Pull request #​2806 by Luis
  Sagastume.
• Improve rake package test error message. Pull request #​2815 by David
  Rodríguez.
• Resolve @@​project_dir from test file paths. Pull request #​2843 by
  Nobuyoshi Nakada.
• Remove dead code in Gem::Validator. Pull request #​2537 by Ellen Marie
  Dash.
• The date might have advanced since TODAY has been set. Pull request
  #​2938 by Nobuyoshi Nakada.
• Remove old ci configurations. Pull request #​2917 by SHIBATA Hiroshi.
• Add Gem::Dependency identity. Pull request #​2936 by Luis Sagastume.
• Filter dependency type and name strictly. Pull request #​2930 by SHIBATA
  Hiroshi.
• Always pass an encoding option to Zlib::GzipReader.wrap. Pull request
  #​2933 by Nobuyoshi Nakada.
• Introduce default prerelease requirement. Pull request #​2925 by David
  Rodríguez.
• Detect libc version, closes #​2918. Pull request #​2922 by fauno.
• Use IAM role to extract security-credentials for EC2 instance. Pull
  request #​2894 by Alexander Pakulov.
• Improve gem uninstall --all. Pull request #​2893 by David Rodríguez.
• Use RbConfig::CONFIG['rubylibprefix']. Pull request #​2889 by Nobuyoshi
  Nakada.
• Build the first gemspec we found if no arguments are passed to gem
  build. Pull request #​2887 by Luis Sagastume.
• $LOAD_PATH elements should be real paths. Pull request #​2885 by
  Nobuyoshi Nakada.
• Use the standard RUBY_ENGINE_VERSION instead of JRUBY_VERSION. Pull
  request #​2864 by Benoit Daloze.
• Cleanup after testing rake package. Pull request #​2862 by David
  Rodríguez.
• Cherry-pick shushing deprecation warnings from ruby-core. Pull request
  #​2861 by David Rodríguez.
• Ext/builder.rb cleanup. Pull request #​2849 by Luis Sagastume.
• Fix @​ran_rake assignment in builder.rb. Pull request #​2850 by Luis
  Sagastume.
• Remove test suite warnings. Pull request #​2845 by Luis Sagastume.
• Replace domain parameter with a parameter to suppress suggestions. Pull
  request #​2846 by Luis Sagastume.
• Move default specifications dir definition out of BasicSpecification.
  Pull request #​2841 by Vít Ondruch.
• There is no usage of @​orig_env_* variables in test suite. Pull request
  #​2838 by SHIBATA Hiroshi.
• Use File#open instead of Kernel#open in stub_specification.rb. Pull
  request #​2834 by Luis Sagastume.
• Simplify #to_ruby code. Pull request #​2825 by Nobuyoshi Nakada.
• Add a gem attr to the Gem::Package class. Pull request #​2828 by Daniel
  Berger.
• Remove useless TODO comment. Pull request #​2818 by Luis Sagastume.

Bug fixes:

• Fix typos in History.txt. Pull request #​2565 by Igor Zubkov.
• Remove unused empty sources array. Pull request #​2598 by Aaron
  Patterson.
• Fix windows specific executables generated by gem install. Pull
  request #​2628 by David Rodríguez.
• Gem::Specification#to_ruby needs OpenSSL. Pull request #​2937 by
  Nobuyoshi Nakada.
• Set SOURCE_DATE_EPOCH env var if not provided. Pull request #​2882 by
  Ellen Marie Dash.
• Installer.rb - fix #windows_stub_script. Pull request #​2876 by MSP-Greg.
• Fixed deprecation message. Pull request #​2867 by Nobuyoshi Nakada.
• Fix requiring default gems to consider prereleases. Pull request #​2728
  by David Rodríguez.
• Forbid find_spec_for_exe without an exec_name. Pull request #​2706 by
  David Rodríguez.
• Do not prompt for passphrase when key can be loaded without it. Pull
  request #​2710 by Luis Sagastume.
• Add missing wrapper. Pull request #​2690 by David Rodríguez.
• Remove long ago deprecated methods. Pull request #​2704 by David
  Rodríguez.
• Renamed duplicate test. Pull request #​2678 by Nobuyoshi Nakada.
• File.exists? is deprecated. Pull request #​2855 by SHIBATA Hiroshi.
• Fixed to warn with shadowing outer local variable. Pull request #​2856 by
  SHIBATA Hiroshi.
• Fix explain with ignore-dependencies. Pull request #​2647 by David
  Rodríguez.
• Fix default gem executable installation when folder is not bin/. Pull
  request #​2649 by David Rodríguez.
• Fix cryptic error on local and ignore-dependencies combination. Pull
  request #​2650 by David Rodríguez.

Deprecations:

• Make deprecate Gem::RubyGemsVersion and Gem::ConfigMap. Pull request
  #​2857 by SHIBATA Hiroshi.
• Deprecate Gem::RemoteFetcher#fetch_size. Pull request #​2833 by Luis
  Sagastume.
• Explicitly deprecate rubyforge_project. Pull request #​2798 by David
  Rodríguez.
• Deprecate unused Gem::Installer#unpack method. Pull request #​2715 by Vít
  Ondruch.
• Deprecate a few unused methods. Pull request #​2674 by David Rodríguez.
• Add deprecation warnings for cli options. Pull request #​2607 by Luis
  Sagastume.

Breaking changes:

• Suppress keywords warning. Pull request #​2934 by Nobuyoshi Nakada.
• Suppress Ruby 2.7's real kwargs warning. Pull request #​2912 by Koichi
  ITO.
• Fix Kernel#warn override. Pull request #​2911 by Jeremy Evans.
• Remove conflict.rb code that was supposed to be removed in Rubygems 3.
  Pull request #​2802 by Luis Sagastume.
• Compatibility cleanups. Pull request #​2754 by David Rodríguez.
• Remove others_possible activation request param. Pull request #​2747 by
  David Rodríguez.
• Remove dependency installer deprecated code. Pull request #​2740 by Luis
  Sagastume.
• Removed guard condition with USE_BUNDLER_FOR_GEMDEPS. Pull request #​2716
  by SHIBATA Hiroshi.
• Skip deprecation warning during specs. Pull request #​2718 by David
  Rodríguez.
• Remove QuickLoader reference. Pull request #​2719 by David Rodríguez.
• Removed circular require. Pull request #​2679 by Nobuyoshi Nakada.
• Removed needless environmental variable for Travis CI. Pull request
  #​2685 by SHIBATA Hiroshi.
• Removing yaml require. Pull request #​2538 by Luciano Sousa.

v2.0.2

Compare Source

Bug fixes:

• HTTPS URLs are preferred over HTTP URLs. RubyGems will now attempt to
  upgrade any HTTP source to HTTPS. Credit to Alex Gaynor.
• SSL Certificates are now installed properly. Fixes #​491 by hemanth.hm
• Fixed HTTP to HTTPS upgrade for rubygems.org.

v2.0.1

Bug fixes:

• Tightened API endpoint checks for CVE-2015-3900

v2.0.0

RubyGems 2.0 includes several new features and many breaking changes. Some of
these changes will cause existing software to break. These changes are a
result of improvements to the internals of RubyGems that make it more
maintainable and improve APIs for RubyGems users.

If you are using bundler be sure to install a 1.3.0.prerelease version or
newer. Older versions of bundler will not work with RubyGems 2.0.

Changes since RubyGems 1.8.25 (including past pre-releases):

Breaking changes:

• Deprecated Gem.unresolved_deps in favor of
  Gem::Specification.unresolved_deps
• Merged Gem::Builder into Gem::Package. Use Gem::Package.build(spec)
  instead of Gem::Builder.new(spec).build
• Merged Gem::Format into Gem::Package. Use Gem::Package.new instead
  of Gem::Format.from_file_by_path
• Moved Gem::OldFormat to Gem::Package::Old. Gem::Package will
  automatically detect old gems for you, so there is no need to refer to it.
• Removed Gem::DocManager, replaced by Gem::RDoc and done_installing hook
• Removed Gem::Package::TarInput in favor of Gem::Package
• Removed Gem::Package::TarOutput in favor of Gem::Package
• Removed Gem::RemoteFetcher#open_uri_or_path. (steveklabnik)
• Removed Gem::SSL in favor of using OpenSSL directly
• Removed Gem.loaded_path
• Removed RSS generation from the gem indexer
• Removed benchmark option from .gemrc
• Removed broken YAML gemspec support in gem build
• Removed support for Ruby 1.9.1
• Removed many deprecated methods

Enhancements:

• Improved support for default gems shipping with ruby 2.0.0+
• A gem can have arbitrary metadata through Gem::Specification#metadata
• gem search now defaults to --remote and is anchored like gem list. Fixes
  #​166
• Added --document to replace --rdoc and --ri. Use --no-document to disable
  documentation, --document=rdoc to only generate rdoc.
• Only ri-format documentation is generated by default.
• gem server uses RDoc::Servlet from RDoc 4.0 to generate HTML
  documentation.
• Add ability to install gems directly from a compatible gemdep
  file (Gemfile, Isolate, gem.deps.rb) gem install --file path
• Add ability to load gem activation information from a gemdeps
  file (Gemfile, Isolate, gem.deps.rb).
  Set RUBYGEMS_GEMDEPS=path to have it loaded. Use - as the path
  to autodetect (current and parent directories are searched).
• Added gem check --doctor to clean up after failed uninstallation. Bug
  #​419 by Erik Hollensbe
• RubyGems no longer defaults to uninstalling gems if a dependency would be
  broken. Now you must manually say "yes". Pull Request #​406 by Shannon
  Skipper.
• Gem::DependencyInstaller now passes build_args down to the installer.
  Pull Request #​412 by Sam Rawlins.
• Added a cmake builder. Pull request #​265 by Allan Espinosa.
• Removed rubyforge page from gem list output
• Added --only-executables option to gem pristine. Fixes #​326
• Added -I flag for 'gem query' to exclude installed items
• Added Gem.install(name, version=default) for interactive sessions
• Added Gem::FilePermissionError#directory
• Added Gem::rubygems_version which is like Gem::ruby_version
• Added RUBYGEMS_HOST documentation to gem env
• Added a post_installs hook that runs after Gem::DependencyInstaller
  finishes installing a set of gems
• Added a usage method for Gem::Commands::OwnerCommand. (ffmike)
• Added an optional type parameter to Gem::Specification#doc_dir.
• Added announcements url and clarified how to file tickets
• Added guidance for how to use rdoc and ri in setup command. (jjb)
• Attempting to install multiple gems with --version is now an error. You
  can specify per-gem versions like rake:0.9.5
• Clarified Gem::CommandManager exa

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.