Prepare RubyGems 4.0.9 and Bundler 4.0.9

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 4.0.9 / 2026-03-25
+
+### Enhancements:
+
+* Fix: include owner role in `gem owner`. Pull request [#9403](https://github.com/ruby/rubygems/pull/9403) by gjtorikian
+* Installs bundler 4.0.9 as a default gem.
+
+### Bug fixes:
+
+* Fix: Ensure trailing slash is added to source URIs added via gem sources. Pull request [#9055](https://github.com/ruby/rubygems/pull/9055) by zirni
+
+### Documentation:
+
+* [DOC] Fix link. Pull request [#9409](https://github.com/ruby/rubygems/pull/9409) by BurdetteLamar
+
 ## 4.0.8 / 2026-03-11
 
 ### Enhancements:

bundler/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 4.0.9 / 2026-03-25
+
+### Enhancements:
+
+* Lock the checksum of Bundler itself in the lockfile. Pull request [#9366](https://github.com/ruby/rubygems/pull/9366) by Edouard-chin
+* Check the git version only **once** per `bundle install`. Pull request [#9406](https://github.com/ruby/rubygems/pull/9406) by Edouard-chin
+* Normalize the number of workers when performing parallel operations. Pull request [#9400](https://github.com/ruby/rubygems/pull/9400) by Edouard-chin
+* Add exponential backoff to bundler retries. Pull request [#9163](https://github.com/ruby/rubygems/pull/9163) by ChrisBr
+* Introduce a priority queue. Pull request [#9389](https://github.com/ruby/rubygems/pull/9389) by Edouard-chin
+* Split the download and install process of a gem. Pull request [#9381](https://github.com/ruby/rubygems/pull/9381) by Edouard-chin
+
+### Bug fixes:
+
+* Retry git fetch without --depth for dumb HTTP transport. Pull request [#9405](https://github.com/ruby/rubygems/pull/9405) by hsbt
+
 ## 4.0.8 (2026-03-11)
 
 ### Enhancements:

bundler/lib/bundler/cli/pristine.rb

@@ -53,7 +53,7 @@ def run
           true
         end.map(&:name)
 
-        jobs = installer.send(:installation_parallelization)
+        jobs = Bundler.settings.installation_parallelization
         pristine_count = definition.specs.count - installed_specs.count
         # allow a pristining a single gem to skip the parallel worker
         jobs = [jobs, pristine_count].min

bundler/lib/bundler/definition.rb

@@ -1122,7 +1122,9 @@ def source_requirements
     end
 
     def preload_git_source_worker
-      @preload_git_source_worker ||= Bundler::Worker.new(5, "Git source preloading", ->(source, _) { source.specs })
+      workers = Bundler.settings.installation_parallelization
+
+      @preload_git_source_worker ||= Bundler::Worker.new(workers, "Git source preloading", ->(source, _) { source.specs })
     end
 
     def preload_git_sources

bundler/lib/bundler/fetcher/gem_remote_fetcher.rb

@@ -8,7 +8,7 @@ class GemRemoteFetcher < Gem::RemoteFetcher
       def initialize(*)
         super
 
-        @pool_size = 5
+        @pool_size = Bundler.settings.installation_parallelization
       end
 
       def request(*args)

bundler/lib/bundler/installer.rb

@@ -189,21 +189,13 @@ def install(options)
       standalone = options[:standalone]
       force = options[:force]
       local = options[:local] || options[:"prefer-local"]
-      jobs = installation_parallelization
+      jobs = Bundler.settings.installation_parallelization
       spec_installations = ParallelInstaller.call(self, @definition.specs, jobs, standalone, force, local: local)
       spec_installations.each do |installation|
         post_install_messages[installation.name] = installation.post_install_message if installation.has_post_install_message?
       end
     end
 
-    def installation_parallelization
-      if jobs = Bundler.settings[:jobs]
-        return jobs
-      end
-
-      Bundler.settings.processor_count
-    end
-
     def load_plugins
       Gem.load_plugins
 

bundler/lib/bundler/installer/gem_installer.rb

@@ -25,6 +25,20 @@ def install_from_spec
       [false, specific_failure_message(e)]
     end
 
+    def download
+      spec.source.download(
+        spec,
+        force: force,
+        local: local,
+        build_args: Array(spec_settings),
+        previous_spec: previous_spec,
+      )
+
+      [true, nil]
+    rescue Bundler::BundlerError => e
+      [false, specific_failure_message(e)]
+    end
+
     private
 
     def specific_failure_message(e)

bundler/lib/bundler/installer/parallel_installer.rb

@@ -24,6 +24,10 @@ def enqueued?
         state == :enqueued
       end
 
+      def enqueue_with_priority?
+        state == :installable && spec.extensions.any?
+      end
+
       def failed?
         state == :failed
       end
@@ -32,6 +36,12 @@ def ready_to_enqueue?
         state == :none
       end
 
+      def ready_to_install?(installed_specs)
+        return false unless state == :downloaded
+
+        spec.extensions.none? || dependencies_installed?(installed_specs)
+      end
+
       def has_post_install_message?
         !post_install_message.empty?
       end
@@ -84,6 +94,7 @@ def initialize(installer, all_specs, size, standalone, force, local: false, skip
 
     def call
       if @rake
+        do_download(@rake, 0)
         do_install(@rake, 0)
         Gem::Specification.reset
       end
@@ -107,26 +118,54 @@ def failed_specs
     end
 
     def install_with_worker
-      enqueue_specs
-      process_specs until finished_installing?
+      installed_specs = {}
+      enqueue_specs(installed_specs)
+
+      process_specs(installed_specs) until finished_installing?
     end
 
     def install_serially
       until finished_installing?
         raise "failed to find a spec to enqueue while installing serially" unless spec_install = @specs.find(&:ready_to_enqueue?)
         spec_install.state = :enqueued
+        do_download(spec_install, 0)
         do_install(spec_install, 0)
       end
     end
 
     def worker_pool
       @worker_pool ||= Bundler::Worker.new @size, "Parallel Installer", lambda {|spec_install, worker_num|
-        do_install(spec_install, worker_num)
+        case spec_install.state
+        when :enqueued
+          do_download(spec_install, worker_num)
+        when :installable
+          do_install(spec_install, worker_num)
+        else
+          spec_install
+        end
       }
     end
 
-    def do_install(spec_install, worker_num)
+    def do_download(spec_install, worker_num)
       Plugin.hook(Plugin::Events::GEM_BEFORE_INSTALL, spec_install)
+
+      gem_installer = Bundler::GemInstaller.new(
+        spec_install.spec, @installer, @standalone, worker_num, @force, @local
+      )
+
+      success, message = gem_installer.download
+
+      if success
+        spec_install.state = :downloaded
+      else
+        spec_install.error = "#{message}\n\n#{require_tree_for_spec(spec_install.spec)}"
+        spec_install.state = :failed
+      end
+
+      spec_install
+    end
+
+    def do_install(spec_install, worker_num)
       gem_installer = Bundler::GemInstaller.new(
         spec_install.spec, @installer, @standalone, worker_num, @force, @local
       )
@@ -147,9 +186,19 @@ def do_install(spec_install, worker_num)
     # Some specs might've had to wait til this spec was installed to be
     # processed so the call to `enqueue_specs` is important after every
     # dequeue.
-    def process_specs
-      worker_pool.deq
-      enqueue_specs
+    def process_specs(installed_specs)
+      spec = worker_pool.deq
+
+      if spec.installed?
+        installed_specs[spec.name] = true
+        return
+      elsif spec.failed?
+        return
+      elsif spec.ready_to_install?(installed_specs)
+        spec.state = :installable
+      end
+
+      worker_pool.enq(spec, priority: spec.enqueue_with_priority?)
     end
 
     def finished_installing?
@@ -185,18 +234,15 @@ def require_tree_for_spec(spec)
     # Later we call this lambda again to install specs that depended on
     # previously installed specifications. We continue until all specs
     # are installed.
-    def enqueue_specs
-      installed_specs = {}
-      @specs.each do |spec|
-        next unless spec.installed?
-        installed_specs[spec.name] = true
-      end
-
+    def enqueue_specs(installed_specs)
       @specs.each do |spec|
-        if spec.ready_to_enqueue? && spec.dependencies_installed?(installed_specs)
-          spec.state = :enqueued
-          worker_pool.enq spec
+        if spec.installed?
+          installed_specs[spec.name] = true
+          next
         end
+
+        spec.state = :enqueued
+        worker_pool.enq spec
       end
     end
   end

bundler/lib/bundler/man/bundle-config.1

@@ -146,7 +146,7 @@ When set, no post install messages will be printed\. To silence a single gem, us
 Generate a \fBgems\.rb\fR instead of a \fBGemfile\fR when running \fBbundle init\fR\.
 .TP
 \fBjobs\fR (\fBBUNDLE_JOBS\fR)
-The number of gems Bundler can install in parallel\. Defaults to the number of available processors\.
+The number of gems Bundler can download and install in parallel\. Defaults to the number of available processors\.
 .TP
 \fBlockfile\fR (\fBBUNDLE_LOCKFILE\fR)
 The path to the lockfile that bundler should use\. By default, Bundler adds \fB\.lock\fR to the end of the \fBgemfile\fR entry\. Can be set to \fBfalse\fR in the Gemfile to disable lockfile creation entirely (see gemfile(5))\.

bundler/lib/bundler/man/bundle-config.1.ronn

@@ -192,8 +192,8 @@ learn more about their operation in [bundle install(1)](bundle-install.1.html).
 * `init_gems_rb` (`BUNDLE_INIT_GEMS_RB`):
    Generate a `gems.rb` instead of a `Gemfile` when running `bundle init`.
 * `jobs` (`BUNDLE_JOBS`):
-   The number of gems Bundler can install in parallel. Defaults to the number of
-   available processors.
+   The number of gems Bundler can download and install in parallel.
+   Defaults to the number of available processors.
 * `lockfile` (`BUNDLE_LOCKFILE`):
    The path to the lockfile that bundler should use. By default, Bundler adds
    `.lock` to the end of the `gemfile` entry. Can be set to `false` in the

bundler/lib/bundler/plugin/api/source.rb

@@ -74,6 +74,14 @@ def options_to_lock
           {}
         end
 
+        # Download the gem specified by the spec at appropriate path.
+        #
+        # A source plugin can implement this method to split the download and the
+        # installation of a gem.
+        #
+        # @return [Boolean] Whether the download of the gem succeeded.
+        def download(spec, opts); end
+
         # Install the gem specified by the spec at appropriate path.
         # `install_path` provides a sufficient default, if the source can only
         # satisfy one gem,  but is not binding.

bundler/lib/bundler/plugin/installer.rb

@@ -110,7 +110,8 @@ def install_from_specs(specs)
         paths = {}
 
         specs.each do |spec|
-          spec.source.install spec
+          spec.source.download(spec)
+          spec.source.install(spec)
 
           paths[spec.name] = spec
         end

bundler/lib/bundler/retry.rb

@@ -6,6 +6,8 @@ class Retry
     attr_accessor :name, :total_runs, :current_run
 
     class << self
+      attr_accessor :default_base_delay
+
       def default_attempts
         default_retries + 1
       end
@@ -16,11 +18,17 @@ def default_retries
       end
     end
 
-    def initialize(name, exceptions = nil, retries = self.class.default_retries)
+    # Set default base delay for exponential backoff
+    self.default_base_delay = 1.0
+
+    def initialize(name, exceptions = nil, retries = self.class.default_retries, opts = {})
       @name = name
       @retries = retries
       @exceptions = Array(exceptions) || []
       @total_runs = @retries + 1 # will run once, then upto attempts.times
+      @base_delay = opts[:base_delay] || self.class.default_base_delay
+      @max_delay = opts[:max_delay] || 60.0
+      @jitter = opts[:jitter] || 0.5
     end
 
     def attempt(&block)
@@ -48,9 +56,27 @@ def fail_attempt(e)
         Bundler.ui.info "" unless Bundler.ui.debug?
         raise e
       end
-      return true unless name
-      Bundler.ui.info "" unless Bundler.ui.debug? # Add new line in case dots preceded this
-      Bundler.ui.warn "Retrying #{name} due to error (#{current_run.next}/#{total_runs}): #{e.class} #{e.message}", true
+      if name
+        Bundler.ui.info "" unless Bundler.ui.debug? # Add new line in case dots preceded this
+        Bundler.ui.warn "Retrying #{name} due to error (#{current_run.next}/#{total_runs}): #{e.class} #{e.message}", true
+      end
+      backoff_sleep if @base_delay > 0
+      true
+    end
+
+    def backoff_sleep
+      # Exponential backoff: delay = base_delay * 2^(attempt - 1)
+      # Add jitter to prevent thundering herd: random value between 0 and jitter seconds
+      delay = @base_delay * (2**(@current_run - 1))
+      delay = [@max_delay, delay].min
+      jitter_amount = rand * @jitter
+      total_delay = delay + jitter_amount
+      Bundler.ui.debug "Sleeping for #{total_delay.round(2)} seconds before retry"
+      sleep(total_delay)
+    end
+
+    def sleep(duration)
+      Kernel.sleep(duration)
     end
 
     def keep_trying?

bundler/lib/bundler/self_manager.rb

@@ -63,6 +63,7 @@ def install_and_restart_with(version)
     end
 
     def install(spec)
+      spec.source.download(spec)
       spec.source.install(spec)
     end
 

bundler/lib/bundler/settings.rb

@@ -303,6 +303,10 @@ def app_cache_path
       @app_cache_path ||= self[:cache_path] || "vendor/cache"
     end
 
+    def installation_parallelization
+      self[:jobs] || processor_count
+    end
+
     def validate!
       all.each do |raw_key|
         [@local_config, @env_config, @global_config].each do |settings|

bundler/lib/bundler/source.rb

@@ -31,6 +31,8 @@ def version_message(spec, locked_spec = nil)
       message
     end
 
+    def download(*); end
+
     def can_lock?(spec)
       spec.source == self
     end