From 95f2c78fc2391cc8e1b5d224857aec89c6a491cb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 6 Jan 2026 02:04:32 +0000
Subject: [PATCH 1/6] Bump dependabot/fetch-metadata from 2.4.0 to 2.5.0

Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.4.0 to 2.5.0.
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](https://github.com/dependabot/fetch-metadata/compare/08eff52bf64351f401fb50d4972fa95b9f2c2d1b...21025c705c08248db411dc16f3619e6b5f9ea21a)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/dependabot_automerge.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot_automerge.yml b/.github/workflows/dependabot_automerge.yml
index aae1b3d9a8015d..a95c7005c41054 100644
--- a/.github/workflows/dependabot_automerge.yml
+++ b/.github/workflows/dependabot_automerge.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'ruby/ruby'
     steps:
       - name: Dependabot metadata
-        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
         id: metadata
 
       - name: Wait for status checks

From 1b476606f2294d0ce52a7429c597491ff68b11ce Mon Sep 17 00:00:00 2001
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
Date: Tue, 6 Jan 2026 13:07:49 +0900
Subject: [PATCH 2/6] Update the latest versions of actions

---
 .github/workflows/annocheck.yml          | 2 +-
 .github/workflows/auto_review_pr.yml     | 2 +-
 .github/workflows/baseruby.yml           | 2 +-
 .github/workflows/check_dependencies.yml | 2 +-
 .github/workflows/modgc.yml              | 2 +-
 .github/workflows/parse_y.yml            | 2 +-
 .github/workflows/spec_guards.yml        | 2 +-
 .github/workflows/sync_default_gems.yml  | 2 +-
 .github/workflows/ubuntu.yml             | 2 +-
 .github/workflows/wasm.yml               | 2 +-
 .github/workflows/windows.yml            | 2 +-
 .github/workflows/yjit-ubuntu.yml        | 2 +-
 .github/workflows/zjit-ubuntu.yml        | 2 +-
 13 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/annocheck.yml b/.github/workflows/annocheck.yml
index 042748389ea87b..899d601aef6dba 100644
--- a/.github/workflows/annocheck.yml
+++ b/.github/workflows/annocheck.yml
@@ -72,7 +72,7 @@ jobs:
           builddir: build
           makeup: true
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none
diff --git a/.github/workflows/auto_review_pr.yml b/.github/workflows/auto_review_pr.yml
index 4fc54902315d31..ad0e63ba126ac0 100644
--- a/.github/workflows/auto_review_pr.yml
+++ b/.github/workflows/auto_review_pr.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6.0.1
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.4'
           bundler: none
diff --git a/.github/workflows/baseruby.yml b/.github/workflows/baseruby.yml
index ee4f8c9a2a78a0..d3e734f8858a3b 100644
--- a/.github/workflows/baseruby.yml
+++ b/.github/workflows/baseruby.yml
@@ -48,7 +48,7 @@ jobs:
           - ruby-3.3
 
     steps:
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none
diff --git a/.github/workflows/check_dependencies.yml b/.github/workflows/check_dependencies.yml
index 7d5b5e79efe4c4..c5dec65e487ef0 100644
--- a/.github/workflows/check_dependencies.yml
+++ b/.github/workflows/check_dependencies.yml
@@ -40,7 +40,7 @@ jobs:
 
       - uses: ./.github/actions/setup/directories
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none
diff --git a/.github/workflows/modgc.yml b/.github/workflows/modgc.yml
index fe01b3dcbefbbb..1d14934df8734e 100644
--- a/.github/workflows/modgc.yml
+++ b/.github/workflows/modgc.yml
@@ -61,7 +61,7 @@ jobs:
         uses: ./.github/actions/setup/ubuntu
         if: ${{ contains(matrix.os, 'ubuntu') }}
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none
diff --git a/.github/workflows/parse_y.yml b/.github/workflows/parse_y.yml
index c06d7b8fa93f74..87facc8a558701 100644
--- a/.github/workflows/parse_y.yml
+++ b/.github/workflows/parse_y.yml
@@ -58,7 +58,7 @@ jobs:
 
       - uses: ./.github/actions/setup/ubuntu
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none
diff --git a/.github/workflows/spec_guards.yml b/.github/workflows/spec_guards.yml
index 971547351de67e..cf4661555c82b2 100644
--- a/.github/workflows/spec_guards.yml
+++ b/.github/workflows/spec_guards.yml
@@ -48,7 +48,7 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none
diff --git a/.github/workflows/sync_default_gems.yml b/.github/workflows/sync_default_gems.yml
index 8e44b96908738f..9ff97d5a4e6d9c 100644
--- a/.github/workflows/sync_default_gems.yml
+++ b/.github/workflows/sync_default_gems.yml
@@ -36,7 +36,7 @@ jobs:
         with:
           token: ${{ github.repository == 'ruby/ruby' && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.4'
           bundler: none
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 81c6bff401780e..88c19b6fe60ee3 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -69,7 +69,7 @@ jobs:
         with:
           arch: ${{ matrix.arch }}
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none
diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
index 6022da8c3b0585..0d2a6f05454c6e 100644
--- a/.github/workflows/wasm.yml
+++ b/.github/workflows/wasm.yml
@@ -98,7 +98,7 @@ jobs:
         run: |
           echo "WASI_SDK_PATH=/opt/wasi-sdk" >> $GITHUB_ENV
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index e0bd6893a6f7e7..d9421374613e1a 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -59,7 +59,7 @@ jobs:
       - run: md build
         working-directory:
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           # windows-11-arm has only 3.4.1, 3.4.2, 3.4.3, head
           ruby-version: ${{ !endsWith(matrix.os, 'arm') && '3.1' || '3.4' }}
diff --git a/.github/workflows/yjit-ubuntu.yml b/.github/workflows/yjit-ubuntu.yml
index bd90a57c2a0d87..150f0b3275e5cc 100644
--- a/.github/workflows/yjit-ubuntu.yml
+++ b/.github/workflows/yjit-ubuntu.yml
@@ -128,7 +128,7 @@ jobs:
 
       - uses: ./.github/actions/setup/ubuntu
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none
diff --git a/.github/workflows/zjit-ubuntu.yml b/.github/workflows/zjit-ubuntu.yml
index 4d5ecb7280c04d..28bfec963e57f5 100644
--- a/.github/workflows/zjit-ubuntu.yml
+++ b/.github/workflows/zjit-ubuntu.yml
@@ -111,7 +111,7 @@ jobs:
 
       - uses: ./.github/actions/setup/ubuntu
 
-      - uses: ruby/setup-ruby@ae195bbe749a7cef685ac729197124a48305c1cb # v1.276.0
+      - uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
         with:
           ruby-version: '3.1'
           bundler: none

From 3143543f958d4fa90d0423f84c598286098f1704 Mon Sep 17 00:00:00 2001
From: lolwut <lol@wut.com>
Date: Thu, 25 Dec 2025 21:05:50 -0600
Subject: [PATCH 3/6] [ruby/rubygems] Compare like values in find_bundler

The input to this method is not guaranteed to be a string, it could be a `Gem::Version` this normalizes the comparison.

https://github.com/ruby/rubygems/commit/1f43c7a988
---
 lib/bundler/rubygems_integration.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/bundler/rubygems_integration.rb b/lib/bundler/rubygems_integration.rb
index d8f95cffb8fcd6..e04ef232592a0c 100644
--- a/lib/bundler/rubygems_integration.rb
+++ b/lib/bundler/rubygems_integration.rb
@@ -432,7 +432,7 @@ def default_specs
     end
 
     def find_bundler(version)
-      find_name("bundler").find {|s| s.version.to_s == version }
+      find_name("bundler").find {|s| s.version.to_s == version.to_s }
     end
 
     def find_name(name)

From 16bdfa1b2a6b4cb40417e7673ad9eaa80664e4f0 Mon Sep 17 00:00:00 2001
From: Schneems <richard.schneeman+foo@gmail.com>
Date: Fri, 26 Dec 2025 12:21:51 -0600
Subject: [PATCH 4/6] [ruby/rubygems] Split logic to two lines

https://github.com/ruby/rubygems/commit/5a6eca4cf9
---
 lib/bundler/runtime.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/bundler/runtime.rb b/lib/bundler/runtime.rb
index 5eb827dcb2a8ed..f632ce9144ef5e 100644
--- a/lib/bundler/runtime.rb
+++ b/lib/bundler/runtime.rb
@@ -174,7 +174,8 @@ def clean(dry_run = false)
       spec_cache_paths     = []
       spec_gemspec_paths   = []
       spec_extension_paths = []
-      Bundler.rubygems.add_default_gems_to(specs).values.each do |spec|
+      specs_to_keep = Bundler.rubygems.add_default_gems_to(specs).values
+      specs_to_keep.each do |spec|
         spec_gem_paths << spec.full_gem_path
         # need to check here in case gems are nested like for the rails git repo
         md = %r{(.+bundler/gems/.+-[a-f0-9]{7,12})}.match(spec.full_gem_path)

From 4377249bbf1a27b3d860ab8948b508f1b024ba1c Mon Sep 17 00:00:00 2001
From: Schneems <richard.schneeman+foo@gmail.com>
Date: Fri, 26 Dec 2025 12:21:51 -0600
Subject: [PATCH 5/6] [ruby/rubygems] Test for removing current bundler version

https://github.com/ruby/rubygems/commit/675342e6d0
---
 spec/bundler/commands/clean_spec.rb | 37 +++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/spec/bundler/commands/clean_spec.rb b/spec/bundler/commands/clean_spec.rb
index 6b678d0aa5451b..793aacf5c2b5cd 100644
--- a/spec/bundler/commands/clean_spec.rb
+++ b/spec/bundler/commands/clean_spec.rb
@@ -898,4 +898,41 @@ def should_not_have_gems(*gems)
 
     expect(very_simple_binary_extensions_dir).to be_nil
   end
+
+  it "does not remove the bundler version currently running" do
+    gemfile <<-G
+      source "https://gem.repo1"
+
+      gem "myrack"
+    G
+
+    bundle "config set path vendor/bundle"
+    bundle "install"
+
+    version = Bundler.gem_version.to_s
+    # Simulate that the locked bundler version is installed in the bundle path
+    # by creating the gem directory and gemspec (as would happen after bundle install with that version)
+    Pathname(vendored_gems("cache/bundler-#{version}.gem")).tap do |path|
+      path.basename.mkpath
+      FileUtils.touch(path)
+    end
+    FileUtils.touch(vendored_gems("gems/bundler-#{version}"))
+    Pathname(vendored_gems("specifications/bundler-#{version}.gemspec")).tap do |path|
+      path.basename.mkpath
+      path.write(<<~GEMSPEC)
+        Gem::Specification.new do |s|
+          s.name = "bundler"
+          s.version = "#{version}"
+          s.authors = ["bundler team"]
+          s.summary = "The best way to manage your application's dependencies"
+        end
+      GEMSPEC
+    end
+
+    should_have_gems "bundler-#{version}"
+
+    bundle :clean
+
+    should_have_gems "bundler-#{version}"
+  end
 end

From ad6b85450db1b252660dae4b514f5be35ccd38b9 Mon Sep 17 00:00:00 2001
From: Schneems <richard.schneeman+foo@gmail.com>
Date: Fri, 26 Dec 2025 12:21:51 -0600
Subject: [PATCH 6/6] [ruby/rubygems] Retain current bundler version on `bundle
 clean`

Previously: In #9218 a reproduction is shared where running `bundle clean` using a binstub (`bin/bundle`) results in bundler removing itself. This results in Ruby falling back to its default bundler version. This behavior seems to be present for as long as there has been a default version of bundler (Ruby 2.6+).

Now: Bundler will explicitly add its current version number to the specs to be preserved. This prevents `bundle clean` from removing the current bundler version.

close https://github.com/ruby/rubygems/pull/9218

https://github.com/ruby/rubygems/commit/e3f0167ae4
---
 lib/bundler/runtime.rb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/bundler/runtime.rb b/lib/bundler/runtime.rb
index f632ce9144ef5e..5280e72aa24b5e 100644
--- a/lib/bundler/runtime.rb
+++ b/lib/bundler/runtime.rb
@@ -175,6 +175,12 @@ def clean(dry_run = false)
       spec_gemspec_paths   = []
       spec_extension_paths = []
       specs_to_keep = Bundler.rubygems.add_default_gems_to(specs).values
+
+      current_bundler = Bundler.rubygems.find_bundler(Bundler.gem_version)
+      if current_bundler
+        specs_to_keep << current_bundler
+      end
+
       specs_to_keep.each do |spec|
         spec_gem_paths << spec.full_gem_path
         # need to check here in case gems are nested like for the rails git repo