Skip to content

Upgrading bundler 1 to 2

Breaking1.17.3 → 2.7.2Breaking1Security2Deprecated6New13Changed32Fixed80Other40

Full comparisonBack to bundler
Fetching 139 releases from GitHub…16 / 139
BreakingUpgrade verdict

1 breaking change and 2 security fixes.

In plain terms
  • Uses -rrubygems instead of -rubygems.rb because ubygems.rb is unavailable on Ruby 2.5.
  • If a gem download fails, the password in the gem source URL is no longer printed in the error message.
  • The gem server now escapes user-supplied content on its web pages so it cannot be used to inject scripts.
  • Warns when requiring deprecated files.
Must act Top 5 of 9 that need code or config changes

Ruby requirement changed in 2.7.0: >= 1.8.7 → >= 3.2.0.

What you must change

Breaking1
Uses -rrubygems instead of -rubygems.rb because ubygems.rb is unavailable on Ruby 2.5.
-rrubygems-rubygems.rbubygems.rb
2.7.0GitHub ReleaseSummarizedView source
Security2
Redacts uri password from error output when gem fetch fails.
2.6.4GitHub ReleaseSummarizedView source
Escapes user-supplied content served by gem server to avoid potential XSS vulnerabilities.
gem server
2.6.4GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated6
Warns when requiring deprecated files.
2.7.0GitHub ReleaseSummarizedView source
Deprecates Gem::InstallerTestCase#util_gem_bindir and Gem::InstallerTestCase#util_gem_dir.
Gem::InstallerTestCase#util_gem_bindirGem::InstallerTestCase#util_gem_dir
2.7.0GitHub ReleaseSummarizedView source
Deprecates passing options to Gem::GemRunner.
Gem::GemRunner
2.7.0GitHub ReleaseSummarizedView source
Adds a deprecation for Gem#datadir.
Gem#datadir
2.7.0GitHub ReleaseSummarizedView source
Adds a deprecation warning for Gem::DependencyInstaller#gems_to_install.
Gem::DependencyInstaller#gems_to_install
2.7.0GitHub ReleaseSummarizedView source
Restores but deprecates support for Array values on Gem.paths=.
Gem.paths=
2.6.1GitHub ReleaseSummarizedView source