Prepare RubyGems 4.0.16 and Bundler 4.0.16

.github/workflows/install-rubygems.yml

@@ -26,7 +26,7 @@ jobs:
           - { name: "3.3", value: 3.3.9 }
           - { name: "3.4", value: 3.4.5 }
           - { name: jruby, value: jruby-10.0.2.0 }
-          - { name: truffleruby, value: truffleruby-24.1.2 }
+          - { name: truffleruby, value: truffleruby-34.0.1 }
         openssl:
           - { name: openssl, value: true }
           - { name: no-openssl, value: false }
@@ -35,7 +35,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup ruby
-        uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: ${{ matrix.ruby.value }}
           bundler: none
@@ -52,8 +52,11 @@ jobs:
           ruby -Ilib -S rake install 2> errors.txt || (cat errors.txt && exit 1)
           test ! -s errors.txt || (cat errors.txt && exit 1)
       - name: Check generating documentation with a non default rdoc
+        # rdoc 8 depends on rbs, which ships a C extension that JRuby cannot
+        # build. Temporarily pin rdoc below 8 on JRuby until rbs provides a
+        # JRuby-compatible build.
         run: |
-          gem install rdoc
+          gem install ${{ matrix.ruby.name == 'jruby' && '"rdoc:<8"' || 'rdoc' }}
           gem rdoc rdoc | grep -q "Parsing documentation"
       - name: Run a local rubygems command
         run: gem list bundler
@@ -131,7 +134,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup ruby
-        uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: ${{ matrix.ruby.value }}
           bundler: none
@@ -173,7 +176,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup original ruby
-        uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: 3.2
           bundler: none
@@ -194,7 +197,7 @@ jobs:
           GEM_HOME: bar
           GEM_PATH: bar
       - name: Setup final ruby
-        uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: 3.3
           bundler: none
@@ -223,7 +226,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup ruby
-        uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: ${{ matrix.ruby.value }}
           bundler: none

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 4.0.16 / 2026-07-10
+
+### Enhancements:
+
+* Installs bundler 4.0.16 as a default gem.
+
+### Bug fixes:
+
+* Skip the make job server when using BSD make. Pull request [#9676](https://github.com/ruby/rubygems/pull/9676) by flavorjones
+
 ## 4.0.15 / 2026-06-24
 
 ### Enhancements:

Manifest.txt

@@ -323,8 +323,6 @@ bundler/lib/bundler/vendor/thor/lib/thor/shell/terminal.rb
 bundler/lib/bundler/vendor/thor/lib/thor/shell/wrapped_printer.rb
 bundler/lib/bundler/vendor/thor/lib/thor/util.rb
 bundler/lib/bundler/vendor/thor/lib/thor/version.rb
-bundler/lib/bundler/vendor/tsort/LICENSE.txt
-bundler/lib/bundler/vendor/tsort/lib/tsort.rb
 bundler/lib/bundler/vendor/uri/COPYING
 bundler/lib/bundler/vendor/uri/lib/uri.rb
 bundler/lib/bundler/vendor/uri/lib/uri/common.rb

bundler/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 4.0.16 / 2026-07-10
+
+### Enhancements:
+
+* Bundler: Fix Bundler::Fetcher for PQC support, adding integration connection tests. Pull request [#9637](https://github.com/ruby/rubygems/pull/9637) by junaruga
+* Reuse RubyGems' vendored tsort in Bundler. Pull request [#9647](https://github.com/ruby/rubygems/pull/9647) by hsbt
+
+### Bug fixes:
+
+* Initialize the new gem's git repo without a subshell. Pull request [#9670](https://github.com/ruby/rubygems/pull/9670) by hsbt
+* Preserve CRLF lockfile line endings on Windows. Pull request [#9669](https://github.com/ruby/rubygems/pull/9669) by hsbt
+* Fix the gemspec error snippet on Windows drive-letter paths. Pull request [#9668](https://github.com/ruby/rubygems/pull/9668) by hsbt
+
+### Documentation:
+
+* Point Bundler gemspec metadata at the moved docs. Pull request [#9648](https://github.com/ruby/rubygems/pull/9648) by hsbt
+
 ## 4.0.15 / 2026-06-24
 
 ### Enhancements:

bundler/lib/bundler/cli/gem.rb

@@ -256,8 +256,7 @@ def run
 
       if use_git
         Bundler.ui.info "\nInitializing git repo in #{target}"
-        require "shellwords"
-        `git init #{target.to_s.shellescape}`
+        IO.popen(["git", "init", target.to_s], &:read)
 
         config[:git_default_branch] = File.read("#{target}/.git/HEAD").split("/").last.chomp
       end

bundler/lib/bundler/definition.rb

@@ -397,10 +397,6 @@ def write_lock(file, preserve_unknown_sections)
 
       contents = to_lock
 
-      # Convert to \r\n if the existing lock has them
-      # i.e., Windows with `git config core.autocrlf=true`
-      contents.gsub!(/\n/, "\r\n") if @lockfile_contents.match?("\r\n")
-
       if @locked_bundler_version
         locked_major = @locked_bundler_version.segments.first
         current_major = bundler_version_to_lock.segments.first
@@ -421,6 +417,14 @@ def write_lock(file, preserve_unknown_sections)
         return
       end
 
+      # Convert to \r\n if the existing lock has them, i.e., Windows with
+      # `git config core.autocrlf=true`. Detect from the bytes on disk because
+      # reading in text mode strips carriage returns on Windows, which would
+      # otherwise defeat this check and rewrite a `\r\n` lockfile with `\n`.
+      if File.exist?(file) && SharedHelpers.filesystem_access(file, :read) {|p| File.binread(p).include?("\r\n") }
+        contents.gsub!(/\n/, "\r\n")
+      end
+
       begin
         SharedHelpers.filesystem_access(file) do |p|
           File.open(p, "wb") {|f| f.puts(contents) }

bundler/lib/bundler/dsl.rb

@@ -602,8 +602,11 @@ def to_s
 
           trace_line = backtrace.find {|l| l.include?(dsl_path) } || trace_line
           return m unless trace_line
-          line_number = trace_line.split(":")[1].to_i - 1
+          # Match the line number right before `:in` or the end of the line so a
+          # Windows drive letter like `C:` does not get mistaken for the number.
+          line_number = trace_line[/:(\d+)(?::in\b|\z)/, 1]
           return m unless line_number
+          line_number = line_number.to_i - 1
 
           lines      = contents.lines.to_a
           indent     = " #  "

bundler/lib/bundler/fetcher.rb

@@ -318,7 +318,7 @@ def connection
         if ssl_client_cert
           pem = File.read(ssl_client_cert)
           con.cert = OpenSSL::X509::Certificate.new(pem)
-          con.key  = OpenSSL::PKey::RSA.new(pem)
+          con.key  = OpenSSL::PKey.read(pem)
         end
 
         con.read_timeout = Fetcher.api_timeout

bundler/lib/bundler/installer/parallel_installer.rb

@@ -125,7 +125,7 @@ def with_jobserver
       # every native extension build with `fatal error U1065: invalid option
       # '-'`. Skip the jobserver when nmake is in use. Other Windows toolchains
       # such as mingw use GNU make and keep working through the inherited pipe.
-      return yield if nmake?
+      return yield if nmake? || bsd_make?
 
       begin
         r, w = IO.pipe
@@ -155,6 +155,12 @@ def nmake?
       /\bnmake/i.match?(make.to_s)
     end
 
+    def bsd_make?
+      return false unless Gem.freebsd_platform?
+      make = ENV["MAKE"] || ENV["make"] || "make"
+      !/\bgmake/i.match?(make)
+    end
+
     def install_serially
       until finished_installing?
         raise "failed to find a spec to enqueue while installing serially" unless spec_install = @specs.find(&:ready_to_enqueue?)

bundler/lib/bundler/spec_set.rb

@@ -5,7 +5,7 @@
 module Bundler
   class SpecSet
     include Enumerable
-    include TSort
+    include Gem::TSort
 
     def initialize(specs)
       @specs = specs
@@ -315,7 +315,7 @@ def valid_dependencies?(s)
 
     def sorted
       @sorted ||= ([@specs.find {|s| s.name == "rake" }] + tsort).compact.uniq
-    rescue TSort::Cyclic => error
+    rescue Gem::TSort::Cyclic => error
       cgems = extract_circular_gems(error)
       raise CyclicDependencyError, "Your bundle requires gems that depend" \
         " on each other, creating an infinite loop. Please remove either" \