5eb9a6925b (master): [ruby/rubygems] Keep lockfile parsing from loading Bundler source plugins

[Hiroshi SHIBATA]

Hiroshi SHIBATA 2026-08-26 04:57:32 +0000 (Wed, 26 Aug 2026)

New Revision: 5eb9a6925b

https://github.com/ruby/ruby/commit/5eb9a6925b

Log:
[ruby/rubygems] Keep lockfile parsing from loading Bundler source plugins

A PLUGIN SOURCE section sends Bundler::Plugin.from_lock looking for the
plugin that handles it, and finding one loads and runs that plugin's
`plugins.rb`. The plugin index is read from the lockfile directory, so a
repository could run code just by being installed from with
`gem install -g`. Nothing here can use a plugin source anyway.

https://github.com/ruby/rubygems/commit/1b9f1e166c

Co-Authored-By: Claude Fable 5 <nor...@anthropic.com>

Modified files:
lib/rubygems/request_set.rb
test/rubygems/test_gem_request_set.rb