Address remaining cooldown review follow-ups - #9801
Merged
Merged
Conversation
The resolver asks for the cooldown once per candidate spec, paying a Bundler.settings lookup each time, so read it once per remote. That makes the value a snapshot, which is fine because nothing changes the setting after the sources are built. Also check the day count before the locked specs lookup, so a resolve without a cooldown configured stops earlier.
A cooldown from a config file or from BUNDLE_COOLDOWN went through value.to_i, so "abc" became 0 and "-5" stayed negative, and either one disabled the cooldown without saying so. Read it with Integer() and warn, naming the effect: such a value disables the cooldown for every source, overriding any per-source cooldown: in the Gemfile. The check runs at the CLI entry point rather than while reading the setting, so bundle config does not warn merely for listing settings, and bundle outdated does not swallow it inside Bundler.ui.silence. gem warns the same way for gemrc values, including ones that are not even numbers, and rejects a negative --cooldown outright.
A created_at without a time zone offset was parsed as local time, so a third-party server that omits the offset shifted the cooldown window by whatever offset the machine running bundler happened to have. rubygems.org always sends one, so this never showed up against it. Complete the missing offset with "Z" before parsing, which leaves the set of accepted formats unchanged. Time.new(value, in: "UTC") would be the obvious way to say this, but it raises TypeError on JRuby, and rescue ArgumentError does not catch that. gem outdated and gem update read timestamps through a second parser in Gem::Source that still used local time, so route both through one helper.
hsbt
force-pushed
the
cooldown-review-followups
branch
from
August 24, 2026 08:03
1b8cf53 to
ea314c4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements three remaining review findings from #9576.
effective_cooldownnow memoizes theBundler.settingslookup that the resolver makes once per candidate spec, andcooldown_excluded?checks the day count before touching the locked specs. The lookup being memoized means the value is a snapshot, which is fine because nothing changes the cooldown setting after the sources are built.An invalid cooldown coming from a config file or from
BUNDLE_COOLDOWNused to disable the cooldown silently. It now warns, and says the cooldown ends up disabled for every source, because such a value also overrides any per-sourcecooldown:in the Gemfile. The check runs at the CLI entry point rather than while reading the setting, sobundle configdoes not warn merely for listing settings andbundle outdateddoes not swallow the warning inside itsBundler.ui.silenceblock.gemwarns the same way for gemrc values, and rejects a negative--cooldownoutright.A
created_attimestamp without a time zone offset was read as local time, which shifted the cooldown window by whatever offset the machine happened to have. Both halves now complete the missing offset and parse it as UTC.gem outdatedandgem updateread timestamps through a second parser inGem::Sourcethat the first pass missed, so both paths share one helper now.