[ruby-on-rails] Bump Gemfile and Bundler to 4.0.10

[hayat01sh1da]

0. Summary

4.0.9 targeted the install phase: gems download and install in parallel more efficiently (split download/install, priority queue for native extensions, BUNDLE_JOBS worker count), and transient network failures are handled with exponential backoff plus a dumb-HTTP fetch fallback.

4.0.10 targeted the resolution phase: version comparison is dramatically faster thanks to integer sort keys and reordered branch logic, while PubGrub's version-selection hot path is now memoised. On the compatibility front, JRuby users sharing a GEM_HOME no longer see false extension warnings, and platform-mismatch errors now include a concrete "run bundle lock --add-platform" hint. A new default_cli_command setting lets users restore Bundler 3's auto-install behaviour, and a regression that broke bundle gem --ext=rust scaffolding was fixed.

1. Bundler 4.0.9

Released: March 28, 2026 | Tag: bundler-v4.0.9 | Commit: 3ce4a32

1-1. Enhancements

• Memoize git version at class level (#9406 by Edouard-chin)
  Each git gem source used to spawn a separate git --version system call (~50 ms each). The version is now checked once and cached at the class level, saving significant overhead in Gemfiles with multiple git sources.
• Normalise parallel worker count via BUNDLE_JOBS (#9400 by Edouard-chin)
  Download and install worker pools previously used a hard-coded count of 5. They now honour the BUNDLE_JOBS setting (defaulting to Etc.nprocessors), making parallel downloads faster — especially behind CDNs like Fastly that front RubyGems.org.
• Exponential backoff for retries (#9163 by ChrisBr)
  Bundler retries previously had no backoff. Retries now use exponential backoff with jitter (1 s base × 2^attempt + 0–0.5 s random), reducing thundering-herd pressure on flaky networks. Closes long-standing #5361.
• Priority queue for native-extension gems (#9389 by Edouard-chin)
  After a gem with native extensions is downloaded and its dependencies are installed, it is now promoted to a priority queue so compilation starts as early as possible instead of waiting at the tail. Benchmarked at ~13 % faster bundle install on a fresh Rails app (gains scale with compilation time).
• Split download from install (#9381 by Edouard-chin)
  Previously Bundler waited for a leaf gem to be fully downloaded and installed before queueing its parent. Now all gems are downloaded first; pure-Ruby gems install immediately while native-extension gems still wait for their deps. This unblocks idle threads and reduces tail latency. Also lays groundwork for a future bundle download command (#9138).

1-2. Bug Fixes

• Retry git fetch without --depth for dumb HTTP (#9405 by hsbt)
  Dumb HTTP git servers cannot handle shallow fetches. Bundler already retried git clone without --depth but the same fallback was missing for git fetch, causing bundle install failures on update. Fixed by refactoring the command assembly and applying the same retry logic. Fixes #9001.

2. Bundler 4.0.10

Released: April 8, 2026 | Tag: bundler-v4.0.10 | Commit: 1c1d885

2-1. Enhancements

• Skip missing_extensions? on JRuby (#8508 by hsbt)
  When sharing a single GEM_HOME across CRuby and JRuby, missing_extensions? produced noisy false-positive warnings (e.g. for jruby-launcher). Since Java-based extensions ship pre-compiled and don't need per-version rebuilds, missing_extensions? now returns false unconditionally on JRuby, silencing the warnings. Closes #3520.
• Better error when platform is missing from lockfile (#9439 by 55728)
  bundle install previously showed a confusing "Could not find gem … with platform X" error while listing that very platform among available gems. The error now appends a clear hint: "Your current platform (X) is not included in the lockfile's platforms (Y). Add it with bundle lock --add-platform X." Fixes #9413.
• Cache PubGrub version-selection results (#9410 by Edouard-chin)
  versions_for(package, range) is called ~3.2 million times during resolution of a large Gemfile (e.g. Shopify monolith). Identical package+constraint lookups are now memoised in a hash, yielding a ~46 % reduction in resolution time (19.2 s → 10.4 s on that monolith).
• Happy-path-first Gem::Version#<=> (#9417 by Edouard-chin)
  Reordered the comparison branches so the equality check executes first — a micro-optimisation measured at 1.29× faster iterations-per-second for equal versions.
• Integer sort key for Gem::Version (#9414 by Edouard-chin)
  Non-prerelease versions with ≤ 4 segments are converted to a single integer sort key, avoiding segment-by-segment comparison. Benchmarked at ~5× faster for less-than / greater-than comparisons. Skipped for 4.0.9 due to a Windows/Ruby-3.3 GC instability issue that was resolved before 4.0.10.
• default_cli_command config option (#8886 by jonbarlo)
  Running bundle with no subcommand now respects a new setting. Set bundle config set default_cli_command install to get the Bundler 3 behaviour (auto-install), or leave the Bundler 4 default (cli_help) to show usage help. Only install and cli_help are accepted; invalid values produce a clear validation error.

2-2. Bug Fixes

• Restore rb_sys gem dependency for Rust extensions (#9416 by bangseongbeom)
  bundle gem --ext=rust generated a Rakefile requiring rb_sys/extensiontask, but #8455 had accidentally dropped the rb_sys gem from the template's dependencies. Running bundle exec rake compile therefore failed with LoadError. The dependency is now restored in the gemspec template.

3. Key Differences at a Glance

Area	4.0.9	4.0.10
Install-phase speed	Split download/install, priority queue for native extensions, normalise BUNDLE_JOBS workers	—
Resolution-phase speed	—	Cache PubGrub version selection (~46 % faster), integer sort key for Gem::Version (~5× faster comparisons), happy-path-first <=>
Network resilience	Exponential backoff with jitter, one-time git version check	—
Cross-platform / JRuby	—	Silence false missing_extensions? warnings on JRuby, actionable error when platform not in lockfile
Configuration	—	New default_cli_command setting (install / cli_help)
Bug fixes	Retry git fetch without --depth for dumb HTTP servers	Restore rb_sys dependency for Rust gem scaffolding

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Ruby on Rails sample apps to use Bundler 4.0.10 across Docker builds and lockfiles.

Changes:

• Bumped BUNDLED WITH from 4.0.9 → 4.0.10 in multiple Gemfile.lock files
• Updated Docker ARG BUNDLER_VERSION to 4.0.10 in corresponding app images

Reviewed changes

Copilot reviewed 3 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
ruby-on-rails/restful-api/Gemfile.lock	Updates lockfile BUNDLED WITH version to 4.0.10
ruby-on-rails/restful-api/Dockerfile	Bumps Docker build-time Bundler version to 4.0.10
ruby-on-rails/perfect-ruby-on-rails/Gemfile.lock	Updates lockfile BUNDLED WITH version to 4.0.10
ruby-on-rails/perfect-ruby-on-rails/Dockerfile	Bumps Docker build-time Bundler version to 4.0.10
ruby-on-rails/e-navigator/Gemfile.lock	Updates lockfile BUNDLED WITH version to 4.0.10
ruby-on-rails/e-navigator/Dockerfile	Bumps Docker build-time Bundler version to 4.0.10

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hayat01sh1da]