[ccutrer]

includes a major version bump. now that Bundler has first-class support for DSL hooks and proper locking of plugins, we can simplify a lot of stuff. this includes the preamble, so a lot of the new code is to handle automatically updating the preamble. several pre-existing bugs were found, and checksums are now supported.

specs have been cleaned up due to version changes of available gems, new ruby versions, and avoiding flaky interactions with system gems. spec helpers have been added and improved.

[Copilot]

Copilot review overview

🟡 Changes recommended

Preamble migration can corrupt Gemfiles, and lockfile validation and selection have unresolved correctness issues.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Regex removes statement-separating newlines · New
• Fallback incorrectly expands explicit lockfile paths · New
• Lockfile synchronization misses newly added gems · New

What changed in this PR

Upgrades Bundler::Multilock to 2.0, adopting Bundler 4.1’s native plugin support.

Changes:

• Simplifies plugin loading and automatically migrates Gemfile preambles.
• Updates lockfile selection and lock-only synchronization.
• Raises runtime requirements and refreshes tests, dependencies, and CI.

File	Description
spec/​bundler/​multilock_spec.rb	Updates compatibility coverage and isolates installed gems.
README.md	Documents requirements and simplified setup.
plugins.rb	Registers the pre-evaluation hook.
lib/​bundler/​multilock/​version.rb	Bumps version to 2.0.0.
lib/​bundler/​multilock/​ext/​plugin.rb	Removes the plugin-loading workaround.
lib/​bundler/​multilock/​ext/​dsl.rb	Updates lockfile handling and argument forwarding.
lib/​bundler/​multilock/​ext/​definition.rb	Adjusts lockfile assignment.
lib/​bundler/​multilock/​ext/​bundler.rb	Separates native and Multilock lockfile selection.
lib/​bundler/​multilock/​check.rb	Adds lock-only validation mode.
lib/​bundler/​multilock.rb	Migrates preambles and updates synchronization.
Gemfile.lock	Refreshes dependencies and Bundler version.
Gemfile	Simplifies plugin setup.
CLAUDE.md	Adds development and compatibility notes.
bundler-multilock.gemspec	Requires Ruby 3.2 and Bundler 4.1.
.rubocop.yml	Targets Ruby 3.2.
.github/​workflows/​ci.yml	Updates Ruby and Bundler coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Explicit subprocess lockfile overrides can be ignored, and preamble migration can leave incompatible version constraints.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve explicit nested BUNDLE_LOCKFILE overrides · New
• Replace all version constraints during migration · New

Resolved since last review (3)

• Regex removes statement-separating newlines
• Lockfile synchronization misses newly added gems
• Fallback incorrectly expands explicit lockfile paths

[Copilot]

Copilot review overview

🟡 Changes recommended

Lockfile path selection, commented preamble upgrades, and checksum consistency checks have unresolved correctness issues.

Review effort: Balanced
Findings: 3

Open (3)

• Preserve absolute lockfile paths without .lock suffixes · New
• Handle comments between version constraints during rewrites · New
• Detect checksum conflicts for shared locked specs · New

Resolved since last review (2)

• Preserve explicit nested BUNDLE_LOCKFILE overrides
• Replace all version constraints during migration

[Copilot]

Copilot review overview

🔵 Needs a closer look

Bundler internals and environment handling require human review with cross-version integration results, alongside resolution of the retained issues.

Review effort: Balanced
Findings: 1

Open (1)

• Normalize unparenthesized guards before injecting the plugin guard · New

Resolved since last review (3)

• Detect checksum conflicts for shared locked specs
• Handle comments between version constraints during rewrites
• Preserve absolute lockfile paths without .lock suffixes

Previously missed (1)

In code that hasn't changed since last review

Match checksum sources before copying parent checksums

lib/​bundler/​multilock.rb:553

Require matching sources before copying checksums, as Check#checksums_match? already does. Matching only full_name also matches the same gem, version, and platform from a different registry. If those registries serve different artifacts, this overwrites the alternate artifact's checksum with the parent's digest and can cause subsequent downloads to fail checksum validation.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Unresolved correctness issues and extensive Bundler lifecycle changes require fixes and human validation.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Raw Gemfile substitutions rewrite strings, heredocs, and comments · New
• Checksum inheritance ignores gem source differences · New
• Frozen lock validation incorrectly requires gems to be installed · New
• Offline resolution incorrectly forces remote checksum lookup · New

Resolved since last review (1)

• Normalize unparenthesized guards before injecting the plugin guard

[Copilot]

🟡 Changes recommended

Preamble guard placement can prevent plugin discovery, and nested absolute-path selection can activate conflicting lockfiles.

1 open finding

• Guard before plugin declaration prevents plugin discovery · New

4 resolved since last review

• Checksum inheritance ignores gem source differences
• Raw Gemfile substitutions rewrite strings, heredocs, and comments
• Offline resolution incorrectly forces remote checksum lookup
• Frozen lock validation incorrectly requires gems to be installed

Previously missed (1)

In code that hasn't changed since last review

Nested lockfile resolution activates duplicate declarations

lib/​bundler/​multilock.rb:457

In a nested Bundler command, a newly supplied absolute BUNDLE_LOCKFILE can differ from the inherited original value. For /project/custom, this fallback then returns both /project/custom and custom. If the Gemfile declares both lockfile "./custom" and lockfile "custom", add_lockfile activates both and raises “Only one lockfile … can be flagged as active.” Resolve these alternatives to a single declaration, preferring an exact path match, or preserve the original selector across nested commands. Add a regression test combining nested execution with these two declarations.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Preamble rewriting and nested lockfile routing can corrupt Gemfiles or lockfiles and reject valid configurations.

4 open findings

• Synchronization redirects alternate lockfile writes to Gemfile.lock · New
• Heredoc-valued plugin path is corrupted during Gemfile rewriting · New
• Nested selector ambiguously activates multiple lockfiles · New
• Alternate lockfile path is incorrectly normalized during nested checks · New

1 resolved since last review

• Guard before plugin declaration prevents plugin discovery

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The cross-cutting Bundler lifecycle and checksum changes need human review and integration validation across supported runtimes.

0 open findings

4 resolved since last review

• Heredoc-valued plugin path is corrupted during Gemfile rewriting
• Synchronization redirects alternate lockfile writes to Gemfile.lock
• Alternate lockfile path is incorrectly normalized during nested checks
• Nested selector ambiguously activates multiple lockfiles

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Changes to private Bundler internals, automatic Gemfile rewriting, and checksum synchronization need human validation across supported runtimes.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Critical plugin-loading and preamble-injection issues remain unresolved.

2 open findings

• Avoid private cli_loaded? call during plugin loading · New
• Keep injected preamble outside scoped source blocks · New

Previously missed (1)

In code that hasn't changed since last review

Fix prerelease-incompatible Bundler requirement in example

README.md:58

This example uses ~> 2.0, which does not satisfy the version currently declared by this PR (2.0.0.beta1); users copying the documented preamble during this release will have Bundler reject the plugin requirement. Use a prerelease-aware requirement such as ~> 2.0.0.beta1, or update the documentation when the final 2.0.0 is released.

This issue also appears on line 104 of the same file.

🧠 Review effort: Lite

[ccutrer]

Builds passing with this:

• canvas-lms
• switchman
• switchman-inst-jobs