`bundle install` updates lockfile when all dependencies are satisfied

[N0xFF]

Describe the problem as clearly as you can

bundle install updates lockfile when all dependencies are satisfied that leads to the frozen error in production.

Did you try upgrading rubygems & bundler?

Yes.

Bundler 2.6.3
Ruby 3.4.1

Post steps to reproduce the problem

1. Copy Gemfile and Gemfile.lock from the bundle env output that is provided below
2. Run bundle install --deployment.

What were you expecting to happen?

Using net-smtp 0.5.0.

> bundle --verbose
Running `bundle install --verbose` with bundler 2.6.3
Found no changes, using resolution from the lockfile
...
Using net-smtp 0.5.0

What actually happened?

Installing net-smtp 0.5.1 (was 0.5.0). Cannot write a changed lockfile while frozen.

> bundle install --deployment
Fetching gem metadata from https://rubygems.org/.........
Resolving dependencies...
...
Fetching net-smtp 0.5.1 (was 0.5.0)
Installing net-smtp 0.5.1 (was 0.5.0)
...
Cannot write a changed lockfile while frozen.

If not included with the output of your command, run bundle env and paste the output below

`bundle env` output

Environment

Bundler       2.6.3
  Platforms   ruby, x86_64-linux
Ruby          3.4.1p0 (2024-12-25 revision 48d4efcb85000e1ebae42004e963b5d0cedddcf2) [x86_64-linux]
  Full Path   /home/x/.local/share/mise/installs/ruby/3.4.1/bin/ruby
  Config Dir  /home/x/.local/share/mise/installs/ruby/3.4.1/etc
RubyGems      3.6.3
  Gem Home    /home/x/.local/share/mise/installs/ruby/3.4.1/lib/ruby/gems/3.4.0
  Gem Path    /home/x/.local/share/gem/ruby/3.4.0:/home/x/.local/share/mise/installs/ruby/3.4.1/lib/ruby/gems/3.4.0
  User Home   /home/x
  User Path   /home/x/.local/share/gem/ruby/3.4.0
  Bin Dir     /home/x/.local/share/mise/installs/ruby/3.4.1/bin
Tools         
  Git         2.43.0
  RVM         not installed
  rbenv       not installed
  chruby      not installed

Bundler Build Metadata

Built At          2025-01-16
Git SHA           3c7c4ff2d8f
Released Version  true

Gemfile

Gemfile

# frozen_string_literal: true

source "https://rubygems.org"

gem "rails", "7.2.1"

Gemfile.lock

GEM
  remote: https://rubygems.org/
  specs:
    actioncable (7.2.1)
      actionpack (= 7.2.1)
      activesupport (= 7.2.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
    actionmailbox (7.2.1)
      actionpack (= 7.2.1)
      activejob (= 7.2.1)
      activerecord (= 7.2.1)
      activestorage (= 7.2.1)
      activesupport (= 7.2.1)
      mail (>= 2.8.0)
    actionmailer (7.2.1)
      actionpack (= 7.2.1)
      actionview (= 7.2.1)
      activejob (= 7.2.1)
      activesupport (= 7.2.1)
      mail (>= 2.8.0)
      rails-dom-testing (~> 2.2)
    actionpack (7.2.1)
      actionview (= 7.2.1)
      activesupport (= 7.2.1)
      nokogiri (>= 1.8.5)
      racc
      rack (>= 2.2.4, < 3.2)
      rack-session (>= 1.0.1)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
      useragent (~> 0.16)
    actiontext (7.2.1)
      actionpack (= 7.2.1)
      activerecord (= 7.2.1)
      activestorage (= 7.2.1)
      activesupport (= 7.2.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
    actionview (7.2.1)
      activesupport (= 7.2.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
    activejob (7.2.1)
      activesupport (= 7.2.1)
      globalid (>= 0.3.6)
    activemodel (7.2.1)
      activesupport (= 7.2.1)
    activerecord (7.2.1)
      activemodel (= 7.2.1)
      activesupport (= 7.2.1)
      timeout (>= 0.4.0)
    activestorage (7.2.1)
      actionpack (= 7.2.1)
      activejob (= 7.2.1)
      activerecord (= 7.2.1)
      activesupport (= 7.2.1)
      marcel (~> 1.0)
    activesupport (7.2.1)
      base64
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.3.1)
      connection_pool (>= 2.2.5)
      drb
      i18n (>= 1.6, < 2)
      logger (>= 1.4.2)
      minitest (>= 5.1)
      securerandom (>= 0.3)
      tzinfo (~> 2.0, >= 2.0.5)
    base64 (0.2.0)
    bigdecimal (3.1.8)
    builder (3.3.0)
    concurrent-ruby (1.3.4)
    connection_pool (2.4.1)
    crass (1.0.6)
    date (3.4.1)
    drb (2.2.1)
    erubi (1.13.1)
    globalid (1.2.1)
      activesupport (>= 6.1)
    i18n (1.14.6)
      concurrent-ruby (~> 1.0)
    io-console (0.7.2)
    irb (1.14.1)
      rdoc (>= 4.0.0)
      reline (>= 0.4.2)
    logger (1.6.1)
    loofah (2.24.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
    mail (2.8.1)
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
      net-smtp
    marcel (1.0.4)
    mini_mime (1.1.5)
    mini_portile2 (2.8.8)
    minitest (5.25.4)
    net-imap (0.5.4)
      date
      net-protocol
    net-pop (0.1.2)
      net-protocol
    net-protocol (0.2.2)
      timeout
    net-smtp (0.5.0)
    nio4r (2.7.4)
    nokogiri (1.18.1)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    nokogiri (1.18.1-aarch64-linux-gnu)
      racc (~> 1.4)
    nokogiri (1.18.1-aarch64-linux-musl)
      racc (~> 1.4)
    nokogiri (1.18.1-arm-linux-gnu)
      racc (~> 1.4)
    nokogiri (1.18.1-arm-linux-musl)
      racc (~> 1.4)
    nokogiri (1.18.1-arm64-darwin)
      racc (~> 1.4)
    nokogiri (1.18.1-x86_64-darwin)
      racc (~> 1.4)
    nokogiri (1.18.1-x86_64-linux-gnu)
      racc (~> 1.4)
    nokogiri (1.18.1-x86_64-linux-musl)
      racc (~> 1.4)
    psych (5.1.2)
      stringio
    racc (1.8.1)
    rack (2.2.9)
    rack-session (1.0.2)
      rack (< 3)
    rack-test (1.1.0)
      rack (>= 1.0, < 3)
    rackup (1.0.1)
      rack (< 3)
      webrick
    rails (7.2.1)
      actioncable (= 7.2.1)
      actionmailbox (= 7.2.1)
      actionmailer (= 7.2.1)
      actionpack (= 7.2.1)
      actiontext (= 7.2.1)
      actionview (= 7.2.1)
      activejob (= 7.2.1)
      activemodel (= 7.2.1)
      activerecord (= 7.2.1)
      activestorage (= 7.2.1)
      activesupport (= 7.2.1)
      bundler (>= 1.15.0)
      railties (= 7.2.1)
    rails-dom-testing (2.2.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.6.2)
      loofah (~> 2.21)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
    railties (7.2.1)
      actionpack (= 7.2.1)
      activesupport (= 7.2.1)
      irb (~> 1.13)
      rackup (>= 1.0.0)
      rake (>= 12.2)
      thor (~> 1.0, >= 1.2.2)
      zeitwerk (~> 2.6)
    rake (13.2.1)
    rdoc (6.7.0)
      psych (>= 4.0.0)
    reline (0.5.10)
      io-console (~> 0.5)
    securerandom (0.3.1)
    stringio (3.1.1)
    thor (1.3.2)
    timeout (0.4.3)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    useragent (0.16.11)
    webrick (1.9.1)
    websocket-driver (0.7.6)
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
    zeitwerk (2.7.1)

PLATFORMS
  aarch64-linux-gnu
  aarch64-linux-musl
  arm-linux-gnu
  arm-linux-musl
  arm64-darwin
  ruby
  x86-linux-gnu
  x86-linux-musl
  x86_64-darwin
  x86_64-linux-gnu
  x86_64-linux-musl

DEPENDENCIES
  rails (= 7.2.1)

CHECKSUMS
  actioncable (7.2.1) sha256=b409c96b0acc90abe6aa8fd9656eaff0980c1b36c9e22b8f7c490a46eafc2204
  actionmailbox (7.2.1) sha256=09c20d0bcb769a6521d22cb8987e2d1d8335b58610957a6c615c85e6743adf89
  actionmailer (7.2.1) sha256=e4853a32c84105066e64d900ee1025ef075893ee3c51de3a3bc59a6e09586e56
  actionpack (7.2.1) sha256=260b80acc720123f23eb2b106b04d2de7d8cf0492d4eeb2dfa7afc8be36dcaad
  actiontext (7.2.1) sha256=1257a2384373188039fc35d46946e757014710361a4af4481e37b510ac7d7d79
  actionview (7.2.1) sha256=d1f8f4df2bff842a03e2a6e86275e4d73e70c654159617ad4abbe7c6b2aed4f4
  activejob (7.2.1) sha256=eb145f5aaf8276f37b9e4e9f72f3d56b1733172b4be680e836c765f2e6a3c503
  activemodel (7.2.1) sha256=7b24e3927122b99c4623f07607a1d0f1cfd598f9dc5077e70178536dd6663348
  activerecord (7.2.1) sha256=b58a26b9337594f2639cafcc443f4d28d786289f5b5b07b810e8251eeace533c
  activestorage (7.2.1) sha256=e5d6746aa9e5d92fff9d214fad782b6a7189bc080d319c0b196e3dfa1595a676
  activesupport (7.2.1) sha256=7557fa077a592a4f36f7ddacf4d9d71c34aff69ed20236b8a61c22d567da8c24
  base64 (0.2.0) sha256=0f25e9b21a02a0cc0cea8ef92b2041035d39350946e8789c562b2d1a3da01507
  bigdecimal (3.1.8) sha256=a89467ed5a44f8ae01824af49cbc575871fa078332e8f77ea425725c1ffe27be
  builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f
  concurrent-ruby (1.3.4) sha256=d4aa926339b0a86b5b5054a0a8c580163e6f5dcbdfd0f4bb916b1a2570731c32
  connection_pool (2.4.1) sha256=0f40cf997091f1f04ff66da67eabd61a9fe0d4928b9a3645228532512fab62f4
  crass (1.0.6) sha256=dc516022a56e7b3b156099abc81b6d2b08ea1ed12676ac7a5657617f012bd45d
  date (3.4.1) sha256=bf268e14ef7158009bfeaec40b5fa3c7271906e88b196d958a89d4b408abe64f
  drb (2.2.1) sha256=e9d472bf785f558b96b25358bae115646da0dbfd45107ad858b0bc0d935cb340
  erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9
  globalid (1.2.1) sha256=70bf76711871f843dbba72beb8613229a49429d1866828476f9c9d6ccc327ce9
  i18n (1.14.6) sha256=dc229a74f5d181f09942dd60ab5d6e667f7392c4ee826f35096db36d1fe3614c
  io-console (0.7.2) sha256=f0dccff252f877a4f60d04a4dc6b442b185ebffb4b320ab69212a92b48a7a221
  irb (1.14.1) sha256=5975003b58d36efaf492380baa982ceedf5aed36967a4d5b40996bc5c66e80f8
  logger (1.6.1) sha256=3ad9587ed3940bf7897ea64a673971415523f4f7d6b22c5e3af5219705669653
  loofah (2.24.0) sha256=61e6a710883abb8210887f3dc868cf3ed66594c509d9ff6987621efa6651ee1e
  mail (2.8.1) sha256=ec3b9fadcf2b3755c78785cb17bc9a0ca9ee9857108a64b6f5cfc9c0b5bfc9ad
  marcel (1.0.4) sha256=0d5649feb64b8f19f3d3468b96c680bae9746335d02194270287868a661516a4
  mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
  mini_portile2 (2.8.8) sha256=8e47136cdac04ce81750bb6c09733b37895bf06962554e4b4056d78168d70a75
  minitest (5.25.4) sha256=9cf2cae25ac4dfc90c988ebc3b917f53c054978b673273da1bd20bcb0778f947
  net-imap (0.5.4) sha256=b665d23a4eeea6af725a9bda0e3dbb65f06b7907e7a3986c1bbcc5d09444599d
  net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3
  net-protocol (0.2.2) sha256=aa73e0cba6a125369de9837b8d8ef82a61849360eba0521900e2c3713aa162a8
  net-smtp (0.5.0) sha256=5fc0415e6ea1cc0b3dfea7270438ec22b278ca8d524986a3ae4e5ae8d087b42a
  nio4r (2.7.4) sha256=d95dee68e0bb251b8ff90ac3423a511e3b784124e5db7ff5f4813a220ae73ca9
  nokogiri (1.18.1) sha256=df18be7e96c34736b6abfdeda80c6e845134fb9afe2fe5d4fbc1cf1f89c68475
  nokogiri (1.18.1-aarch64-linux-gnu) sha256=35837013800e34342fcbaca305f8c49231f6bd4f779bfa23fe7b4686ae82d5b8
  nokogiri (1.18.1-aarch64-linux-musl) sha256=1b303402cd045f9075a6ee291767c1ffe654b426ed30911e5b47819c21855b22
  nokogiri (1.18.1-arm-linux-gnu) sha256=3b873fd6b0cd1ad7c77e87af701075bdfd14c9a6b2f2965c5e00ed29a5627a37
  nokogiri (1.18.1-arm-linux-musl) sha256=d6fe26f6d1425f403077fbf829fc0ef8e521545c924a13777d6fdf1a0c07c1f3
  nokogiri (1.18.1-arm64-darwin) sha256=d75193f284c899d225943a8944479faedd995a7573ddd5c8308ffbdf2ec55204
  nokogiri (1.18.1-x86_64-darwin) sha256=d94e3aa6483577495fc8969d6b4b5c075840ce6b1ab09636a6d4177ad171051d
  nokogiri (1.18.1-x86_64-linux-gnu) sha256=e516cf16ccde67ed4cc595a2621ca5ddd42562ecb24928914b0045a20a41620e
  nokogiri (1.18.1-x86_64-linux-musl) sha256=f2c389bc100541247edaeaabc6d875b31d72e897471b66a67987b2e4df0192d6
  psych (5.1.2) sha256=337322f58fc2bf24827d2b9bd5ab595f6a72971867d151bb39980060ea40a368
  racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
  rack (2.2.9) sha256=fd6301a97a1c1e955e68f85c861fcb1cde6145a32c532e1ea321a72ff8cc4042
  rack-session (1.0.2) sha256=a02115e5420b4de036839b9811e3f7967d73446a554b42aa45106af335851d76
  rack-test (1.1.0) sha256=154161f40f162b1c009a655b7b0c5de3a3102cc6d7d2e94b64e1f46ace800866
  rackup (1.0.1) sha256=ba86604a28989fe1043bff20d819b360944ca08156406812dca6742b24b3c249
  rails (7.2.1) sha256=fd5684e5d007220960666a3a8b31a57cd1c8cd7f60d88cb40e28e95f1911b705
  rails-dom-testing (2.2.0) sha256=e515712e48df1f687a1d7c380fd7b07b8558faa26464474da64183a7426fa93b
  rails-html-sanitizer (1.6.2) sha256=35fce2ca8242da8775c83b6ba9c1bcaad6751d9eb73c1abaa8403475ab89a560
  railties (7.2.1) sha256=4b6ad279bbfb9228d7e7fbc8df562a8f5d4910e179b957d801fcec176d548463
  rake (13.2.1) sha256=46cb38dae65d7d74b6020a4ac9d48afed8eb8149c040eccf0523bec91907059d
  rdoc (6.7.0) sha256=b17d5f0f57b0853d7b880d4360a32c7caf8dbb81f8503a36426df809e617f379
  reline (0.5.10) sha256=1660c969a792ebd034e6ceee8ca628f3b6698dcdb34f7a282a5edda37b958166
  securerandom (0.3.1) sha256=98f0450c0ea46d2f9a4b6db4f391dbd83dc08049592eada155739f40e0341bde
  stringio (3.1.1) sha256=53456e14175c594e0e8eb2206a1be33f3974d4fe21c131e628908b05c8c2ae1e
  thor (1.3.2) sha256=eef0293b9e24158ccad7ab383ae83534b7ad4ed99c09f96f1a6b036550abbeda
  timeout (0.4.3) sha256=9509f079b2b55fe4236d79633bd75e34c1c1e7e3fb4b56cb5fda61f80a0fe30e
  tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b
  useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844
  webrick (1.9.1) sha256=b42d3c94f166f3fb73d87e9b359def9b5836c426fc8beacf38f2184a21b2a989
  websocket-driver (0.7.6) sha256=f69400be7bc197879726ad8e6f5869a61823147372fd8928836a53c2c741d0db
  websocket-extensions (0.1.5) sha256=1c6ba63092cda343eb53fc657110c71c754c56484aad42578495227d717a8241
  zeitwerk (2.7.1) sha256=0945986050e4907140895378e74df1fe882a2271ed087cc6c6d6b00d415a2756

BUNDLED WITH
   2.6.3

[deivid-rodriguez]

I can reproduce, thanks for reporting. I will have a look soon!

[aaronjensen]

There appears to be an issue with system-installed net-smtp-0.5.0.gemspec that is included in Ruby 3.4.1:

# -*- encoding: utf-8 -*-
# stub: net-smtp 0.5.0 ruby lib

Gem::Specification.new do |s|
  s.name = "net-smtp".freeze
  s.version = "0.5.0".freeze

  s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
  s.metadata = { "homepage_uri" => "https://github.com/ruby/net-smtp", "source_code_uri" => "https://github.com/ruby/net-smtp" } if s.respond_to? :metadata=
  s.require_paths = ["lib".freeze]
  s.authors = ["Yukihiro Matsumoto".freeze]
  s.date = "2024-12-25"
  s.description = "Simple Mail Transfer Protocol client library for Ruby.".freeze
  s.email = ["matz@ruby-lang.org".freeze]
  s.homepage = "https://github.com/ruby/net-smtp".freeze
  s.licenses = ["Ruby".freeze, "BSD-2-Clause".freeze]
  s.required_ruby_version = Gem::Requirement.new(">= 2.6.0".freeze)
  s.rubygems_version = "3.4.20".freeze
  s.summary = "Simple Mail Transfer Protocol client library for Ruby.".freeze

  s.installed_by_version = "3.6.2".freeze
end

It does not have the dependency on net-protocol that it should have.

There was a similar issue in Ruby 3.3.3 with net-pop: https://stackoverflow.com/questions/78617432/strange-bundle-update-issue-disappearing-net-pop-0-1-2-dependency

The issue results in the Gemfile.lock not having a dependency listed for net-smtp (net-protocol) that it expects to have, which appears to force it to go find a different version.

Of course, it shouldn't do this because --deployment was used, so something is wrong with bundler.

Furthermore, if --frozen is used, bundler will use the wrong/newer version anyways and print a red warning indicating that it couldn't update the gemfile, but not result in an error status code. This behavior is a significant hazard, at best. Edit: there is an open issue for this: #8475

[deivid-rodriguez]

Yes, thanks for digging in.

When Bundler detects lockfile dependencies that don't match real remote dependencies, Bundler will re-resolve the lockfile. However, it should resolve using the same version of net-smtp that's already locked and only correct the dependencies, instead of resolving to a higher version of net-smtp.

On top of that, I agree when in frozen mode, Bundler should fail hard in this situation.

Finally, Bundler should better log what's going on and explain the fallback that's going on here.

I will create PRs to fix all of these issues.

[aaronjensen]

Thank you, @deivid-rodriguez

Also, per ruby/net-smtp#92, Ruby 3.4.2 will have a correction for the defective net-smtp gemspec that was included with Ruby 3.4.1 that exposed this issue.

In the interim, folks are encouraged to re-install net-smtp or update to 0.5.1.

[deivid-rodriguez]

In the interim, folks are encouraged to re-install net-smtp or update to 0.5.1.

Yep, next version of Bundler will do the former, and also fix the lockfile.

[aaronjensen]

Yep, next version of Bundler will do the former, and also fix the lockfile.

Unless it's frozen, in which case it will error, correct?

[deivid-rodriguez]

Yes, that's correct.

[deivid-rodriguez]

#8489 should fix the issue of resolving to a higher version than the one locked when incorrect lockfile dependencies are found.

[deivid-rodriguez]

Also, the frozen mode issue was fixed by #8483.