Feature #19776
closed
Warn bundled gems when it called from `require`
Description
We should warn when users try to load default gems that will be promoted bundled gems at next version. We will warn them only under the bundler environment without Gemfile.
- Ruby 3.3:
- Warn for adding bundled gems to be addressed Ruby 3.4 to Gemfile when user load its gem without
gem 'foo'in their Gemfile.- Target libraries are TBD
- Also warn existing bundled gems was loaded without
gem 'foo'of Gemfile. Ex. net-smtp, rexml etc.
- Warn for adding bundled gems to be addressed Ruby 3.4 to Gemfile when user load its gem without
- Ruby 3.4:
- Promote bundled gems.
- Raise LoadError same as current behavior with warnings of Ruby 3.3.
- Warn same as Ruby 3.3.
- Promote bundled gems.
I implemented PoC for this: https://github.com/ruby/ruby/pull/8096
Updated by vo.x (Vit Ondruch) almost 2 years ago
Isn't it time that upstream should start to encourage that every part of the StdLib should be listed in Gemfile? How long it is the URI gem fixing MEDIUM rated CVE was released and who uses it? Who added it into their Gemfile? Who even noticed that there is some vulnerability to fix?
Really, the current practice "it is part of StdLib, therefore I don't list it anywhere among dependencies" should be discouraged. The PR should actually be updated to warn when any part of StdLib is loaded without being listed as a dependency in either Gemfile or transitively via different gem.
Updated by hsbt (Hiroshi SHIBATA) almost 2 years ago
I submit https://github.com/rubygems/rubygems/pull/6831 to RubyGems upstream.
Updated by 
Updated by