Pin lockfile dependencies to the version their section resolved

The parser removed in #9564 turned a `!` entry in the DEPENDENCIES
section into a `= <version>` requirement. Bundler's LockfileParser
records the pinned source on the dependency and leaves the requirement
at `>= 0`, so `gem install -g` could resolve a newer published version
over the locked GIT or PATH one. Keeping the version as each section is
read pins prereleases too, and lets a PATH section pin to the gemspec on
disk the way the old parser did.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hsbt

lib/rubygems/request_set.rb

@@ -349,6 +349,8 @@ def load_lockfile(lock_file) # :nodoc:
 
     parser = Bundler::LockfileParser.new(File.read(lock_file), lockfile_path: lock_file)
 
+    locked_versions = {}
+
     parser.specs.group_by(&:source).each do |source, specs|
       case source
       when Bundler::Source::Rubygems
@@ -357,6 +359,7 @@ def load_lockfile(lock_file) # :nodoc:
         lock_set = Gem::Resolver::LockSet.new(remotes)
         specs.each do |spec|
           added = lock_set.add(spec.name, spec.version.to_s, spec.platform)
+          locked_versions[spec.name] ||= spec.version
           spec.dependencies.each do |dep|
             added.each {|s| s.add_dependency dep }
           end
@@ -373,21 +376,33 @@ def load_lockfile(lock_file) # :nodoc:
             source.revision,
             source.submodules || false
           )
+          locked_versions[spec.name] ||= spec.version
           spec.dependencies.each {|dep| git_spec.add_dependency dep }
         end
         @sets << git_set
       when Bundler::Source::Path
         vendor_set = Gem::Resolver::VendorSet.new
         specs.each do |spec|
           loaded = vendor_set.add_vendor_gem(spec.name, source.path.to_s)
+          locked_versions[spec.name] ||= loaded.version
           spec.dependencies.each {|dep| loaded.dependencies << dep }
         end
         @sets << vendor_set
       end
     end
 
     parser.dependencies.each_value do |dep|
-      gem dep.name, *dep.requirement.as_list
+      requirements = dep.requirement.as_list
+
+      # A dependency the lockfile ties to a source replaces whatever it asks
+      # for with the version that source resolved, the way the parser this
+      # replaced did. For a PATH section that is the version of the gemspec on
+      # disk, not the one the lockfile records.
+      if dep.source && (version = locked_versions[dep.name])
+        requirements = [version]
+      end
+
+      gem dep.name, *requirements
     end
   ensure
     Bundler.instance_variable_set(:@root, previous_root) if defined?(previous_root)

test/rubygems/test_gem_request_set.rb

@@ -354,6 +354,7 @@ def test_load_gemdeps_with_lockfile_gem_section
             a (1)
             b (1)
               a (~> 1.0)
+            b (3-x86_64-linux)
 
         PLATFORMS
           #{Gem::Platform::RUBY}
@@ -365,9 +366,23 @@ def test_load_gemdeps_with_lockfile_gem_section
 
     rs.load_gemdeps "gem.deps.rb"
 
+    assert_equal [dep("b")], rs.dependencies
+
     lock_set = rs.sets.find {|set| Gem::Resolver::LockSet === set }
     refute_nil lock_set, "LockSet should be created from GEM section"
-    assert_equal %w[a-1 b-1], lock_set.specs.map(&:full_name).sort
+    assert_equal %w[a-1 b-1 b-3], lock_set.specs.map(&:full_name).sort
+
+    expected = [
+      Gem::Platform::RUBY,
+      Gem::Platform::RUBY,
+      Gem::Platform.new("x86_64-linux"),
+    ]
+
+    assert_equal expected, lock_set.specs.sort_by(&:full_name).map(&:platform)
+
+    spec = lock_set.specs.find {|s| s.full_name == "b-1" }
+
+    assert_equal [dep("a", "~> 1.0")], spec.dependencies
   end
 
   def test_load_gemdeps_with_lockfile_git_section
@@ -383,7 +398,9 @@ def test_load_gemdeps_with_lockfile_git_section
           remote: git://example/a.git
           revision: deadbeef
           specs:
-            a (1)
+            a (2)
+              b (>= 3)
+              c
 
         PLATFORMS
           #{Gem::Platform::RUBY}
@@ -395,9 +412,42 @@ def test_load_gemdeps_with_lockfile_git_section
 
     rs.load_gemdeps "gem.deps.rb"
 
+    assert_equal [dep("a", "= 2")], rs.dependencies
+
     git_set = rs.sets.find {|set| Gem::Resolver::GitSet === set }
     refute_nil git_set, "GitSet should be created from GIT section"
-    assert_includes git_set.specs.keys, "a"
+    assert_equal %w[a-2], git_set.specs.values.map(&:full_name)
+
+    assert_equal [dep("b", ">= 3"), dep("c")],
+                 git_set.specs.values.first.dependencies
+  end
+
+  def test_load_gemdeps_with_lockfile_git_section_prerelease
+    rs = Gem::RequestSet.new
+
+    File.open "gem.deps.rb", "w" do |io|
+      io.puts 'gem "a", :git => "git://example/a.git"'
+    end
+
+    File.open "gem.deps.rb.lock", "w" do |io|
+      io.puts <<~LOCKFILE
+        GIT
+          remote: git://example/a.git
+          revision: deadbeef
+          specs:
+            a (1.0.0.pre1)
+
+        PLATFORMS
+          #{Gem::Platform::RUBY}
+
+        DEPENDENCIES
+          a!
+      LOCKFILE
+    end
+
+    rs.load_gemdeps "gem.deps.rb"
+
+    assert_equal [dep("a", "= 1.0.0.pre1")], rs.dependencies
   end
 
   def test_load_gemdeps_with_lockfile_path_section
@@ -426,11 +476,46 @@ def test_load_gemdeps_with_lockfile_path_section
 
     rs.load_gemdeps "gem.deps.rb"
 
+    assert_equal [dep("a", "= 1")], rs.dependencies
+
     vendor_set = rs.sets.find {|set| Gem::Resolver::VendorSet === set }
     refute_nil vendor_set, "VendorSet should be created from PATH section"
     assert_equal %w[a-1], vendor_set.specs.values.map(&:full_name)
   end
 
+  def test_load_gemdeps_with_lockfile_path_section_newer_than_lockfile
+    _, _, directory = vendor_gem "a", 2
+
+    rs = Gem::RequestSet.new
+
+    File.open "gem.deps.rb", "w" do |io|
+      io.puts "gem \"a\", :path => #{directory.inspect}"
+    end
+
+    File.open "gem.deps.rb.lock", "w" do |io|
+      io.puts <<~LOCKFILE
+        PATH
+          remote: #{directory}
+          specs:
+            a (1)
+
+        PLATFORMS
+          #{Gem::Platform::RUBY}
+
+        DEPENDENCIES
+          a!
+      LOCKFILE
+    end
+
+    rs.load_gemdeps "gem.deps.rb"
+
+    assert_equal [dep("a", "= 2")], rs.dependencies
+
+    vendor_set = rs.sets.find {|set| Gem::Resolver::VendorSet === set }
+    assert_equal %w[a-2], vendor_set.specs.values.map(&:full_name)
+    assert_equal %w[a-2], vendor_set.find_all(dep("a", "= 2")).map(&:full_name)
+  end
+
   def test_load_gemdeps_with_missing_lockfile
     rs = Gem::RequestSet.new