Different result between bundle and bundle update

[winston]

Hi, I am seeing a different result between bundle and bundle update (or bundle lock --update).

I am on bundler 1.11.2 and the difference is reproducible with this Gemfile:

source 'https://rubygems.org'
ruby '2.2.3'

gem 'capybara'
gem 'mail'

When I run bundle install. This Gemfile.lock will be generated:

$ bundle
Using mime-types 2.99
Using mini_portile2 2.0.0
Using rack 1.6.4
Using bundler 1.11.2
Using mail 2.6.3
Using nokogiri 1.6.7.1
Using rack-test 0.6.3
Using xpath 2.0.0
Using capybara 2.5.0
Bundle complete! 2 Gemfile dependencies, 9 gems now installed.
Bundled gems are installed into ./vendor/bundle.

# Gemfile.lock
GEM
  remote: https://rubygems.org/
  specs:
    capybara (2.5.0)
      mime-types (>= 1.16)
      nokogiri (>= 1.3.3)
      rack (>= 1.0.0)
      rack-test (>= 0.5.4)
      xpath (~> 2.0)
    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    mime-types (2.99)
    mini_portile2 (2.0.0)
    nokogiri (1.6.7.1)
      mini_portile2 (~> 2.0.0.rc2)
    rack (1.6.4)
    rack-test (0.6.3)
      rack (>= 1.0)
    xpath (2.0.0)
      nokogiri (~> 1.3)

PLATFORMS
  ruby

DEPENDENCIES
  capybara
  mail

BUNDLED WITH
   1.11.2

At this point, if I run bundle update or bundle lock --update, mime-types-data would be added.

$ bundle update
Fetching gem metadata from https://rubygems.org/..........
Fetching version metadata from https://rubygems.org/..
Resolving dependencies...
Using mime-types 2.99
Using rack 1.6.4
Using bundler 1.11.2
Using mini_portile2 2.0.0
Using mail 2.6.3
Using rack-test 0.6.3
Using nokogiri 1.6.7.1
Using xpath 2.0.0
Using capybara 2.5.0
Bundle updated!

$ git diff
diff --git a/Gemfile.lock b/Gemfile.lock
index 4a680fa..3aa662b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -10,6 +10,7 @@ GEM
     mail (2.6.3)
       mime-types (>= 1.16, < 3)
     mime-types (2.99)
+    mime-types-data (3.2015.1120)
     mini_portile2 (2.0.0)
     nokogiri (1.6.7.1)
       mini_portile2 (~> 2.0.0.rc2)

However, if I run bundle again, then mime-types-data would be gone.

I had a look at mime-types https://rubygems.org/gems/mime-types/versions/3.0 and only v3.0 requires mime-types-data 3.2015.1120 as a dependency while mime-types < 3 doesn't have that as a dependency.

Given the resolved Gemfile.lock (this portion specifically):

    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    mime-types (2.99)

The eventual resolved and installed version of mime-types should be 2.99 and hence mime-types-data should not be required as a dependency. But somehow I think bundle update didn't resolve it correctly, whereas bundle install did.

Is this a bug with bundler or with the gems involved, or am I doing something wrong?

Thank you in advance!!!

[indirect]

@segiddins this looks like your wheelhouse

[segiddins]

Resolving dependencies...Creating possibility state for capybara (36 remaining)
  Attempting to activate capybara (2.5.0)
  Activated capybara at capybara (2.5.0)
  Requiring nested dependencies (nokogiri (>= 1.3.3), mime-types (>= 1.16), rack (>= 1.0.0), rack-test (>= 0.5.4), xpath (~> 2.0))
  Creating possibility state for xpath (~> 2.0) (1 remaining)
    Attempting to activate xpath (2.0.0)
    Activated xpath at xpath (2.0.0)
    Requiring nested dependencies (nokogiri (~> 1.3))
    Creating possibility state for nokogiri (>= 1.3.3) (37 remaining)
      Attempting to activate nokogiri (1.6.7.1)
      Activated nokogiri at nokogiri (1.6.7.1)
      Requiring nested dependencies (mini_portile2 (~> 2.0.0.rc2))
      Creating possibility state for nokogiri (~> 1.3) (40 remaining)
        Attempting to activate nokogiri (1.6.7.1)
        Found existing spec (nokogiri (1.6.7.1))
        Creating possibility state for rack-test (>= 0.5.4) (8 remaining)
          Attempting to activate rack-test (0.6.3)
          Activated rack-test at rack-test (0.6.3)
          Requiring nested dependencies (rack (>= 1.0))
          Creating possibility state for mini_portile2 (~> 2.0.0.rc2) (2 remaining)
            Attempting to activate mini_portile2 (2.0.0)
            Activated mini_portile2 at mini_portile2 (2.0.0)
            Requiring nested dependencies ()
            Creating possibility state for rack (>= 1.0.0) (48 remaining)
              Attempting to activate rack (1.6.4)
              Activated rack at rack (1.6.4)
              Requiring nested dependencies ()
              Creating possibility state for rack (>= 1.0) (48 remaining)
                Attempting to activate rack (1.6.4)
                Found existing spec (rack (1.6.4))
                Creating possibility state for mime-types (>= 1.16) (27 remaining)
                  Attempting to activate mime-types (3.0)
                  Activated mime-types at mime-types (3.0)
                  Requiring nested dependencies (mime-types-data (~> 3.2015))
                  Creating possibility state for mime-types-data (~> 3.2015) (1 remaining)
                    Attempting to activate mime-types-data (3.2015.1120)
                    Activated mime-types-data at mime-types-data (3.2015.1120)
                    Requiring nested dependencies ()
                    Creating possibility state for mail (70 remaining)
                      Attempting to activate mail (2.6.3)
                      Activated mail at mail (2.6.3)
                      Requiring nested dependencies (mime-types (< 3, >= 1.16))
                      Creating possibility state for mime-types (< 3, >= 1.16) (26 remaining)
                        Attempting to activate mime-types (2.99)
                        Found existing spec (mime-types (3.0))
                        Activated mime-types at mime-types (2.99)
                        Requiring nested dependencies ()

[segiddins]

Looks like a bug in Molinillo with swapping, I'll try and debug that when I get the chance. Thanks for the excellent bug report!

[winston]

Thank you! 🙇

[obfuscoder]

Unfortunatelly I still get this issue with bundler 1.13.6 and another Gemfile.

bundle update results in the added dependencies:

mime-types-data (3.2016.0521)
public_suffix (2.0.4)

After running bundle install the dependencies disappear again.

I think it has something to do with the Gemfile. We have several platform specific dependencies (ruby, java, x64-mingw32) and the Gemfile.lock lists all of them. There might be a difference in the transient dependencies for different platforms.

[segiddins]

@obfuscoder please open a new issue with steps to reproduce. Thanks!