carlhuda/bundler — Issue #1668: Top-level Gemfile in multi-gem project "leaks" dependencies
Author: dekellum
Created: 2012-02-19 01:09:09+00:00
State: open

I maintain several multiple-gem in a single git-repo projects. Introducing Bundler in these projects was of great utility for:

1. Better controlling per-gem dependencies, for example when running tests.
2. Allowing cross-gem updates/testing without constantly needing to `gem install` incremental changes.

To enable the last in particular and keep things as easy to operate as possible, I'm using a single project top-level Gemfile. A much more prominent example of this style of Bundler usage is in rails:

https://github.com/rails/rails (see the top-level Gemfile)

There is a subtle flaw IMO in Bundler's behavior with these setups, in that any gem declared in any of the project gemspecs' is visible or `require` accessible from any other gem in the project, regardless of the gem's specific gemspec. This can lead to post-release surprises on gemspec declaration flaws, as Rubygems does not and could not have the same leaks.

The following sample project demonstrates this problem in tests:

https://github.com/dekellum/bundler-dep-leak

The alternative approach would be to use independent Gemfile's in each gem subdirectory. There are no dependency leaks in this case. See passing tests for the sample here:

https://github.com/dekellum/bundler-dep-leak/tree/sub-gemfiles

I find myself needing to switch to this per-Gemfile style setup periodically to test that my gemspec dependencies are correct and to fix any dependency issues. I then find myself switching back to take advantage of (2) above, and given that a single top-level Gemfile makes the project easier to use with a single top-level `bundle install` or `bundle update`. But this switching is proving tedious at best. It could be avoided by a Bundler fix for the dependency leaks, or restated as a feature request:

* _Bundler should restrain resolving/activating gems to only the regular and development dependencies declared directly by, or transitive regular dependencies of, the gemspec found/declared in the current working directory._

* If no gemspec is found in the current working directory, the current behavior is preserved.

* There is no change in the common case of a single Gemfile, single gemspec project.

At minimum I hope to shed light on this "leak" issue. If you guys agree that this is Bundler's issue or the above feature is desirable, I will be happy to attempt an implementation.