net-protocol gets removed with ruby 3.3.3

[9mm]

I'm not sure if this is a problem with net-pop, net-protocol, or some other gem, but after installing ruby 3.3.3, when i do bundle update, net-protocol gets removed from gemfile and breaks deploys

[jamalawd]

I am encountering a similar issue with the net-pop gem during deployment. Specifically, on Ubuntu 24.04 LTS with Ruby 3.3.3, I receive the following error:

bundle stderr: Downloading net-pop-0.1.2 revealed dependencies not in the API or the lockfile
(net-protocol (>= 0)).
Running `bundle update net-pop` should fix the problem.

However, using the same Ruby version on Ubuntu 22.04 LTS, everything works without issues.

Could you please provide more details about the exact error you are facing and which operating system you are using? This information will help in identifying whether the problem is with net-pop, net-protocol, another gem or something with the OS.

[jamalawd]

Following up on my previous comment, I manually added net-protocol under net-pop as dependency in the Gemfile.lock, and everything worked as expected. After this change, running bundle install worked without issues. This is just for our debugging purposes, so we are not sure what is the problem and why it worked on earlier ubuntu version with same ruby but not on latest.

[davekaro]

My reading of the problem is that running bundle update (at least from macOS) is causing net-protocol to be removed from the Gemfile.lock as a dependency of net-pop. This causes downstream problems on CI when trying to install all the gems.

However, using the same Ruby version on Ubuntu 22.04 LTS, everything works without issues.

In my case, it failed for me on an Ubuntu 22.04 LTS Github action runner. Are you sure your ruby 3.3.3 install on Ubuntu 22.04 had no gems installed already?

[hsbt]

I'm not sure why this is happend yet. It may be caused by RubyGems/Bundler or regression of installation script of Ruby package.

I'll investigate that.

[krsyoung]

We're hitting the same issue. In our case we do development with ruby:3-alpine and deploy to production running (ruby:3.3.3-slim - which is debian bookworm). Development is working fine, production fails to deploy with the following message:

remote: 39.09 Using net-protocol 0.2.2        
remote: 46.30 Downloading net-pop-0.1.2 revealed dependencies not in the API or the lockfile        
remote: 46.30 (net-protocol (>= 0)).        
remote: 46.30 Either installing with `--full-index` or running `bundle update net-pop` should        
remote: 46.30 fix the problem.  

When running:

RUN bundle install && \
    bundle exec bootsnap precompile --gemfile && \
    rm -rf ~/.bundle/ $BUNDLE_PATH/ruby/*/cache $BUNDLE_PATH/ruby/*/bundler/gems/*/.git

Relevant Gemfile.lock lines:

    net-imap (0.4.12)
      date
      net-protocol
    net-pop (0.1.2)
    net-protocol (0.2.2)
      timeout
    net-smtp (0.5.0)
      net-protocol

To confirm, development is indeed 3.3.3:

/app # ruby -v
ruby 3.3.3 (2024-06-12 revision f1c7b6f435) [x86_64-linux-musl]

@jamalawd good hack 👍 This does indeed work in Gemfile.lock:

    net-imap (0.4.12)
      date
      net-protocol
    net-pop (0.1.2)
      net-protocol
    net-protocol (0.2.2)
      timeout
    net-smtp (0.5.0)
      net-protocol

[Bjoernsen]

I have the same issue and asked for a solution at Stackoverflow. Based on the comment of the user Alex, it seems to be a Ruby 3.3.3 issue Looks like gemspec files are part of the ruby releases, so it's just broken out of the box https://stackoverflow.com/a/78620570/776481

[rjhancock]

Unfortunately adding it to the Gemfile.lock isn't viable on my end as I run updates too often. Had to revert to the previous version for it to work within my CI/CD system.

Hopefully this gets fixed on one end or the other. Not critical for us as we don't use POP, just annoying.

[jamalawd]

@rjhancock I found an alternative solution that worked for me. I deleted the gemspec file for the net-pop gem, and after that, everything worked smoothly with bundle update.

rm ~/.rbenv/versions/3.3.3/lib/ruby/gems/3.3.0/specifications/net-pop-0.1.2.gemspec

[rjhancock]

I appreciate it but I'm also using the Docker image as well so unless they fix the docker image, I need to stick to my solution.

[hsbt]

I could reproduce this. This issue caused by regression of install script of Ruby package. I created backport request with fixed commits for Ruby 3.3.

• https://bugs.ruby-lang.org/issues/20581#note-2
• [Bug #20581][3.3] Fix unintentional truncation for dependencies of bundled gems ruby#11006

If you use ruby-build, you can install the correct version of Ruby 3.3 with the following command:

$ rbenv install --patch 3.3.3 < <(curl -sSL https://patch-diff.githubusercontent.com/raw/ruby/ruby/pull/11006.patch)

Sorry to inconvenient experience for the latest stable vesion. Thanks.

[schneems]

To cross-post a temporary workaround until Ruby 3.3.4 is released ruby/ruby#11006 (comment)

Putting this in the Gemfile will work for all systems (including Heroku)

# Needed until Ruby 3.3.4 is released https://github.com/ruby/ruby/pull/11006
gem 'net-pop', github: 'ruby/net-pop'

[schinery]

While pointing at GitHub would resolve the install issue, it would mean (I think) that Dependabot checks would fail unless insecure-external-code-execution is set to allow.

Was wondering if it would be possible to publish a 0.1.3 version of this gem, seems there are a couple of commits not in 0.1.2, and then people could update to use that version via bundler without pointing at the GitHub repo?

[gbs4ever]

we had the same issue when updating our Rails version 7.1.3.4 app to Ruby 3.3.3 and deploying to Heroku-22 , this seems to help gem 'net-pop', github: 'ruby/net-pop'

[sameignatovich]

Seems like resolved in 3.3.4: https://github.com/ruby/ruby/releases/tag/v3_3_4

[cody-elhard]

A few extra steps that fixed this issue for me in an existing rails application

1. set ruby to 3.3.4
2. gem uninstall net-pop
3. bundle up net-pop

[joshuapinter]

Like @cody-elhard mentioned, running bundle update net-pop was critical to add the net-protocol dependency in the Gemfile.lock file. Otherwise, you get the same error message.

[stephannv]

Is this a problem with Ruby 3.4.0.preview1?
On CI I got:

Downloading net-smtp-0.5.0 revealed dependencies not in the API or the lockfile
(net-protocol (>= 0)).
Running `bundle update net-smtp` should fix the problem.
Error: The process '/opt/hostedtoolcache/Ruby/3.4.0-preview1/x64/bin/bundle' failed with exit code 34

My gemfile lock:

    mail (2.8.1)
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
      net-smtp
    ...
    net-imap (0.4.16)
      date
      net-protocol
    net-pop (0.1.2)
      net-protocol
    net-protocol (0.2.2)
      timeout

[hsbt]

3.4.0-preview1 is old version today. If you want to test development version, use "head" instead of "3.4.0-preview1".

[Vagab]

@hsbt I got the same error as stated here with 3.4.0-preview2

[hsbt]

No. 3.4.0-preview2 has correct gemspec.

see

$ pwd
/Users/hsbt/.local/share/rbenv/versions/3.4.0-preview2/lib/ruby/gems/3.4.0+0/specifications
~/.l/s/r/v/3/l/r/g/3/specifications (master)
$ cat net-pop-0.1.2.gemspec
# -*- encoding: utf-8 -*-
# stub: net-pop 0.1.2 ruby lib

Gem::Specification.new do |s|
  s.name = "net-pop".freeze
  s.version = "0.1.2".freeze

  s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
  s.metadata = { "homepage_uri" => "https://github.com/ruby/net-pop", "source_code_uri" => "https://github.com/ruby/net-pop" } if s.respond_to? :metadata=
  s.require_paths = ["lib".freeze]
  s.authors = ["Yukihiro Matsumoto".freeze]
  s.bindir = "exe".freeze
  s.date = "2024-10-07"
  s.description = "Ruby client library for POP3.".freeze
  s.email = ["matz@ruby-lang.org".freeze]
  s.homepage = "https://github.com/ruby/net-pop".freeze
  s.licenses = ["Ruby".freeze, "BSD-2-Clause".freeze]
  s.rubygems_version = "3.6.0.dev".freeze
  s.summary = "Ruby client library for POP3.".freeze

  s.installed_by_version = "3.6.0.dev".freeze

  s.specification_version = 4

  s.add_runtime_dependency(%q<net-protocol>.freeze, [">= 0".freeze])
end

[Vagab]

thanks for the response. I’ll check if there’s something else that can be wrong with my setup
However, the comment I referenced lists the issue with the gem net-smtp, not net-pop. Might be the wrong place to continue this thread then, but it’s the only one I found