[pull] master from ruby:master

lib/bundler/bundler.gemspec

@@ -36,9 +36,11 @@ Gem::Specification.new do |s|
 
   s.files = Dir.glob("lib/bundler{.rb,/**/*}", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
 
-  # Bundler reuses RubyGems' vendored URI. Ship a copy under lib/rubygems so
-  # Bundler stays self-contained on RubyGems versions that predate it.
+  # Bundler reuses RubyGems' vendored URI and SecureRandom. Ship a copy under
+  # lib/rubygems so Bundler stays self-contained on RubyGems versions that
+  # predate them.
   s.files += Dir.glob("lib/rubygems/vendor/uri/**/*", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+  s.files += Dir.glob("lib/rubygems/vendor/securerandom/**/*", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
 
   # include the gemspec itself because warbler breaks w/o it
   s.files += %w[lib/bundler/bundler.gemspec]

lib/bundler/vendored_securerandom.rb

@@ -1,12 +1,15 @@
 # frozen_string_literal: true
 
-# Use RubyGems vendored copy when available. Otherwise fallback to Bundler
-# vendored copy. The vendored copy in Bundler can be removed once support for
-# RubyGems 3.5.18 is dropped.
+# Reuse RubyGems' vendored SecureRandom (Gem::SecureRandom). The Bundler gem
+# ships a copy under lib/rubygems/vendor, so this resolves even on RubyGems
+# versions that predate it. Fall back to the stdlib only when no vendored copy
+# is available at all.
 
-begin
-  require "rubygems/vendored_securerandom"
-rescue LoadError
-  require_relative "vendor/securerandom/lib/securerandom"
-  Gem::SecureRandom = Bundler::SecureRandom
+unless defined?(Gem::SecureRandom)
+  begin
+    require "rubygems/vendor/securerandom/lib/securerandom"
+  rescue LoadError
+    require "securerandom"
+    Gem::SecureRandom = SecureRandom
+  end
 end

lib/rubygems/vendor/securerandom/lib/securerandom.rb

@@ -38,6 +38,10 @@
 # If a secure random number generator is not available,
 # +NotImplementedError+ is raised.
 
+# Skip reloading when an identical copy (e.g. the one shipped inside the Bundler
+# gem) was already required from a different path, to avoid redefinition warnings.
+return if defined?(Gem::SecureRandom::VERSION)
+
 module Gem::SecureRandom
 
   # The version

spec/bundler/bundler/friendly_errors_spec.rb

@@ -133,11 +133,9 @@
 
     context "Java::JavaLang::OutOfMemoryError", :jruby_only do
       it "Bundler.ui receive error" do
-        install_gemfile <<-G, raise_on_error: false, env: { "JRUBY_OPTS" => "-J-Xmx32M" }, artifice: nil
-          source "https://gem.repo1"
-        G
-
-        expect(err).to include("JVM has run out of memory")
+        error = Java::JavaLang::OutOfMemoryError.new
+        expect(Bundler.ui).to receive(:error).with(/JVM has run out of memory/)
+        Bundler::FriendlyErrors.log_error(error)
       end
     end
 

spec/bundler/support/path.rb

@@ -345,7 +345,7 @@ def git_ls_files(glob)
     end
 
     def tracked_files_glob
-      ruby_core? ? "libexec/bundle* lib/bundler lib/bundler.rb lib/rubygems/vendor/uri spec/bundler man/bundle*" : "exe/bundle exe/bundler lib/bundler lib/bundler.rb lib/rubygems/vendor/uri bundler.gemspec CHANGELOG-bundler.md LICENSE-bundler.md README-bundler.md"
+      ruby_core? ? "libexec/bundle* lib/bundler lib/bundler.rb lib/rubygems/vendor/uri lib/rubygems/vendor/securerandom spec/bundler man/bundle*" : "exe/bundle exe/bundler lib/bundler lib/bundler.rb lib/rubygems/vendor/uri lib/rubygems/vendor/securerandom bundler.gemspec CHANGELOG-bundler.md LICENSE-bundler.md README-bundler.md"
     end
 
     def lib_tracked_files_glob