Editing Bundler dependencies

Pin a sealed version in the Gemfile, including transitive overrides by adding gem entries.

Direct dependencies

The Bundler manifest is Gemfile. Update the gem version constraint:

-gem 'rails', '7.0.4'
+gem 'rails', '7.0.4-sp1'

Run bundle install; the resolved gem is the sealed version pulled through ruby.sealsecurity.io.

Transitive dependencies (add a gem entry)

Bundler does not have a dedicated transitive-override syntax. To force a transitive to a sealed version, add a gem entry for it directly in Gemfile, pinned to the sealed version:

 gem 'rails', '7.0.4'
+gem 'nokogiri', '1.15.6-sp1'

Bundler's resolver treats the new entry as a direct requirement, which takes precedence over the version any depending gem asks for. The entry does not have to be adjacent to the gem that brings the transitive in.

Related

• Configuring Bundler: the package-manager setup that points Bundler at the Seal Artifact Server.