From f2fde274506fa1731e576d9fca237764103b56db Mon Sep 17 00:00:00 2001
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
Date: Tue, 27 Jan 2026 18:28:44 +0900
Subject: [ruby/rubygems] Only use parent source with Git and Path sources

https://github.com/ruby/rubygems/commit/c5da276610
---
 lib/bundler/definition.rb                    |  2 +-
 spec/bundler/install/gemfile/sources_spec.rb | 41 ++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/lib/bundler/definition.rb b/lib/bundler/definition.rb
index 5ab577f504..639740e46b 100644
--- a/lib/bundler/definition.rb
+++ b/lib/bundler/definition.rb
@@ -1077,7 +1077,7 @@ module Bundler
             end
           end
 
-          if parent_dep
+          if parent_dep && parent_dep.source.is_a?(Source::Path)
             replacement_source = parent_dep.source
           else
             replacement_source = sources.get(lockfile_source)
diff --git a/spec/bundler/install/gemfile/sources_spec.rb b/spec/bundler/install/gemfile/sources_spec.rb
index 90f87ed0c5..69b0816a18 100644
--- a/spec/bundler/install/gemfile/sources_spec.rb
+++ b/spec/bundler/install/gemfile/sources_spec.rb
@@ -1195,4 +1195,45 @@ RSpec.describe "bundle install with gems on multiple sources" do
       expect(gem_section).not_to include("activerecord (7.0.0)")
     end
   end
+
+  context "when a scoped rubygems source is missing a transitive dependency" do
+    before do
+      build_repo2 do
+        build_gem "fallback_dep", "1.0.0"
+        build_gem "foo", "1.0.0"
+      end
+
+      build_repo3 do
+        build_gem "private_parent", "1.0.0" do |s|
+          s.add_dependency "fallback_dep"
+        end
+      end
+
+      gemfile <<-G
+        source "https://gem.repo2"
+
+        gem "foo"
+
+        source "https://gem.repo3" do
+          gem "private_parent", "1.0.0"
+        end
+      G
+
+      bundle :install, artifice: "compact_index"
+    end
+
+    it "falls back to the default rubygems source for that dependency" do
+      build_repo2 do
+        build_gem "foo", "2.0.0"
+      end
+
+      system_gems []
+
+      bundle "update foo", artifice: "compact_index"
+
+      expect(the_bundle).to include_gems("private_parent 1.0.0", "fallback_dep 1.0.0", "foo 2.0.0")
+      expect(the_bundle).to include_gems("private_parent 1.0.0", source: "remote3")
+      expect(the_bundle).to include_gems("fallback_dep 1.0.0", source: "remote2")
+    end
+  end
 end
-- 
cgit v1.2.3