Prevent loading all non-Bundler gems

Library/Homebrew/brew.sh

@@ -568,11 +568,11 @@ then
   # Don't allow non-developers to customise Ruby warnings.
   unset HOMEBREW_RUBY_WARNINGS
 
-  # Disable Ruby options we don't need. RubyGems provides a decent speedup.
+  # Disable Ruby options we don't need.
-  RUBY_DISABLE_OPTIONS="--disable=gems,did_you_mean,rubyopt"
+  RUBY_DISABLE_OPTIONS="--disable=did_you_mean,rubyopt"
 else
   # Don't disable did_you_mean for developers as it's useful.
-  RUBY_DISABLE_OPTIONS="--disable=gems,rubyopt"
+  RUBY_DISABLE_OPTIONS="--disable=rubyopt"
 fi
 
 if [[ -z "$HOMEBREW_RUBY_WARNINGS" ]]

Library/Homebrew/cleanup.rb

@@ -3,7 +3,6 @@
 
 require "utils/bottles"
 
-require "utils/gems"
 require "formula"
 require "cask/cask_loader"
 require "set"

Library/Homebrew/global.rb

@@ -16,7 +16,6 @@ require "rbconfig"
 RUBY_PATH = Pathname.new(RbConfig.ruby).freeze
 RUBY_BIN = RUBY_PATH.dirname.freeze
 
-require "rubygems"
 # Only require "core_ext" here to ensure we're only requiring the minimum of
 # what we need.
 require "active_support/core_ext/object/blank"

Library/Homebrew/homebrew_bootsnap.rb

@@ -17,13 +17,10 @@ else
 end
 
 if homebrew_bootsnap_enabled
-  require "rubygems"
-
   begin
     require "bootsnap"
   rescue LoadError
     unless ENV["HOMEBREW_BOOTSNAP_RETRY"]
-      require "utils/gems"
       Homebrew.install_bundler_gems!(only_warn_on_failure: true)
 
       ENV["HOMEBREW_BOOTSNAP_RETRY"] = "1"

Library/Homebrew/load_path.rb

@@ -5,12 +5,21 @@ require "pathname"
 
 HOMEBREW_LIBRARY_PATH = Pathname(__dir__).realpath.freeze
 
-$LOAD_PATH.push HOMEBREW_LIBRARY_PATH.to_s
+require_relative "utils/gems"
+Homebrew.setup_gem_environment!(setup_path: false)
 
-require "vendor/bundle/bundler/setup"
+$LOAD_PATH.push HOMEBREW_LIBRARY_PATH.to_s unless $LOAD_PATH.include?(HOMEBREW_LIBRARY_PATH.to_s)
-require "homebrew_bootsnap"
+require_relative "vendor/bundle/bundler/setup"
-
-unless defined?(Bootsnap)
-  $LOAD_PATH.select! { |d| Pathname(d).directory? }
 $LOAD_PATH.uniq!
+
+# Block any gem loading by bypassing rubygem's `require`.
+# Helps make sure we don't accidentally use things not in bundler's load path.
+# Bundler 2.2.7+ and non-standalone mode both do this automatically.
+# https://github.com/rubygems/rubygems/blob/5841761974bef324a33ef1cb650bbf8a2457805b/bundler/lib/bundler/installer/standalone.rb#L55-L63
+if Kernel.private_method_defined?(:gem_original_require)
+  Kernel.send(:remove_method, :require)
+  Kernel.send(:define_method, :require, Kernel.instance_method(:gem_original_require))
+  Kernel.send(:private, :require)
 end
+
+require_relative "homebrew_bootsnap"

Library/Homebrew/utils/gems.rb

@@ -22,7 +22,6 @@ module Homebrew
   end
 
   def gem_user_bindir
-    require "rubygems"
     "#{gem_user_dir}/bin"
   end
 
@@ -51,13 +50,11 @@ module Homebrew
     end
   end
 
-  def setup_gem_environment!(gem_home: nil, gem_bindir: nil)
+  def setup_gem_environment!(gem_home: nil, gem_bindir: nil, setup_path: true)
-    require "rubygems"
-
     # Match where our bundler gems are.
     gem_home ||= "#{ENV["HOMEBREW_LIBRARY"]}/Homebrew/vendor/bundle/ruby/#{RbConfig::CONFIG["ruby_version"]}"
     ENV["GEM_HOME"] = gem_home
-    ENV["GEM_PATH"] = "#{ENV["GEM_HOME"]}:#{Gem.default_dir}"
+    ENV["GEM_PATH"] = gem_home
 
     # Set TMPDIR so Xcode's `make` doesn't fall back to `/var/tmp/`,
     # which may be not user-writable.
@@ -67,6 +64,8 @@ module Homebrew
     Gem.clear_paths
     Gem::Specification.reset
 
+    return unless setup_path
+
     # Add necessary Ruby and Gem binary directories to `PATH`.
     gem_bindir ||= Gem.bindir
     paths = ENV.fetch("PATH").split(":")
@@ -103,7 +102,6 @@ module Homebrew
   end
 
   def install_bundler!
-    require "rubygems"
     setup_gem_environment!(gem_home: gem_user_dir, gem_bindir: gem_user_bindir)
     install_gem_setup_path!(
       "bundler",

Library/Homebrew/utils/sorbet.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 if ENV["HOMEBREW_SORBET_RUNTIME"]
-  require "utils/gems"
   Homebrew.install_bundler_gems!
   require "sorbet-runtime"
 else