gemfile

The purpose is to replace the versions of your gems in your Gemfile with the latest one.

I'm simply waiting for the time where I can just replace a line in my Gemfile and reap the benefits.

The gemfile.lock and friends make this a bit less of a problem, but you also get to lock things like libxml version or ffmpeg or...

I would love to be able to upload my project's Gemfile and then have the option to subscribe to everything there.

You can specify a specific version of a plugin in the Gemfile and it will never change, but you'll be able to update everything else.

Is the vulnerability scanner of Gemfile based on bundler-audit[1]?

Like Gemfile or requirements.txt, but for Emacs.

If you have this gem: gem 'rails', '~> 3.2.12' It will become: gem 'rails', '~> 4.2.3' If you have: gem 'rails' It will become: gem 'rails', '~> 4.2.3' It's recommended to put versions in your Gemfile specially if you're updating to a major version.

This is almost nothing like having Gemfile.lock and committing it to the project code repo, saving each changeset after every "bundle update".

"You're not going to be storing any sensitive information in your Gemfile.locks" That's not accurate.

When a build of all the packages succeeds, Stackage generates a "snapshot", a list of all the package versions used for that build (sort of like a Gemfile.lock/Podfile.lock, for the whole ecosystem).

This is what CocoaPods + Bundler uses to figure out the dependency trees (Podfile.lock/Gemfile.lock) for your project.

Must be cumbersome, there's no equivalent of Gemfile.lock and bundler for apt-get, is there?

My approach is often to periodically delete npm-shrinkwrap.json, Gemfile.lock, composer.lock, etc.