diff --git a/.github/workflows/annocheck.yml b/.github/workflows/annocheck.yml
index ac1b338af5f713..b276b273b41919 100644
--- a/.github/workflows/annocheck.yml
+++ b/.github/workflows/annocheck.yml
@@ -41,7 +41,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     env:
diff --git a/.github/workflows/baseruby.yml b/.github/workflows/baseruby.yml
index 2002a49414c920..42c2fd0936b55c 100644
--- a/.github/workflows/baseruby.yml
+++ b/.github/workflows/baseruby.yml
@@ -37,7 +37,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     strategy:
diff --git a/.github/workflows/check_sast.yml b/.github/workflows/check_sast.yml
index 216a1b146827b5..9259afe66f7903 100644
--- a/.github/workflows/check_sast.yml
+++ b/.github/workflows/check_sast.yml
@@ -54,19 +54,16 @@ jobs:
     permissions:
       actions: read # for github/codeql-action/init to get workflow details
       contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/autobuild to send a status report
+      security-events: write # for github/codeql-action/upload-sarif to send a status report
     # CodeQL fails to run pull requests from dependabot due to missing write access to upload results.
     if: >-
       ${{!(false
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
-    env:
-      enable_install_doc: no
-
     strategy:
       fail-fast: false
       matrix:
@@ -80,29 +77,11 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install libraries
-        if: ${{ contains(matrix.os, 'macos') }}
-        uses: ./.github/actions/setup/macos
-
-      - name: Install libraries
-        if : ${{ matrix.os == 'ubuntu-latest' }}
-        uses: ./.github/actions/setup/ubuntu
-
-      - uses: ./.github/actions/setup/directories
-
-      - name: Remove an obsolete rubygems vendored file
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        run: sudo rm /usr/lib/ruby/vendor_ruby/rubygems/defaults/operating_system.rb
-
       - name: Initialize CodeQL
         uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
         with:
           languages: ${{ matrix.language }}
-          trap-caching: false
-          debug: true
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+          build-mode: none
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
@@ -134,6 +113,17 @@ jobs:
         if: ${{ matrix.language == 'ruby' }}
         continue-on-error: true
 
+      - name: filter-sarif
+        uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1.0.1.1
+        with:
+          patterns: |
+            +**/*.c
+            +**/*.h
+          input: sarif-results/${{ matrix.language }}.sarif
+          output: sarif-results/${{ matrix.language }}.sarif
+        if: ${{ matrix.language == 'cpp' }}
+        continue-on-error: true
+
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
         with:
diff --git a/.github/workflows/compilers.yml b/.github/workflows/compilers.yml
index d02adc30e2da89..f678eabd1c2ba4 100644
--- a/.github/workflows/compilers.yml
+++ b/.github/workflows/compilers.yml
@@ -37,7 +37,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
     steps:
       - run: true
diff --git a/.github/workflows/cygwin.yml b/.github/workflows/cygwin.yml
index eb90647b7e830d..850f654167e41e 100644
--- a/.github/workflows/cygwin.yml
+++ b/.github/workflows/cygwin.yml
@@ -34,7 +34,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps:
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 6727fbc004120e..e3e81c309e4150 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -57,7 +57,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps:
diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index 6a1278ae757db3..56f734df8644f3 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -79,7 +79,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/vcpkg'))
       )}}
 
     steps:
diff --git a/.github/workflows/modgc.yml b/.github/workflows/modgc.yml
index f96648c06b70ed..1b9ef7c49bcc5f 100644
--- a/.github/workflows/modgc.yml
+++ b/.github/workflows/modgc.yml
@@ -44,7 +44,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps:
diff --git a/.github/workflows/parse_y.yml b/.github/workflows/parse_y.yml
index ca9b7e0cb40e40..fcd9fb70de5833 100644
--- a/.github/workflows/parse_y.yml
+++ b/.github/workflows/parse_y.yml
@@ -47,7 +47,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps:
diff --git a/.github/workflows/rust-warnings.yml b/.github/workflows/rust-warnings.yml
index 07ec32133dc0c9..23ed16440573ae 100644
--- a/.github/workflows/rust-warnings.yml
+++ b/.github/workflows/rust-warnings.yml
@@ -32,7 +32,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
diff --git a/.github/workflows/spec_guards.yml b/.github/workflows/spec_guards.yml
index 6301f02bf2a2a4..d889442a4dbd00 100644
--- a/.github/workflows/spec_guards.yml
+++ b/.github/workflows/spec_guards.yml
@@ -31,7 +31,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     strategy:
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 76035a73963c13..7b7a1af318357c 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -56,7 +56,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps: &make-steps
@@ -198,7 +198,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps: *make-steps
@@ -218,7 +218,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps:
diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
index 616bacc32021bd..4f6e10a6f9318e 100644
--- a/.github/workflows/wasm.yml
+++ b/.github/workflows/wasm.yml
@@ -55,7 +55,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps:
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 431581a0f21a2e..7cf3e3af007e4b 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -46,7 +46,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/vcpkg'))
       )}}
 
     name: Windows ${{ matrix.os }}/Visual C++ ${{ matrix.vc }} (${{ matrix.test_task }})
diff --git a/.github/workflows/wsl.yml b/.github/workflows/wsl.yml
index 640f18ce42e876..a857c5f4b1458d 100644
--- a/.github/workflows/wsl.yml
+++ b/.github/workflows/wsl.yml
@@ -23,7 +23,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
       )}}
 
     steps:
diff --git a/.github/workflows/yjit-macos.yml b/.github/workflows/yjit-macos.yml
index 23a49a9291ebf0..0f7fe0556b5a86 100644
--- a/.github/workflows/yjit-macos.yml
+++ b/.github/workflows/yjit-macos.yml
@@ -37,7 +37,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
@@ -81,7 +81,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
diff --git a/.github/workflows/yjit-ubuntu.yml b/.github/workflows/yjit-ubuntu.yml
index 5df617998ac732..6dc52c1567a7ea 100644
--- a/.github/workflows/yjit-ubuntu.yml
+++ b/.github/workflows/yjit-ubuntu.yml
@@ -32,7 +32,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
@@ -66,7 +66,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
@@ -121,7 +121,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
diff --git a/.github/workflows/zjit-macos.yml b/.github/workflows/zjit-macos.yml
index a59704f3504c65..224f8cbb556b0a 100644
--- a/.github/workflows/zjit-macos.yml
+++ b/.github/workflows/zjit-macos.yml
@@ -65,7 +65,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
@@ -93,7 +93,7 @@ jobs:
           rustup install ${{ matrix.rust_version }} --profile minimal
           rustup default ${{ matrix.rust_version }}
 
-      - uses: taiki-e/install-action@0d865d5cc6d507df4765f1f866bfae8bab4e2a73 # v2.69.7
+      - uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2.69.9
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}
@@ -188,7 +188,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
diff --git a/.github/workflows/zjit-ubuntu.yml b/.github/workflows/zjit-ubuntu.yml
index a86717c6e9f429..12d33ac67232ef 100644
--- a/.github/workflows/zjit-ubuntu.yml
+++ b/.github/workflows/zjit-ubuntu.yml
@@ -37,7 +37,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
@@ -102,7 +102,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
@@ -119,7 +119,7 @@ jobs:
           ruby-version: '3.1'
           bundler: none
 
-      - uses: taiki-e/install-action@0d865d5cc6d507df4765f1f866bfae8bab4e2a73 # v2.69.7
+      - uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2.69.9
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-check' }}
@@ -246,7 +246,7 @@ jobs:
       || contains(github.event.head_commit.message, '[DOC]')
       || contains(github.event.pull_request.title, '[DOC]')
       || contains(github.event.pull_request.labels.*.name, 'Documentation')
-      || (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
       )}}
 
     steps:
diff --git a/lib/bundler.rb b/lib/bundler.rb
index 26e946e0598154..8bec10c0db8746 100644
--- a/lib/bundler.rb
+++ b/lib/bundler.rb
@@ -156,6 +156,7 @@ def setup(*groups)
       # Return if all groups are already loaded
       return @setup if defined?(@setup) && @setup
 
+      configure_custom_gemfile
       definition.validate_runtime!
 
       SharedHelpers.print_major_deprecations!
@@ -586,6 +587,15 @@ def configure_gem_home_and_path(path = bundle_path)
       Bundler.rubygems.clear_paths
     end
 
+    def configure_custom_gemfile(custom_gemfile = nil)
+      custom_gemfile ||= Bundler.settings[:gemfile]
+
+      if custom_gemfile && !custom_gemfile.empty?
+        Bundler::SharedHelpers.set_env "BUNDLE_GEMFILE", File.expand_path(custom_gemfile)
+        reset_settings_and_root!
+      end
+    end
+
     def self_manager
       @self_manager ||= begin
                           require_relative "bundler/self_manager"
diff --git a/lib/bundler/cli.rb b/lib/bundler/cli.rb
index 0f234f26b956b1..9a0f756bcf827f 100644
--- a/lib/bundler/cli.rb
+++ b/lib/bundler/cli.rb
@@ -61,11 +61,7 @@ def initialize(*args)
 
       current_cmd = args.last[:current_command].name
 
-      custom_gemfile = options[:gemfile] || Bundler.settings[:gemfile]
-      if custom_gemfile && !custom_gemfile.empty?
-        Bundler::SharedHelpers.set_env "BUNDLE_GEMFILE", File.expand_path(custom_gemfile)
-        reset_settings = true
-      end
+      Bundler.configure_custom_gemfile(options[:gemfile])
 
       # lock --lockfile works differently than install --lockfile
       unless current_cmd == "lock"
diff --git a/lib/bundler/definition.rb b/lib/bundler/definition.rb
index 69842b4813fa3e..a923a8cb20e8c4 100644
--- a/lib/bundler/definition.rb
+++ b/lib/bundler/definition.rb
@@ -487,12 +487,6 @@ def validate_ruby!
                 "Your Ruby version is #{actual}, but your Gemfile specified #{expected}"
               when :engine_version
                 "Your #{Bundler::RubyVersion.system.engine} version is #{actual}, but your Gemfile specified #{ruby_version.engine} #{expected}"
-              when :patchlevel
-                if !expected.is_a?(String)
-                  "The Ruby patchlevel in your Gemfile must be a string"
-                else
-                  "Your Ruby patchlevel is #{actual}, but your Gemfile specified #{expected}"
-                end
         end
 
         raise RubyVersionMismatch, msg
diff --git a/lib/bundler/injector.rb b/lib/bundler/injector.rb
index 21ff90ad1313a6..3f8bf14e38e3ba 100644
--- a/lib/bundler/injector.rb
+++ b/lib/bundler/injector.rb
@@ -80,11 +80,10 @@ def remove(gemfile_path, lockfile_path)
     def conservative_version(spec)
       version = spec.version
       return ">= 0" if version.nil?
-      segments = version.segments
       seg_end_index = version >= Gem::Version.new("1.0") ? 1 : 2
 
       prerelease_suffix = version.to_s.delete_prefix(version.release.to_s) if version.prerelease?
-      "#{version_prefix}#{segments[0..seg_end_index].join(".")}#{prerelease_suffix}"
+      "#{version_prefix}#{version.segments[0..seg_end_index].join(".")}#{prerelease_suffix}"
     end
 
     def version_prefix
diff --git a/lib/bundler/ruby_version.rb b/lib/bundler/ruby_version.rb
index 7f60dde4768ddd..aeff07582eb386 100644
--- a/lib/bundler/ruby_version.rb
+++ b/lib/bundler/ruby_version.rb
@@ -96,8 +96,6 @@ def diff(other)
         [:version, versions_string(versions), versions_string(other.versions)]
       elsif @input_engine && !matches?(engine_versions, other.engine_gem_version)
         [:engine_version, versions_string(engine_versions), versions_string(other.engine_versions)]
-      elsif patchlevel && (!patchlevel.is_a?(String) || !other.patchlevel.is_a?(String) || !matches?(patchlevel, other.patchlevel))
-        [:patchlevel, patchlevel, other.patchlevel]
       end
     end
 
diff --git a/lib/bundler/settings.rb b/lib/bundler/settings.rb
index d120faca61fa1c..120a3202afd5dc 100644
--- a/lib/bundler/settings.rb
+++ b/lib/bundler/settings.rb
@@ -59,6 +59,7 @@ class Settings
       bin
       cache_path
       console
+      default_cli_command
       gem.ci
       gem.github_username
       gem.linter
diff --git a/lib/bundler/settings/validator.rb b/lib/bundler/settings/validator.rb
index 9aa1627fb2e2ee..70a0ca36d46001 100644
--- a/lib/bundler/settings/validator.rb
+++ b/lib/bundler/settings/validator.rb
@@ -74,6 +74,13 @@ def self.validate!(key, value, settings)
           fail!(key, value, "`#{other_key}` is current set to #{other_setting.inspect}", "the `#{conflicting.join("`, `")}` groups conflict")
         end
       end
+
+      rule %w[default_cli_command], "default_cli_command must be either 'install' or 'cli_help'" do |key, value, _settings|
+        valid_values = %w[install cli_help]
+        if !value.nil? && !valid_values.include?(value.to_s)
+          fail!(key, value, "must be one of: #{valid_values.join(", ")}")
+        end
+      end
     end
   end
 end
diff --git a/spec/bundler/bundler/ruby_version_spec.rb b/spec/bundler/bundler/ruby_version_spec.rb
index b96893cefe8cc5..0d41ec99014e4a 100644
--- a/spec/bundler/bundler/ruby_version_spec.rb
+++ b/spec/bundler/bundler/ruby_version_spec.rb
@@ -137,7 +137,7 @@
         end
       end
 
-      context "the versions, pathlevels, engines, and engine_versions match" do
+      shared_examples_for "the versions, engines, and engine_versions match" do
         it "should return true" do
           expect(subject).to eq(other_ruby_version)
         end
@@ -149,6 +149,12 @@
         it_behaves_like "two ruby versions are not equal"
       end
 
+      context "the patchlevels do not match" do
+        let(:other_patchlevel) { "21" }
+
+        it_behaves_like "the versions, engines, and engine_versions match"
+      end
+
       context "the engines do not match" do
         let(:other_engine) { "ruby" }
 
@@ -222,9 +228,9 @@
         end
       end
 
-      shared_examples_for "there is a difference in the patchlevels" do
-        it "should return a tuple with :patchlevel and the two different patchlevels" do
-          expect(ruby_version.diff(other_ruby_version)).to eq([:patchlevel, patchlevel, other_patchlevel])
+      shared_examples_for "even there is a difference in the patchlevels" do
+        it "should return nil" do
+          expect(ruby_version.diff(other_ruby_version)).to be_nil
         end
       end
 
@@ -281,10 +287,10 @@
         it_behaves_like "there is a difference in the engine versions"
       end
 
-      context "detects patchlevel discrepancies last" do
+      context "ignores patchlevel discrepancies last" do
         let(:other_patchlevel) { "643" }
 
-        it_behaves_like "there is a difference in the patchlevels"
+        it_behaves_like "even there is a difference in the patchlevels"
       end
 
       context "successfully matches gem requirements" do
@@ -349,7 +355,7 @@
         let(:other_engine)         { "ruby" }
         let(:other_engine_version) { "2.0.5" }
 
-        it_behaves_like "there is a difference in the patchlevels"
+        it_behaves_like "even there is a difference in the patchlevels"
       end
 
       context "successfully detects bad gem requirements with engine versions" do
@@ -383,7 +389,7 @@
         context "and comparing with a patchlevel that is not -1" do
           let(:other_patchlevel)     { "642" }
 
-          it_behaves_like "there is a difference in the patchlevels"
+          it_behaves_like "even there is a difference in the patchlevels"
         end
       end
     end
diff --git a/spec/bundler/bundler/settings_spec.rb b/spec/bundler/bundler/settings_spec.rb
index 592db81e9b9039..39a8b36b3d658f 100644
--- a/spec/bundler/bundler/settings_spec.rb
+++ b/spec/bundler/bundler/settings_spec.rb
@@ -351,4 +351,25 @@
       expect(settings["mirror.https://rubygems.org/"]).to eq("http://example-mirror.rubygems.org")
     end
   end
+
+  describe "default_cli_command validation" do
+    it "accepts 'install' as a valid value" do
+      expect { settings.set_local("default_cli_command", "install") }.not_to raise_error
+    end
+
+    it "accepts 'cli_help' as a valid value" do
+      expect { settings.set_local("default_cli_command", "cli_help") }.not_to raise_error
+    end
+
+    it "rejects invalid values" do
+      expect { settings.set_local("default_cli_command", "invalid") }.to raise_error(
+        Bundler::InvalidOption,
+        /Setting `default_cli_command` to "invalid" failed:\n - default_cli_command must be either 'install' or 'cli_help'\n - must be one of: install, cli_help/
+      )
+    end
+
+    it "accepts nil values" do
+      expect { settings.set_local("default_cli_command", nil) }.not_to raise_error
+    end
+  end
 end
diff --git a/spec/bundler/commands/add_spec.rb b/spec/bundler/commands/add_spec.rb
index b1b323f725646d..ed98a914f326c4 100644
--- a/spec/bundler/commands/add_spec.rb
+++ b/spec/bundler/commands/add_spec.rb
@@ -51,16 +51,12 @@
     end
 
     it "version requirement becomes ~> major.minor.patch.pre when resolved version is < 1.0" do
-      # Ruby 3.3 on Windows has a native crash (SEGV in rb_ary_cmp during Array#join) related to Object Shape optimization.
-      skip "Ruby 3.3 on Windows crashes with SEGV in Array#join" if Gem.win_platform? && RUBY_VERSION.start_with?("3.3.")
       bundle "add 'cat'"
       expect(bundled_app_gemfile.read).to match(/gem "cat", "~> 0.12.3.pre"/)
       expect(the_bundle).to include_gems "cat 0.12.3.pre"
     end
 
     it "version requirement becomes ~> major.minor.pre when resolved version is > 1.0.pre" do
-      # Ruby 3.3 on Windows has a native crash (SEGV in rb_ary_cmp during Array#join) related to Object Shape optimization.
-      skip "Ruby 3.3 on Windows crashes with SEGV in Array#join" if Gem.win_platform? && RUBY_VERSION.start_with?("3.3.")
       bundle "add 'dog'"
       expect(bundled_app_gemfile.read).to match(/gem "dog", "~> 1.1.pre"/)
       expect(the_bundle).to include_gems "dog 1.1.3.pre"
diff --git a/spec/bundler/commands/platform_spec.rb b/spec/bundler/commands/platform_spec.rb
index 1e233e0917b026..9d7354c54f3d57 100644
--- a/spec/bundler/commands/platform_spec.rb
+++ b/spec/bundler/commands/platform_spec.rb
@@ -302,9 +302,9 @@ def should_be_engine_version_incorrect
     expect(err).to be_include("Your #{local_ruby_engine} version is #{local_engine_version}, but your Gemfile specified #{local_ruby_engine} #{not_local_engine_version}")
   end
 
-  def should_be_patchlevel_incorrect
-    expect(exitstatus).to eq(18)
-    expect(err).to be_include("Your Ruby patchlevel is #{RUBY_PATCHLEVEL}, but your Gemfile specified #{not_local_patchlevel}")
+  def should_ignore_patchlevel
+    expect(exitstatus).to eq(0)
+    expect(err).to eq("")
   end
 
   def should_be_patchlevel_fixnum
@@ -382,7 +382,7 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "doesn't install when patchlevel doesn't match" do
+    it "does install even when patchlevel doesn't match" do
       install_gemfile <<-G, raise_on_error: false
         source "https://gem.repo1"
         gem "myrack"
@@ -390,8 +390,8 @@ def should_be_patchlevel_fixnum
         #{patchlevel_incorrect}
       G
 
-      expect(bundled_app_lock).not_to exist
-      should_be_patchlevel_incorrect
+      expect(bundled_app_lock).to exist
+      should_ignore_patchlevel
     end
   end
 
@@ -481,7 +481,7 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "checks fine even when patchlevel doesn't match" do
       install_gemfile <<-G
         source "https://gem.repo1"
         gem "myrack"
@@ -494,8 +494,8 @@ def should_be_patchlevel_fixnum
         #{patchlevel_incorrect}
       G
 
-      bundle :check, raise_on_error: false
-      should_be_patchlevel_incorrect
+      bundle :check
+      should_ignore_patchlevel
     end
   end
 
@@ -598,10 +598,10 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "updates fine even when patchlevel doesn't match" do
       gemfile <<-G
-        source "https://gem.repo1"
-        gem "myrack"
+        source "https://gem.repo2"
+        gem "activesupport"
 
         #{patchlevel_incorrect}
       G
@@ -609,8 +609,9 @@ def should_be_patchlevel_fixnum
         build_gem "activesupport", "3.0"
       end
 
-      bundle :update, all: true, raise_on_error: false
-      should_be_patchlevel_incorrect
+      bundle :update, all: true
+      should_ignore_patchlevel
+      expect(the_bundle).to include_gems "activesupport 3.0"
     end
   end
 
@@ -682,19 +683,17 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "prints path even when patchlevel doesn't match" do
       gemfile <<-G
         source "https://gem.repo1"
-        gem "myrack"
+        gem "rails"
 
         #{patchlevel_incorrect}
       G
-      update_repo2 do
-        build_gem "activesupport", "3.0"
-      end
 
-      bundle "show rails", raise_on_error: false
-      should_be_patchlevel_incorrect
+      bundle "show rails"
+      should_ignore_patchlevel
+      expect(out).to eq(default_bundle_path("gems", "rails-2.3.2").to_s)
     end
   end
 
@@ -766,7 +765,7 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "copies the .gem file to vendor/cache even when patchlevel doesn't match" do
       gemfile <<-G
         source "https://gem.repo1"
         gem "myrack"
@@ -774,8 +773,9 @@ def should_be_patchlevel_fixnum
         #{patchlevel_incorrect}
       G
 
-      bundle :cache, raise_on_error: false
-      should_be_patchlevel_incorrect
+      bundle :cache
+      should_ignore_patchlevel
+      expect(bundled_app("vendor/cache/myrack-1.0.0.gem")).to exist
     end
   end
 
@@ -847,7 +847,7 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "copies the .gem file to vendor/cache even when patchlevel doesn't match" do
       gemfile <<-G
         source "https://gem.repo1"
         gem "myrack"
@@ -855,8 +855,9 @@ def should_be_patchlevel_fixnum
         #{patchlevel_incorrect}
       G
 
-      bundle :cache, raise_on_error: false
-      should_be_patchlevel_incorrect
+      bundle :cache
+      should_ignore_patchlevel
+      expect(bundled_app("vendor/cache/myrack-1.0.0.gem")).to exist
     end
   end
 
@@ -926,7 +927,7 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "activates the correct gem even when patchlevel doesn't match" do
       gemfile <<-G
         source "https://gem.repo1"
         gem "myrack"
@@ -934,8 +935,9 @@ def should_be_patchlevel_fixnum
         #{patchlevel_incorrect}
       G
 
-      bundle "exec myrackup", raise_on_error: false
-      should_be_patchlevel_incorrect
+      bundle "exec myrackup"
+      should_ignore_patchlevel
+      expect(out).to include("1.0.0")
     end
   end
 
@@ -995,11 +997,15 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "starts IRB with the default group loaded even when patchlevel doesn't match", :readline do
       gemfile gemfile + "\n\n#{patchlevel_incorrect}\n"
 
-      bundle "console", raise_on_error: false
-      should_be_patchlevel_incorrect
+      bundle "console" do |input, _, _|
+        input.puts("puts MYRACK")
+        input.puts("exit")
+      end
+      should_ignore_patchlevel
+      expect(out).to include("0.9.1")
     end
   end
 
@@ -1095,7 +1101,7 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when patchlevel doesn't match" do
+    it "makes a Gemfile.lock even when patchlevel doesn't match" do
       install_gemfile <<-G, raise_on_error: false
         source "https://gem.repo1"
         gem "yard"
@@ -1106,10 +1112,10 @@ def should_be_patchlevel_fixnum
 
       FileUtils.rm(bundled_app_lock)
 
-      ruby "require 'bundler/setup'", env: { "BUNDLER_VERSION" => Bundler::VERSION }, raise_on_error: false
+      ruby "require 'bundler/setup'", env: { "BUNDLER_VERSION" => Bundler::VERSION }
 
-      expect(bundled_app_lock).not_to exist
-      should_be_patchlevel_incorrect
+      should_ignore_patchlevel
+      expect(bundled_app_lock).to exist
     end
   end
 
@@ -1231,7 +1237,7 @@ def should_be_patchlevel_fixnum
       should_be_engine_version_incorrect
     end
 
-    it "fails when the patchlevel doesn't match", :jruby_only do
+    it "reports outdated gems even when patchlevel doesn't match" do
       update_repo2 do
         build_gem "activesupport", "3.0"
         update_git "foo", path: lib_path("foo")
@@ -1246,25 +1252,9 @@ def should_be_patchlevel_fixnum
       G
 
       bundle "outdated", raise_on_error: false
-      should_be_patchlevel_incorrect
-    end
-
-    it "fails when the patchlevel is a fixnum", :jruby_only do
-      update_repo2 do
-        build_gem "activesupport", "3.0"
-        update_git "foo", path: lib_path("foo")
-      end
-
-      gemfile <<-G
-        source "https://gem.repo2"
-        gem "activesupport", "2.3.5"
-        gem "foo", :git => "#{lib_path("foo")}"
-
-        #{patchlevel_fixnum}
-      G
-
-      bundle "outdated", raise_on_error: false
-      should_be_patchlevel_fixnum
+      expect(err).not_to include("patchlevel")
+      expect(out).to include("activesupport")
+      expect(out).to include("foo")
     end
   end
 end
diff --git a/spec/bundler/install/gemspecs_spec.rb b/spec/bundler/install/gemspecs_spec.rb
index dee8e547e44a45..fb2271c8302e45 100644
--- a/spec/bundler/install/gemspecs_spec.rb
+++ b/spec/bundler/install/gemspecs_spec.rb
@@ -122,7 +122,7 @@ module Persistent💎
       expect(the_bundle).to include_gems "foo 1.0"
     end
 
-    it "fails and complains about patchlevel on patchlevel mismatch",
+    it "installs gems ignoring the mismatch even when patchlevel is mismatch",
       if: RUBY_PATCHLEVEL >= 0 do
       patchlevel = RUBY_PATCHLEVEL.to_i + 1
       build_lib("foo", path: bundled_app) do |s|
@@ -135,9 +135,7 @@ module Persistent💎
         gemspec
       G
 
-      expect(err).to include("Ruby patchlevel")
-      expect(err).to include("but your Gemfile specified")
-      expect(exitstatus).to eq(18)
+      expect(the_bundle).to include_gems "foo 1.0"
     end
 
     it "fails and complains about version on version mismatch" do
diff --git a/spec/bundler/runtime/setup_spec.rb b/spec/bundler/runtime/setup_spec.rb
index 1ffaffef0ed20e..e3fa82f8560a23 100644
--- a/spec/bundler/runtime/setup_spec.rb
+++ b/spec/bundler/runtime/setup_spec.rb
@@ -303,6 +303,32 @@ def clean_load_path(lp)
         expect(out).to eq("WIN")
       end
     end
+
+    context "user sets it via `config set --local gemfile`" do
+      it "uses the value in the config" do
+        gemfile <<-G
+          source "https://gem.repo1"
+          gem "myrack"
+        G
+
+        gemfile bundled_app("CustomGemfile"), <<-G
+          source "https://gem.repo1"
+          gem "activesupport", "2.3.5"
+        G
+
+        bundle "config set --local gemfile #{bundled_app("CustomGemfile")}"
+        bundle "install"
+
+        ruby <<-R
+          require 'bundler'
+          Bundler.setup
+          require 'activesupport'
+          puts ACTIVESUPPORT
+        R
+
+        expect(out).to eq("2.3.5")
+      end
+    end
   end
 
   it "prioritizes gems in BUNDLE_PATH over gems in GEM_HOME" do
diff --git a/spec/ruby/core/io/select_spec.rb b/spec/ruby/core/io/select_spec.rb
index 8e0b89c053548f..2cc4a02115850c 100644
--- a/spec/ruby/core/io/select_spec.rb
+++ b/spec/ruby/core/io/select_spec.rb
@@ -18,6 +18,10 @@
     @wr.syswrite("be ready")
     IO.pipe do |_, wr|
       result = IO.select [@rd], [wr], nil, 0
+      unless result
+        # On some platforms (e.g., Windows), pipe readiness may not be immediate
+        result = IO.select [@rd], [wr], nil, 2
+      end
       result.should == [[@rd], [wr], []]
     end
   end
diff --git a/test/resolv/test_dns.rb b/test/resolv/test_dns.rb
index 69a0e03ec9c716..0b81118c8c4a48 100644
--- a/test/resolv/test_dns.rb
+++ b/test/resolv/test_dns.rb
@@ -721,8 +721,8 @@ def test_multiple_servers_with_timeout_and_truncated_tcp_fallback
 
         client_thread = Thread.new do
           Resolv::DNS.open(nameserver_port: [[server1_address, server1_port], [server2_address, server2_port]]) do |dns|
-            dns.timeouts = [EnvUtil.apply_timeout_scale(0.1),
-                            EnvUtil.apply_timeout_scale(0.2)]
+            dns.timeouts = [EnvUtil.apply_timeout_scale(0.5),
+                            EnvUtil.apply_timeout_scale(1)]
             dns.getresources('foo.example.org', Resolv::DNS::Resource::IN::A)
           end
         end