[rubygems/rubygems] Don't overwrite locked dependency sources too early

Otherwise we hide some useful message about dependency source changes.

https://github.com/rubygems/rubygems/commit/c926673c5b

lib/bundler/definition.rb

@@ -644,7 +644,7 @@ module Bundler
     end
 
     def converge_dependencies
-      (@dependencies + locked_dependencies).each do |dep|
+      @dependencies.each do |dep|
         if dep.source
           dep.source = sources.get(dep.source)
         end

spec/bundler/install/deploy_spec.rb

@@ -379,7 +379,7 @@ RSpec.describe "install in deployment or frozen mode" do
       expect(err).to include("deployment mode")
       expect(err).to include("You have deleted from the Gemfile:\n* source: #{lib_path("rack-1.0")}")
       expect(err).not_to include("You have added to the Gemfile")
-      expect(err).not_to include("You have changed in the Gemfile")
+      expect(err).to include("You have changed in the Gemfile:\n* rack from `#{lib_path("rack-1.0")}` to `no specified source`")
     end
 
     it "explodes if you unpin a source, leaving it pinned somewhere else" do