dependabot-julia 0.342.2

data/lib/dependabot/julia/requirement.rb

@@ -0,0 +1,94 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/requirement"
+require "dependabot/utils"
+
+module Dependabot
+  module Julia
+    class Requirement < Dependabot::Requirement
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Dependabot::Julia::Requirement]) }
+      def self.requirements_array(requirement_string)
+        # Julia version specifiers can be:
+        # - Exact: "1.2.3"
+        # - Range: "1.2-1.3", ">=1.0, <2.0"
+        # - Caret: "^1.2" (compatible within major version)
+        # - Tilde: "~1.2.3" (compatible within minor version)
+        # - Wildcard: "*" (any version)
+        return [new(">= 0")] if requirement_string.nil? || requirement_string.empty? || requirement_string == "*"
+
+        # Split by comma for multiple constraints
+        constraints = requirement_string.split(",").map(&:strip)
+
+        constraints.map do |constraint|
+          # Handle Julia-specific patterns
+          normalized_constraint = normalize_julia_constraint(constraint)
+          new(normalized_constraint)
+        end
+      rescue Gem::Requirement::BadRequirementError
+        [new(">= 0")]
+      end
+
+      sig { params(requirement_string: String).returns(T::Array[Dependabot::Julia::Requirement]) }
+      def self.parse_requirements(requirement_string)
+        requirements_array(requirement_string)
+      end
+
+      sig { params(version: String).returns(String) }
+      def self.normalize_version(version)
+        # Remove 'v' prefix if present (common in Julia)
+        version = version.sub(/^v/, "") if version.match?(/^v\d/)
+        version
+      end
+
+      sig { params(constraint: String).returns(String) }
+      def self.normalize_julia_constraint(constraint)
+        return normalize_caret_constraint(constraint) if constraint.match?(/^\^(\d+(?:\.\d+)*)/)
+        return normalize_tilde_constraint(constraint) if constraint.match?(/^~(\d+(?:\.\d+)*)/)
+        return normalize_range_constraint(constraint) if constraint.match?(/^(\d+(?:\.\d+)*)-(\d+(?:\.\d+)*)$/)
+
+        # Return as-is for standard gem requirements (>=, <=, ==, etc.)
+        constraint
+      end
+
+      sig { params(constraint: String).returns(String) }
+      private_class_method def self.normalize_caret_constraint(constraint)
+        version = T.must(constraint[1..-1])
+        parts = version.split(".")
+        major = T.must(parts[0])
+        return ">= #{version}.0.0, < #{major.to_i + 1}.0.0" if parts.length == 1
+
+        ">= #{version}, < #{major.to_i + 1}.0.0"
+      end
+
+      sig { params(constraint: String).returns(String) }
+      private_class_method def self.normalize_tilde_constraint(constraint)
+        version = T.must(constraint[1..-1])
+        parts = version.split(".")
+        return ">= #{version}, < #{T.must(parts[0]).to_i + 1}.0.0" unless parts.length >= 2
+
+        major = T.must(parts[0])
+        minor = T.must(parts[1])
+        ">= #{version}, < #{major}.#{minor.to_i + 1}.0"
+      end
+
+      sig { params(constraint: String).returns(String) }
+      private_class_method def self.normalize_range_constraint(constraint)
+        start_version, end_version = constraint.split("-")
+        end_parts = T.must(end_version).split(".")
+
+        next_minor = if end_parts.length >= 2
+                       major = T.must(end_parts[0])
+                       minor = T.must(end_parts[1])
+                       "#{major}.#{minor.to_i + 1}.0"
+                     else
+                       "#{T.must(end_parts[0]).to_i + 1}.0.0"
+                     end
+
+        ">= #{start_version}, < #{next_minor}"
+      end
+    end
+  end
+end
+
+Dependabot::Utils.register_requirement_class("julia", Dependabot::Julia::Requirement)

data/lib/dependabot/julia/update_checker/latest_version_finder.rb

@@ -0,0 +1,222 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "time"
+require "dependabot/julia/package/package_details_fetcher"
+require "dependabot/julia/version"
+require "dependabot/update_checkers/version_filters"
+
+module Dependabot
+  module Julia
+    class LatestVersionFinder
+      extend T::Sig
+
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          dependency_files: T::Array[Dependabot::DependencyFile],
+          credentials: T::Array[Dependabot::Credential],
+          ignored_versions: T::Array[String],
+          security_advisories: T::Array[Dependabot::SecurityAdvisory],
+          raise_on_ignored: T::Boolean,
+          cooldown_config: T.nilable(T::Hash[Symbol, T.untyped]),
+          custom_registries: T::Array[T::Hash[Symbol, String]]
+        ).void
+      end
+      def initialize(
+        dependency:,
+        dependency_files:,
+        credentials:,
+        ignored_versions:,
+        security_advisories:,
+        raise_on_ignored:,
+        cooldown_config: nil,
+        custom_registries: []
+      )
+        @dependency = dependency
+        @dependency_files = dependency_files
+        @credentials = credentials
+        @ignored_versions = ignored_versions
+        @security_advisories = security_advisories
+        @raise_on_ignored = raise_on_ignored
+        @cooldown_config = cooldown_config
+        @custom_registries = custom_registries
+      end
+
+      sig { returns(T.nilable(Gem::Version)) }
+      def latest_version
+        @latest_version ||= T.let(fetch_latest_version, T.nilable(Gem::Version))
+      end
+
+      private
+
+      sig { returns(Dependabot::Dependency) }
+      attr_reader :dependency
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      attr_reader :dependency_files
+
+      sig { returns(T::Array[Dependabot::Credential]) }
+      attr_reader :credentials
+
+      sig { returns(T::Array[String]) }
+      attr_reader :ignored_versions
+
+      sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+      attr_reader :security_advisories
+
+      sig { returns(T::Boolean) }
+      attr_reader :raise_on_ignored
+
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      attr_reader :cooldown_config
+
+      sig { returns(T::Array[T::Hash[Symbol, String]]) }
+      attr_reader :custom_registries
+
+      sig { returns(T.nilable(Gem::Version)) }
+      def fetch_latest_version
+        # Fetch all package releases using the PackageDetailsFetcher
+        package_fetcher = Julia::Package::PackageDetailsFetcher.new(
+          dependency: dependency,
+          credentials: credentials,
+          custom_registries: custom_registries
+        )
+
+        releases = package_fetcher.fetch_package_releases
+        return nil if releases.empty?
+
+        # Filter releases based on cooldown
+        if cooldown_config
+          releases = filter_releases_by_cooldown(releases)
+          return nil if releases.empty?
+        end
+
+        # Convert to versions for further filtering
+        versions = releases.map(&:version).sort
+
+        # Filter out ignored versions
+        versions = versions.reject do |version|
+          ignored_versions.any?(version.to_s)
+        end
+
+        # Filter out vulnerable versions
+        filtered_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+          versions,
+          security_advisories
+        )
+
+        raise Dependabot::AllVersionsIgnored if filtered_versions.empty? && raise_on_ignored
+
+        filtered_versions.max
+      end
+
+      sig do
+        params(
+          releases: T::Array[Dependabot::Package::PackageRelease]
+        ).returns(T::Array[Dependabot::Package::PackageRelease])
+      end
+      def filter_releases_by_cooldown(releases)
+        return releases unless cooldown_config
+        return releases unless dependency_in_cooldown_scope?
+
+        releases.reject do |release|
+          cooldown_active_for_release?(release)
+        end
+      end
+
+      sig { params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+      def cooldown_active_for_release?(release)
+        cooldown_days = determine_cooldown_days(release.version)
+        return false unless cooldown_days&.positive?
+        return false unless release.released_at
+
+        # Check if enough time has passed since release
+        seconds_since_release = T.cast(Time.now - release.released_at, Float)
+        cooldown_seconds = cooldown_days * 24 * 60 * 60 # Convert days to seconds
+        seconds_since_release < cooldown_seconds
+      end
+
+      sig { returns(T::Boolean) }
+      def dependency_in_cooldown_scope?
+        return true unless cooldown_config
+
+        config = T.must(cooldown_config) # We know it's not nil due to guard above
+        includes = T.cast(config[:include], T.nilable(T::Array[String]))
+        excludes = T.cast(config[:exclude], T.nilable(T::Array[String]))
+
+        # Check exclusions first
+        return false if excludes&.any? { |pattern| dependency.name.match?(Regexp.new(pattern.gsub("*", ".*"))) }
+
+        # Check inclusions (if specified, dependency must match)
+        return includes.any? { |pattern| dependency.name.match?(Regexp.new(pattern.gsub("*", ".*"))) } if includes&.any?
+
+        true # Include by default if no include patterns specified
+      end
+
+      sig { params(version: Gem::Version).returns(T.nilable(Integer)) }
+      def determine_cooldown_days(version)
+        return nil unless cooldown_config
+
+        current_version = dependency.version ? Gem::Version.new(dependency.version) : nil
+        return nil unless current_version
+
+        version_bump_type = determine_version_bump_type(version, current_version)
+        cooldown_days_for_bump_type(version_bump_type)
+      end
+
+      sig { params(version: Gem::Version, current_version: Gem::Version).returns(Symbol) }
+      def determine_version_bump_type(version, current_version)
+        v_segments = normalize_version_segments(version)
+        c_segments = normalize_version_segments(current_version)
+
+        compare_version_segments(v_segments, c_segments)
+      end
+
+      sig { params(bump_type: Symbol).returns(T.nilable(Integer)) }
+      def cooldown_days_for_bump_type(bump_type)
+        return nil unless cooldown_config
+
+        config = T.must(cooldown_config) # We know it's not nil due to guard above
+        case bump_type
+        when :major
+          T.cast(config[:semver_major_days], T.nilable(Integer)) ||
+            T.cast(config[:default_days], T.nilable(Integer))
+        when :minor
+          T.cast(config[:semver_minor_days], T.nilable(Integer)) ||
+            T.cast(config[:default_days], T.nilable(Integer))
+        when :patch
+          T.cast(config[:semver_patch_days], T.nilable(Integer)) ||
+            T.cast(config[:default_days], T.nilable(Integer))
+        else
+          T.cast(config[:default_days], T.nilable(Integer))
+        end
+      end
+
+      sig { params(version: Gem::Version).returns([Integer, Integer, Integer]) }
+      def normalize_version_segments(version)
+        [
+          (version.segments[0] || 0).to_i,
+          (version.segments[1] || 0).to_i,
+          (version.segments[2] || 0).to_i
+        ]
+      end
+
+      sig { params(v_segments: [Integer, Integer, Integer], c_segments: [Integer, Integer, Integer]).returns(Symbol) }
+      def compare_version_segments(v_segments, c_segments)
+        v_major, v_minor, v_patch = v_segments
+        c_major, c_minor, c_patch = c_segments
+
+        if v_major > c_major
+          :major
+        elsif v_minor > c_minor
+          :minor
+        elsif v_patch > c_patch
+          :patch
+        else
+          :default
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/julia/update_checker/requirements_updater.rb

@@ -0,0 +1,90 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/julia/requirement"
+require "dependabot/julia/version"
+
+module Dependabot
+  module Julia
+    class RequirementsUpdater
+      extend T::Sig
+
+      sig do
+        params(
+          requirements: T::Array[T::Hash[Symbol, T.untyped]],
+          target_version: T.nilable(String),
+          update_strategy: T.nilable(Symbol)
+        ).void
+      end
+      def initialize(requirements:, target_version:, update_strategy:)
+        @requirements = requirements
+        @target_version = target_version
+        @update_strategy = T.let(update_strategy || :bump_versions, Symbol)
+      end
+
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def updated_requirements
+        return requirements unless target_version
+
+        target_version_obj = Dependabot::Julia::Version.new(target_version)
+
+        requirements.map do |requirement|
+          update_requirement(requirement, target_version_obj)
+        end
+      end
+
+      private
+
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      attr_reader :requirements
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :target_version
+
+      sig { returns(Symbol) }
+      attr_reader :update_strategy
+
+      sig do
+        params(
+          requirement: T::Hash[Symbol, T.untyped],
+          target_version: Dependabot::Julia::Version
+        ).returns(T::Hash[Symbol, T.untyped])
+      end
+      def update_requirement(requirement, target_version)
+        current_requirement = requirement[:requirement]
+
+        # If requirement is "*" or nil, use target version
+        new_requirement = if current_requirement.nil? || current_requirement == "*"
+                            target_version.to_s
+                          else
+                            updated_version_requirement(current_requirement, target_version)
+                          end
+
+        requirement.merge(requirement: new_requirement)
+      end
+
+      sig { params(requirement_string: String, target_version: Dependabot::Julia::Version).returns(String) }
+      def updated_version_requirement(requirement_string, target_version)
+        req = Dependabot::Julia::Requirement.new(requirement_string)
+
+        # If current requirement already satisfied, keep it
+        return requirement_string if req.satisfied_by?(target_version)
+
+        # Otherwise, create a new requirement that includes the target version
+        if requirement_string.start_with?("^")
+          # Caret requirement: ^1.2 -> update to ^new_major.new_minor if needed
+          "^#{target_version.segments[0]}.#{target_version.segments[1] || 0}"
+        elsif requirement_string.start_with?("~")
+          # Tilde requirement: ~1.2.3 -> update to ~new_version
+          "~#{target_version}"
+        elsif requirement_string.include?("-")
+          # Range requirement: keep as is or expand to include target
+          requirement_string
+        else
+          # Exact version or other: use target version
+          target_version.to_s
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/julia/update_checker.rb

@@ -0,0 +1,146 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "dependabot/update_checkers"
+require "dependabot/update_checkers/base"
+require "dependabot/julia/registry_client"
+require "dependabot/julia/requirement"
+
+module Dependabot
+  module Julia
+    # Load helper classes
+    autoload :LatestVersionFinder, "dependabot/julia/update_checker/latest_version_finder"
+    autoload :RequirementsUpdater, "dependabot/julia/update_checker/requirements_updater"
+
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
+      sig do
+        params(
+          dependency: Dependabot::Dependency,
+          dependency_files: T::Array[Dependabot::DependencyFile],
+          credentials: T::Array[Dependabot::Credential],
+          repo_contents_path: T.nilable(String),
+          ignored_versions: T::Array[String],
+          raise_on_ignored: T::Boolean,
+          security_advisories: T::Array[Dependabot::SecurityAdvisory],
+          requirements_update_strategy: T.nilable(Dependabot::RequirementsUpdateStrategy),
+          dependency_group: T.nilable(Dependabot::DependencyGroup),
+          update_cooldown: T.nilable(Dependabot::Package::ReleaseCooldownOptions),
+          options: T::Hash[Symbol, T.untyped]
+        ).void
+      end
+      def initialize(
+        dependency:,
+        dependency_files:,
+        credentials:,
+        repo_contents_path: nil,
+        ignored_versions: [],
+        raise_on_ignored: false,
+        security_advisories: [],
+        requirements_update_strategy: nil,
+        dependency_group: nil,
+        update_cooldown: nil,
+        options: {}
+      )
+        super
+        @custom_registries = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
+      end
+
+      sig { override.returns(T.nilable(Gem::Version)) }
+      def latest_version
+        @latest_version ||= T.let(latest_version_finder.latest_version, T.nilable(Gem::Version))
+      end
+
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def custom_registries
+        return @custom_registries if @custom_registries
+
+        registries = T.cast(options.dig(:registries, :julia), T.nilable(T::Array[T.untyped])) || []
+        # Convert string keys to symbols if needed
+        @custom_registries = registries.map do |registry|
+          if registry.is_a?(Hash)
+            registry.transform_keys(&:to_sym)
+          else
+            T.cast(registry, T::Hash[Symbol, T.untyped])
+          end
+        end
+      end
+
+      sig { override.returns(T.nilable(Gem::Version)) }
+      def latest_resolvable_version
+        # For Julia, the latest version is generally resolvable since
+        # the manifest file locks exact versions, so we use latest_version
+        @latest_resolvable_version ||= T.let(latest_version, T.nilable(Gem::Version))
+      end
+
+      sig { override.returns(T.nilable(T.any(Dependabot::Version, String))) }
+      def latest_resolvable_version_with_no_unlock
+        # Return latest version that satisfies current requirement constraints
+        return nil unless latest_version
+
+        current_requirement = T.cast(dependency.requirements.first&.fetch(:requirement, nil), T.nilable(String))
+
+        if current_requirement.nil? || current_requirement == "*"
+          return Dependabot::Julia::Version.new(latest_version.to_s)
+        end
+
+        req = requirement_class.new(current_requirement)
+        return unless T.cast(req.satisfied_by?(latest_version), T::Boolean)
+
+        Dependabot::Julia::Version.new(latest_version.to_s)
+      end
+
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def updated_requirements
+        Dependabot::Julia::RequirementsUpdater.new(
+          requirements: dependency.requirements,
+          target_version: latest_resolvable_version&.to_s,
+          update_strategy: requirements_update_strategy&.to_s&.to_sym
+        ).updated_requirements
+      end
+
+      private
+
+      sig { returns(Dependabot::Julia::LatestVersionFinder) }
+      def latest_version_finder
+        @latest_version_finder ||= T.let(
+          Dependabot::Julia::LatestVersionFinder.new(
+            dependency: dependency,
+            dependency_files: dependency_files,
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            security_advisories: security_advisories,
+            raise_on_ignored: raise_on_ignored,
+            cooldown_config: cooldown_config,
+            custom_registries: custom_registries
+          ),
+          T.nilable(Dependabot::Julia::LatestVersionFinder)
+        )
+      end
+
+      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      def cooldown_config
+        return nil unless update_cooldown
+
+        # Convert the ReleaseCooldownOptions to a hash for compatibility
+        cooldown = T.must(update_cooldown) # We know it's not nil due to guard above
+        {
+          default_days: cooldown.default_days,
+          semver_major_days: cooldown.semver_major_days,
+          semver_minor_days: cooldown.semver_minor_days,
+          semver_patch_days: cooldown.semver_patch_days,
+          include: cooldown.include,
+          exclude: cooldown.exclude
+        }
+      end
+
+      sig { returns(T.class_of(Dependabot::Julia::Requirement)) }
+      def requirement_class
+        Dependabot::Julia::Requirement
+      end
+    end
+  end
+end
+
+Dependabot::UpdateCheckers.register("julia", Dependabot::Julia::UpdateChecker)

data/lib/dependabot/julia/version.rb

@@ -0,0 +1,44 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/version"
+
+module Dependabot
+  module Julia
+    class Version < Dependabot::Version
+      # Julia follows semantic versioning for most packages
+      # See: https://docs.julialang.org/en/v1/stdlib/Pkg/#Version-specifier-format
+      VERSION_PATTERN = T.let(/^v?(\d+(?:\.\d+)*)(?:[-+].*)?$/, Regexp)
+
+      sig { override.params(version: T.nilable(T.any(String, Integer, Gem::Version))).returns(T::Boolean) }
+      def self.correct?(version)
+        return false if version.nil?
+
+        version_string = version.to_s
+        VERSION_PATTERN.match?(version_string)
+      end
+
+      sig { override.params(version: T.nilable(T.any(String, Integer, Gem::Version))).void }
+      def initialize(version)
+        version_string = version.to_s.strip
+
+        # Remove 'v' prefix if present (common in Julia)
+        version_string = version_string.sub(/^v/, "") if version_string.match?(/^v\d/)
+
+        @version_string = T.let(version_string, String)
+        super(version_string)
+      end
+
+      sig do
+        override
+          .params(version: T.nilable(T.any(String, Integer, Gem::Version)))
+          .returns(Dependabot::Julia::Version)
+      end
+      def self.new(version)
+        T.cast(super, Dependabot::Julia::Version)
+      end
+    end
+  end
+end
+
+Dependabot::Utils.register_version_class("julia", Dependabot::Julia::Version)

data/lib/dependabot/julia.rb

@@ -0,0 +1,65 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/version"
+require "dependabot/utils"
+
+# Register Julia version and requirement classes
+require "dependabot/julia/version"
+require "dependabot/julia/requirement"
+
+module Dependabot
+  module Julia
+    extend T::Sig
+
+    VERSION = "0.1.0"
+
+    sig { returns(String) }
+    def self.package_ecosystem
+      "julia"
+    end
+
+    sig { returns(T.class_of(Dependabot::Julia::FileFetcher)) }
+    def self.file_fetcher_class
+      FileFetcher
+    end
+
+    sig { returns(T.class_of(Dependabot::Julia::FileParser)) }
+    def self.file_parser_class
+      FileParser
+    end
+
+    sig { returns(T.class_of(Dependabot::Julia::UpdateChecker)) }
+    def self.update_checker_class
+      UpdateChecker
+    end
+
+    sig { returns(T.class_of(Dependabot::Julia::FileUpdater)) }
+    def self.file_updater_class
+      FileUpdater
+    end
+
+    sig { returns(T.class_of(Dependabot::Julia::MetadataFinder)) }
+    def self.metadata_finder_class
+      MetadataFinder
+    end
+
+    sig { returns(T.class_of(Dependabot::Julia::Dependency)) }
+    def self.dependency_class
+      Dependabot::Julia::Dependency
+    end
+
+    sig { returns(T.class_of(Dependabot::Julia::PackageManager)) }
+    def self.package_manager_class
+      PackageManager
+    end
+  end
+end
+
+require "dependabot/julia/package_manager"
+require "dependabot/julia/file_fetcher"
+require "dependabot/julia/file_parser"
+require "dependabot/julia/update_checker"
+require "dependabot/julia/file_updater"
+require "dependabot/julia/metadata_finder"
+require "dependabot/julia/dependency"