dependabot-julia 0.386.0 → 0.387.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ee61ab238b4d9d818bf4863f3a1ae53aa062d93b893b16f03881a522e615d49
-  data.tar.gz: b4b9dfe09b76ec2d28581d543124447694cb97836ec88a7ed0957c4d7aaafc51
+  metadata.gz: 76dfbce20089045f1450b8e8c2c48a7b3c9b57fb48036014d0df8408a22c2603
+  data.tar.gz: f3594883c239208218847751d87eecbd3f04f9af019e4f9044d8a7da57ee6ac5
 SHA512:
-  metadata.gz: b846a9a0e4e372859539e4acfbbbbe2d815919e26f7b25944aa1a32df48270fcad9d7258ea732a764e03c1ce282be09e6225a963880ed867aa44906424f4bbea
-  data.tar.gz: d631d1f3aa74650a8402052931887af1c2ba393f08b7c08a74549fe142fda32f8378b07cece1b1394bf88450aa62f1cb49eea1502d21e916f18a84128bc07d8d
+  metadata.gz: 27f432eee3b36aa258ae409c4afe26aaa4bc8f41589025d1f4147ba4737d4fe0543225c8765178797e5dbc6c66728e93dec966fd8849223b3731b42e29034dce
+  data.tar.gz: 6b414d534a79f3d9098878652fd5554091cd3faccdb36cab1236ce6972f74e3a24cc7ac68986b46276829b178961132d16971eb2285b47cecc658a23a572246b

data/lib/dependabot/julia/file_fetcher.rb

@@ -45,8 +45,11 @@ module Dependabot
         fetched_files
       end
 
-      sig { params(workspace_info: T::Hash[String, T.untyped]).void }
+      sig { params(workspace_info: T::Hash[String, Object]).void }
       def validate_workspace_info!(workspace_info)
+        # Only domain errors ("no project file found") reach here; helper
+        # crashes raise from RegistryClient rather than being misreported as
+        # a missing Project.toml.
         error_value = T.cast(workspace_info["error"], T.nilable(String))
         has_error = !error_value.nil?
         project_files = T.cast(workspace_info["project_files"], T.nilable(T::Array[String]))

data/lib/dependabot/julia/file_parser.rb

@@ -110,13 +110,87 @@ module Dependabot
           parse_single_project_file(proj_file, dependencies_map)
         end
 
+        apply_manifest_versions(dependencies_map)
+
         dependencies_map.values
       end
 
+      # Resolve the installed version of each dependency from the manifest
+      # (Julia's lockfile), matching by UUID.
+      sig { params(dependencies_map: T::Hash[String, Dependabot::Dependency]).void }
+      def apply_manifest_versions(dependencies_map)
+        versions = manifest_versions_by_uuid
+        return if versions.empty?
+
+        dependencies_map.transform_values! do |dep|
+          uuid = T.cast(dep.metadata[:julia_uuid], T.nilable(String))
+          version = uuid && versions[uuid]
+          next dep unless version
+
+          Dependabot::Dependency.new(
+            name: dep.name,
+            version: version,
+            requirements: dep.requirements,
+            package_manager: "julia",
+            metadata: dep.metadata
+          )
+        end
+      end
+
+      sig { returns(T::Hash[String, String]) }
+      def manifest_versions_by_uuid
+        manifest = manifest_file
+        return {} unless manifest
+
+        result = parse_manifest_content(T.must(manifest.content))
+
+        if result["error"]
+          Dependabot.logger.warn("Failed to parse Julia manifest: #{result['error']}")
+          return {}
+        end
+
+        deps = T.cast(result["dependencies"] || [], T::Array[T.untyped])
+        deps.each_with_object({}) do |dep_info, map|
+          dep_hash = T.cast(dep_info, T::Hash[String, T.untyped])
+          uuid = T.cast(dep_hash["uuid"], T.nilable(String))
+          version = T.cast(dep_hash["version"], T.nilable(String)).to_s
+          next if uuid.nil? || version.empty?
+
+          map[uuid] = version
+        end
+      end
+
+      sig { params(content: String).returns(T::Hash[String, T.untyped]) }
+      def parse_manifest_content(content)
+        result = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+        Dir.mktmpdir("julia_manifest") do |temp_dir|
+          # Written under a fixed name: version-suffixed manifests
+          # (Manifest-v1.11.toml) would otherwise be skipped by Pkg when the
+          # helper's Julia version doesn't match.
+          manifest_path = File.join(temp_dir, "Manifest.toml")
+          File.write(manifest_path, content)
+          result = registry_client.parse_manifest(manifest_path)
+        end
+        T.must(result)
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def manifest_file
+        dependency_files.find do |f|
+          File.basename(f.name).match?(/^(Julia)?Manifest(?:-v[\d.]+)?\.toml$/i)
+        end
+      end
+
       sig { params(proj_file: Dependabot::DependencyFile, dependencies_map: T::Hash[String, Dependabot::Dependency]).void }
       def parse_single_project_file(proj_file, dependencies_map)
         temp_dir = Dir.mktmpdir("julia_project")
-        project_path = File.join(temp_dir, proj_file.name)
+        # File names like "../Project.toml" (a workspace root fetched from a
+        # member directory) must not escape the temp dir; fall back to the
+        # basename since each project file gets its own directory anyway.
+        project_path = File.expand_path(File.join(temp_dir, proj_file.name))
+        unless project_path.start_with?("#{File.expand_path(temp_dir)}#{File::SEPARATOR}")
+          project_path = File.join(temp_dir, File.basename(proj_file.name))
+        end
         FileUtils.mkdir_p(File.dirname(project_path))
         File.write(project_path, proj_file.content)
 
@@ -164,6 +238,8 @@ module Dependabot
           if dependencies_map.key?(name)
             # Merge requirements from additional project files
             existing_dep = T.must(dependencies_map[name])
+            next if uuid_conflict?(existing_dep, uuid, file_name)
+
             existing_requirements = existing_dep.requirements + [new_requirement]
             dependencies_map[name] = Dependabot::Dependency.new(
               name: name,
@@ -185,6 +261,27 @@ module Dependabot
         end
       end
 
+      # UUID is a package's identity in Julia: two same-named entries with
+      # different UUIDs are different packages, and merging them would run
+      # updates against the wrong UUID.
+      sig do
+        params(
+          existing_dep: Dependabot::Dependency,
+          uuid: T.nilable(String),
+          file_name: String
+        ).returns(T::Boolean)
+      end
+      def uuid_conflict?(existing_dep, uuid, file_name)
+        existing_uuid = T.cast(existing_dep.metadata[:julia_uuid], T.nilable(String))
+        return false unless uuid && existing_uuid && uuid != existing_uuid
+
+        Dependabot.logger.warn(
+          "Skipping #{existing_dep.name} in #{file_name}: UUID #{uuid} conflicts with #{existing_uuid} " \
+          "from another project file"
+        )
+        true
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def all_project_files
         dependency_files.select { |f| f.name.match?(/Project\.toml$/i) }

data/lib/dependabot/julia/file_updater.rb

@@ -15,6 +15,10 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       extend T::Sig
 
+      # Matches a [compat] table header, tolerating indentation and a trailing
+      # comment ("[compat]  # pins")
+      COMPAT_HEADER_PATTERN = T.let(/^\s*\[compat\]\s*(?:#.*)?$/, Regexp)
+
       sig { returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [/(?:Julia)?Project\.toml$/i, /(?:Julia)?Manifest(?:-v[\d.]+)?\.toml$/i]
@@ -58,6 +62,10 @@ module Dependabot
 
           return all_projects_only_update(updated_project_files) if actual_manifest.nil?
 
+          # Requirement-only updates (no target versions) have nothing to tell
+          # Pkg; ship the Project.toml changes on their own.
+          return all_projects_only_update(updated_project_files) if build_updates_hash.empty?
+
           # Write all updated project files to disk for Julia's Pkg
           write_all_temporary_files(updated_project_files, actual_manifest)
           result = call_julia_helper
@@ -232,19 +240,30 @@ module Dependabot
 
       private
 
-      sig { returns(T::Hash[String, String]) }
+      sig { returns(T::Hash[String, T::Hash[String, String]]) }
       def build_updates_hash
-        updates = {}
-        dependencies.each do |dependency|
-          next unless dependency.version
-
-          uuid = T.cast(dependency.metadata[:julia_uuid], String)
-          updates[uuid] = {
-            "name" => dependency.name,
-            "version" => dependency.version
-          }
-        end
-        updates
+        @build_updates_hash ||= T.let(
+          begin
+            updates = T.let({}, T::Hash[String, T::Hash[String, String]])
+            dependencies.each do |dependency|
+              version = dependency.version
+              next unless version
+
+              uuid = dependency.metadata[:julia_uuid]
+              unless uuid.is_a?(String)
+                Dependabot.logger.warn("Skipping manifest update for #{dependency.name}: no UUID available")
+                next
+              end
+
+              updates[uuid] = {
+                "name" => dependency.name,
+                "version" => version
+              }
+            end
+            updates
+          end,
+          T.nilable(T::Hash[String, T::Hash[String, String]])
+        )
       end
 
       # Helper methods for DependabotHelper.jl integration
@@ -253,12 +272,25 @@ module Dependabot
       def registry_client
         @registry_client ||= T.let(
           Dependabot::Julia::RegistryClient.new(
-            credentials: credentials
+            credentials: credentials,
+            custom_registries: custom_registries
           ),
           T.nilable(Dependabot::Julia::RegistryClient)
         )
       end
 
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def custom_registries
+        @custom_registries ||= T.let(
+          begin
+            registries_config = T.cast(options[:registries], T.nilable(T::Hash[Symbol, T.anything]))
+            registries = T.cast(registries_config&.dig(:julia), T.nilable(T::Array[T::Hash[Symbol, T.anything]])) || []
+            registries.map { |registry| registry.transform_keys(&:to_sym) }
+          end,
+          T.nilable(T::Array[T::Hash[Symbol, T.untyped]])
+        )
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def find_manifest_file
         # The file fetcher has already identified the correct manifest file
@@ -270,10 +302,17 @@ module Dependabot
         dependency_files.find do |f|
           # Use basename to get just the filename, not the full path with ../
           is_manifest = File.basename(f.name).match?(/^(Julia)?Manifest(?:-v[\d.]+)?\.toml$/i)
-          is_manifest && (f.directory == project_dir || project_dir.start_with?(f.directory))
+          is_manifest && (f.directory == project_dir || parent_directory_of?(f.directory, project_dir))
         end
       end
 
+      sig { params(candidate: String, dir: String).returns(T::Boolean) }
+      def parent_directory_of?(candidate, dir)
+        # Segment-aware prefix check so "/doc" is not treated as a parent of "/docs"
+        prefix = candidate.end_with?("/") ? candidate : "#{candidate}/"
+        dir.start_with?(prefix)
+      end
+
       sig { params(manifest_path: String).returns(Dependabot::DependencyFile) }
       def manifest_file_for_path(manifest_path)
         # manifest_path is relative to the project directory (e.g., "Manifest.toml" or "../Manifest.toml")
@@ -288,10 +327,11 @@ module Dependabot
 
         # Find the matching manifest file in dependency_files
         found_manifest = dependency_files.find do |f|
-          next unless f.name.match?(/^(Julia)?Manifest(?:-v[\d.]+)?\.toml$/i)
+          next unless File.basename(f.name).match?(/^(Julia)?Manifest(?:-v[\d.]+)?\.toml$/i)
 
-          # Construct the full path for this file and normalize it
-          file_path = File.join(f.directory, f.name).sub(%r{^/}, "")
+          # Construct the full path for this file, resolving ".." segments
+          # (workspace manifests are named e.g. "../Manifest.toml")
+          file_path = Pathname.new(File.join(f.directory, f.name)).cleanpath.to_s.sub(%r{^/}, "")
           file_path == resolved_manifest_path
         end
 
@@ -311,8 +351,6 @@ module Dependabot
 
       sig { override.void }
       def check_required_files
-        return if dependency_files.empty?
-
         return if dependency_files.any? { |f| f.name.match?(/^(Julia)?Project\.toml$/i) }
 
         raise Dependabot::DependencyFileNotFound, "No Project.toml or JuliaProject.toml found."
@@ -330,71 +368,81 @@ module Dependabot
 
       sig { params(content: String, dependency_name: String, new_requirement: String).returns(String) }
       def update_dependency_requirement_in_content(content, dependency_name, new_requirement)
-        # Extract the [compat] section to update it specifically
-        # The regex handles files with or without trailing newlines
-        compat_section_match = content.match(/^\[compat\]\s*\n((?:(?!\[)[^\n]*(?:\n|\z))*?)(?=^\[|\z)/m)
-
-        if compat_section_match
-          compat_section = T.must(compat_section_match[1])
-          # Pattern to match the dependency in the compat section
-          pattern = /^(\s*#{Regexp.escape(dependency_name)}\s*=\s*)(?:"[^"]*"|'[^']*'|[^\s#\n]+)(\s*(?:\#.*)?)$/
-
-          if compat_section.match?(pattern)
-            # Replace existing entry in compat section
-            updated_compat = compat_section.gsub(pattern, "\\1\"#{new_requirement}\"\\2")
-            content.sub(T.must(compat_section_match[0]), "[compat]\n#{updated_compat}")
-          else
-            # Add new entry to existing [compat] section
-            add_compat_entry_to_content(content, dependency_name, new_requirement)
-          end
-        else
-          # Add new [compat] section
-          add_compat_entry_to_content(content, dependency_name, new_requirement)
+        lines = content.lines
+        header_idx = lines.index { |line| line.match?(COMPAT_HEADER_PATTERN) }
+
+        unless header_idx
+          # Add a new [compat] section at the end of the file
+          separator = content.end_with?("\n") ? "" : "\n"
+          return "#{content}#{separator}\n[compat]\n#{dependency_name} = \"#{new_requirement}\"\n"
         end
-      end
 
-      sig { params(content: String, dependency_name: String, requirement: String).returns(String) }
-      def add_compat_entry_to_content(content, dependency_name, requirement)
-        if content.match?(/^\s*\[compat\]\s*$/m)
-          compat_section_match = content.match(/^\[compat\]\s*\n((?:(?!\[)[^\n]*(?:\n|\z))*?)(?=^\[|\z)/m)
-          return content unless compat_section_match
-
-          compat_section = T.must(compat_section_match[1])
-          entries = parse_compat_entries(compat_section)
-          entries[dependency_name] = requirement
-          sorted_entries = sort_compat_entries(entries)
-          new_compat_section = build_compat_section(sorted_entries)
-
-          content.sub(T.must(compat_section_match[0]), "[compat]\n#{new_compat_section}")
-        else
-          content + "\n[compat]\n#{dependency_name} = \"#{requirement}\"\n"
+        section_end = ((header_idx + 1)...lines.length).find { |i| T.must(lines[i]).match?(/^\s*\[/) } ||
+                      lines.length
+
+        # Replace an existing entry in place, preserving surrounding lines
+        entry_pattern =
+          /^(\s*#{Regexp.escape(dependency_name)}\s*=\s*)(?:"[^"]*"|'[^']*'|[^\s#\n]+)(\s*(?:\#.*)?)$/
+        ((header_idx + 1)...section_end).each do |i|
+          line = T.must(lines[i])
+          next unless line.match?(entry_pattern)
+
+          lines[i] = line.sub(entry_pattern) { "#{Regexp.last_match(1)}\"#{new_requirement}\"#{Regexp.last_match(2)}" }
+          return lines.join
         end
-      end
 
-      sig { params(compat_section: String).returns(T::Hash[String, String]) }
-      def parse_compat_entries(compat_section)
-        entries = {}
-        compat_section.each_line do |line|
-          next if line.strip.empty? || line.strip.start_with?("#")
+        insert_compat_entry(lines, header_idx, section_end, dependency_name, new_requirement)
+      end
 
-          match = line.match(/^\s*([^=\s]+)\s*=\s*(.+?)(?:\s*#.*)?$/)
-          next unless match
+      # Insert a new compat entry in alphabetical position without rewriting
+      # the rest of the section, so comments, blank lines and any custom
+      # ordering of the existing entries survive.
+      sig do
+        params(
+          lines: T::Array[String],
+          header_idx: Integer,
+          section_end: Integer,
+          dependency_name: String,
+          requirement: String
+        ).returns(String)
+      end
+      def insert_compat_entry(lines, header_idx, section_end, dependency_name, requirement)
+        insert_at = alphabetical_insert_position(lines, header_idx, section_end, dependency_name)
 
-          key = T.must(match[1]).strip
-          value = T.must(match[2]).strip.gsub(/^["']|["']$/, "")
-          entries[key] = value
+        unless insert_at
+          # Append at the end of the section, before any trailing blank lines
+          insert_at = section_end
+          insert_at -= 1 while insert_at > header_idx + 1 && T.must(lines[insert_at - 1]).strip.empty?
         end
-        entries
+
+        # The preceding line may lack a newline when the section ends the file
+        prev = lines[insert_at - 1]
+        lines[insert_at - 1] = "#{prev}\n" if prev && !prev.end_with?("\n")
+
+        lines.insert(insert_at, "#{dependency_name} = \"#{requirement}\"\n")
+        lines.join
       end
 
-      sig { params(entries: T::Hash[String, String]).returns(T::Hash[String, String]) }
-      def sort_compat_entries(entries)
-        entries.sort.to_h
+      sig do
+        params(
+          lines: T::Array[String],
+          header_idx: Integer,
+          section_end: Integer,
+          dependency_name: String
+        ).returns(T.nilable(Integer))
       end
+      def alphabetical_insert_position(lines, header_idx, section_end, dependency_name)
+        ((header_idx + 1)...section_end).each do |i|
+          key = T.must(lines[i])[/^\s*([^#\s=][^=\s]*)\s*=/, 1]
+          next unless key && key > dependency_name
+
+          insert_at = i
+          # Comment lines directly above an entry belong to it
+          insert_at -= 1 while insert_at > header_idx + 1 && T.must(lines[insert_at - 1]).strip.start_with?("#")
+          return insert_at
+        end
 
-      sig { params(entries: T::Hash[String, String]).returns(String) }
-      def build_compat_section(entries)
-        entries.map { |name, requirement| "#{name} = \"#{requirement}\"\n" }.join
+        nil
       end
     end
   end

data/lib/dependabot/julia/metadata_finder.rb

@@ -51,34 +51,12 @@ module Dependabot
 
       sig { params(url_string: String).returns(T.nilable(Dependabot::Source)) }
       def parse_source_url(url_string)
-        uri = URI.parse(url_string)
-        hostname = uri.host
-        return nil unless hostname
-
-        # Extract repository path and clean it
-        path = T.must(uri.path).delete_prefix("/").delete_suffix(".git")
-        path_parts = path.split("/")
-        return nil if path_parts.length < 2
-
-        repo = "#{path_parts[0]}/#{path_parts[1]}"
-
-        # Determine the provider based on hostname
-        provider = case hostname
-                   when "github.com" then "github"
-                   when "gitlab.com" then "gitlab"
-                   when /\A.*\.gitlab\.io\z/ then "gitlab"
-                   else
-                     Dependabot.logger.info("Unknown SCM provider for #{hostname}, using generic")
-                     return nil # Return nil for unknown providers
-                   end
-
-        Dependabot::Source.new(
-          provider: provider,
-          repo: repo
-        )
-      rescue URI::InvalidURIError => e
-        Dependabot.logger.error("Invalid URI for dependency #{dependency.name}: #{url_string} - #{e.message}")
-        nil
+        # Source.from_url understands all providers Dependabot supports
+        # (GitHub, GitLab, Bitbucket, Azure DevOps, ...), unlike a
+        # hand-rolled hostname switch
+        source = Dependabot::Source.from_url(url_string)
+        Dependabot.logger.info("Unknown SCM provider for #{url_string}") if source.nil?
+        source
       end
     end
   end

data/lib/dependabot/julia/package/package_details_fetcher.rb

@@ -39,27 +39,23 @@ module Dependabot
 
         sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
         def fetch_package_releases
-          releases = T.let([], T::Array[Dependabot::Package::PackageRelease])
-
-          begin
-            registry_client = RegistryClient.new(
-              credentials: credentials,
-              custom_registries: custom_registries
-            )
-            uuid = T.cast(dependency.metadata[:julia_uuid], T.nilable(String))
-
-            # Fetch all available versions
-            available_versions = registry_client.fetch_available_versions(dependency.name, uuid)
-            return releases if available_versions.empty?
-
-            releases = build_releases_for_versions(registry_client, available_versions, uuid)
-            mark_latest_release(releases)
-
-            releases
-          rescue StandardError => e
-            Dependabot.logger.error("Error while fetching package releases for #{dependency.name}: #{e.message}")
-            releases
-          end
+          registry_client = RegistryClient.new(
+            credentials: credentials,
+            custom_registries: custom_registries
+          )
+          uuid = T.cast(dependency.metadata[:julia_uuid], T.nilable(String))
+
+          # Fetch all available versions. Domain errors (package not found)
+          # come back as an empty list; infrastructure failures raise and are
+          # classified by the updater's error handler rather than being
+          # silently treated as "no update available".
+          available_versions = registry_client.fetch_available_versions(dependency.name, uuid)
+          return [] if available_versions.empty?
+
+          releases = build_releases_for_versions(registry_client, available_versions, uuid)
+          mark_latest_release(releases)
+
+          releases
         end
 
         private

data/lib/dependabot/julia/package_manager.rb

@@ -60,7 +60,7 @@ module Dependabot
         )
       end
 
-      sig { returns(T::Hash[T.untyped, T.untyped]) }
+      sig { returns(T::Hash[Symbol, Object]) }
       def ecosystem
         {
           package_manager: "julia",

data/lib/dependabot/julia/registry_client.rb

@@ -3,6 +3,9 @@
 # frozen_string_literal: true
 
 require "time"
+require "uri"
+require "fileutils"
+require "toml-rb"
 require "dependabot/credential"
 require "dependabot/julia/version"
 require "dependabot/shared_helpers"
@@ -35,18 +38,18 @@ module Dependabot
         )
 
         # Check if the result itself contains an error (package not found)
-        return nil if result["error"]
+        if result["error"]
+          Dependabot.logger.warn(
+            "Failed to fetch latest version for #{package_name}: #{result['error']}"
+          )
+          return nil
+        end
 
         # Extract version from the result structure
         # The Julia helper returns version directly in the result
         return nil unless result["version"]
 
         Gem::Version.new(result["version"])
-      rescue StandardError => e
-        Dependabot.logger.warn(
-          "Failed to fetch latest version for #{package_name}: #{e.message}"
-        )
-        nil
       end
 
       sig { params(package_name: String, package_uuid: T.nilable(String)).returns(T.nilable(Gem::Version)) }
@@ -63,17 +66,17 @@ module Dependabot
         )
 
         # Check if the result itself contains an error (package not found)
-        return nil if result["error"]
+        if result["error"]
+          Dependabot.logger.warn(
+            "Failed to fetch latest version with custom registries for #{package_name}: #{result['error']}"
+          )
+          return nil
+        end
 
         # Extract version from the result structure
         return nil unless result["version"]
 
         Gem::Version.new(result["version"])
-      rescue StandardError => e
-        Dependabot.logger.warn(
-          "Failed to fetch latest version with custom registries for #{package_name}: #{e.message}"
-        )
-        nil
       end
 
       sig { params(package_name: String, package_uuid: String).returns(T.nilable(T::Hash[String, T.untyped])) }
@@ -82,9 +85,6 @@ module Dependabot
           function: "get_package_metadata",
           args: { package_name: package_name, package_uuid: package_uuid }
         )
-      rescue StandardError => e
-        Dependabot.logger.warn("Failed to fetch metadata for #{package_name}: #{e.message}")
-        nil
       end
 
       sig do
@@ -124,9 +124,6 @@ module Dependabot
           "project_file" => result["project_file"],
           "manifest_file" => result["manifest_file"]
         }
-      rescue StandardError => e
-        Dependabot.logger.warn("Failed to find environment files in #{directory}: #{e.message}")
-        {}
       end
 
       sig { params(directory: String).returns(T::Hash[String, T.untyped]) }
@@ -143,9 +140,6 @@ module Dependabot
           "manifest_file" => result["manifest_file"] || "",
           "workspace_root" => result["workspace_root"] || ""
         }
-      rescue StandardError => e
-        Dependabot.logger.warn("Failed to find workspace project files in #{directory}: #{e.message}")
-        { "error" => e.message }
       end
 
       sig do
@@ -182,7 +176,7 @@ module Dependabot
       sig do
         params(
           project_path: String,
-          updates: T::Hash[String, String]
+          updates: T::Hash[String, T::Hash[String, String]]
         ).returns(T::Hash[String, T.untyped])
       end
       def update_manifest(project_path:, updates:)
@@ -213,8 +207,8 @@ module Dependabot
         return nil unless result["release_date"]
 
         Time.parse(result["release_date"])
-      rescue StandardError => e
-        Dependabot.logger.warn("Failed to fetch release date for #{package_name} v#{version}: #{e.message}")
+      rescue ArgumentError => e
+        Dependabot.logger.warn("Failed to parse release date for #{package_name} v#{version}: #{e.message}")
         nil
       end
 
@@ -232,16 +226,16 @@ module Dependabot
         )
 
         # Check if the result contains an error
-        return [] if result["error"]
+        if result["error"]
+          Dependabot.logger.warn("Failed to fetch available versions for #{package_name}: #{result['error']}")
+          return []
+        end
 
         # Extract versions array from the result
         versions = result["versions"]
         return [] unless versions.is_a?(Array)
 
         versions.map(&:to_s)
-      rescue StandardError => e
-        Dependabot.logger.warn("Failed to fetch available versions for #{package_name}: #{e.message}")
-        []
       end
 
       sig { params(package_name: String, package_uuid: T.nilable(String)).returns(T::Array[String]) }
@@ -258,18 +252,18 @@ module Dependabot
         )
 
         # Check if the result contains an error
-        return [] if result["error"]
+        if result["error"]
+          Dependabot.logger.warn(
+            "Failed to fetch available versions with custom registries for #{package_name}: #{result['error']}"
+          )
+          return []
+        end
 
         # Extract versions array from the result
         versions = result["versions"]
         return [] unless versions.is_a?(Array)
 
         versions.map(&:to_s)
-      rescue StandardError => e
-        Dependabot.logger.warn(
-          "Failed to fetch available versions with custom registries for #{package_name}: #{e.message}"
-        )
-        []
       end
 
       # ============================================================================
@@ -278,6 +272,8 @@ module Dependabot
 
       sig { params(dependencies: T::Array[Dependabot::Dependency]).returns(T::Hash[String, T.untyped]) }
       def batch_fetch_package_info(dependencies)
+        return {} if dependencies.empty?
+
         packages = dependencies.map do |dep|
           {
             name: dep.name,
@@ -289,9 +285,6 @@ module Dependabot
           function: "batch_get_package_info",
           args: { packages: packages }
         )
-      rescue StandardError => e
-        Dependabot.logger.error("Failed to batch fetch package info: #{e.message}")
-        {}
       end
 
       sig do
@@ -300,6 +293,8 @@ module Dependabot
         ).returns(T::Hash[String, T::Hash[String, T.nilable(String)]])
       end
       def batch_fetch_version_release_dates(packages_versions)
+        return {} if packages_versions.empty?
+
         result = call_julia_helper(
           function: "batch_get_version_release_dates",
           args: { packages_versions: packages_versions }
@@ -311,13 +306,12 @@ module Dependabot
 
           dates.is_a?(Hash) ? dates : {}
         end
-      rescue StandardError => e
-        Dependabot.logger.error("Failed to batch fetch version release dates: #{e.message}")
-        {}
       end
 
       sig { params(dependencies: T::Array[Dependabot::Dependency]).returns(T::Hash[String, T.untyped]) }
       def batch_fetch_available_versions(dependencies)
+        return {} if dependencies.empty?
+
         packages = dependencies.map do |dep|
           {
             name: dep.name,
@@ -329,9 +323,6 @@ module Dependabot
           function: "batch_get_available_versions",
           args: { packages: packages }
         )
-      rescue StandardError => e
-        Dependabot.logger.error("Failed to batch fetch available versions: #{e.message}")
-        {}
       end
 
       private
@@ -385,21 +376,59 @@ module Dependabot
 
         if ENV["DEPENDABOT_NATIVE_HELPERS_PATH"]
           # In production/CI, use the shared depot where packages were precompiled
-          user_depot = File.join(ENV.fetch("HOME", "/home/dependabot"), ".julia")
           # Trailing : is intentional. It automatically includes the bundled stdlibs
-          env["JULIA_DEPOT_PATH"] = "#{user_depot}:"
+          env["JULIA_DEPOT_PATH"] = "#{julia_user_depot}:"
         end
         # In development use the default Julia depot
 
-        # Add Julia-specific environment variables for registry authentication
-        julia_credentials = credentials.select { |c| c["type"] == "julia_registry" }
-        julia_credentials.each_with_index do |cred, index|
-          env["JULIA_PKG_SERVER_REGISTRY_PREFERENCE_#{index}"] = cred.fetch("url")
-          env["JULIA_PKG_SERVER_#{index}_TOKEN"] = cred.fetch("token") if cred["token"]
+        # Pkg supports a single package server via JULIA_PKG_SERVER;
+        # authentication uses an auth.toml in the depot, not env vars.
+        pkg_server = pkg_server_credential
+        if pkg_server
+          env["JULIA_PKG_SERVER"] = pkg_server.fetch("url")
+          configure_pkg_server_auth(pkg_server)
         end
 
         env
       end
+
+      sig { returns(T.nilable(Dependabot::Credential)) }
+      def pkg_server_credential
+        julia_credentials = credentials.select { |c| c["type"] == "julia_registry" && c["url"] }
+        if julia_credentials.length > 1
+          Dependabot.logger.warn(
+            "Multiple julia_registry credentials configured; Julia's Pkg supports a single " \
+            "package server, using the first"
+          )
+        end
+        julia_credentials.first
+      end
+
+      # Write the package server token where Pkg actually reads it:
+      # <depot>/servers/<host>/auth.toml
+      sig { params(credential: Dependabot::Credential).void }
+      def configure_pkg_server_auth(credential)
+        token = credential["token"]
+        return unless token
+
+        host = URI.parse(credential.fetch("url")).host
+        return unless host
+
+        auth_dir = File.join(julia_user_depot, "servers", host)
+        FileUtils.mkdir_p(auth_dir)
+        File.write(File.join(auth_dir, "auth.toml"), TomlRB.dump({ "access_token" => token }))
+      rescue URI::InvalidURIError => e
+        Dependabot.logger.warn("Invalid julia_registry URL: #{e.message}")
+      end
+
+      sig { returns(String) }
+      def julia_user_depot
+        if ENV["DEPENDABOT_NATIVE_HELPERS_PATH"]
+          File.join(ENV.fetch("HOME", "/home/dependabot"), ".julia")
+        else
+          File.join(Dir.home, ".julia")
+        end
+      end
     end
   end
 end

data/lib/dependabot/julia/requirement.rb

@@ -11,7 +11,7 @@ module Dependabot
       def self.requirements_array(requirement_string)
         # Julia version specifiers can be:
         # - Exact: "1.2.3"
-        # - Range: "1.2-1.3", ">=1.0, <2.0"
+        # - Range: "1.2 - 1.3", ">=1.0, <2.0"
         # - Caret: "^1.2" (compatible within major version)
         # - Tilde: "~1.2.3" (compatible within minor version)
         # Note: Missing compat entry (nil/empty) means any version is acceptable
@@ -35,6 +35,13 @@ module Dependabot
         # Separate constraints (e.g., "^1.10, 2" or "0.34, 0.35") use version specs
         # (with or without ^/~) as OR conditions - any matching spec is acceptable.
         # Only treat as compound if ALL constraints use explicit comparison operators.
+        #
+        # NOTE: Julia's Pkg unions *all* comma-separated compat specs, including
+        # operator-style ones, so ">= 1.0, < 2.0" is `*` to the resolver. We keep
+        # intersection semantics for operator-style lists anyway because this
+        # method also parses Dependabot ignore conditions (e.g. ">= 2.a, < 3"),
+        # which are always intersections; treating those as unions would make
+        # every ignore condition match all versions.
         return false if constraints.length <= 1
 
         constraints.all? { |c| c.match?(/^[<>=]/) }
@@ -65,11 +72,15 @@ module Dependabot
         version
       end
 
+      # Julia hyphen ranges require whitespace around the hyphen ("1.2 - 3.4");
+      # without spaces the hyphen introduces a prerelease tag instead.
+      HYPHEN_RANGE_PATTERN = T.let(/^(\d+(?:\.\d+)*)\s+-\s+(\d+(?:\.\d+)*)$/, Regexp)
+
       sig { params(constraint: String).returns(T::Array[String]) }
       def self.normalize_julia_constraint(constraint)
         return normalize_caret_constraint(constraint) if constraint.match?(/^\^(\d+(?:\.\d+)*)/)
         return normalize_tilde_constraint(constraint) if constraint.match?(/^~(\d+(?:\.\d+)*)/)
-        return normalize_range_constraint(constraint) if constraint.match?(/^(\d+(?:\.\d+)*)-(\d+(?:\.\d+)*)$/)
+        return normalize_range_constraint(constraint) if constraint.match?(HYPHEN_RANGE_PATTERN)
 
         # Julia treats plain version numbers as caret constraints (implicit ^)
         # e.g., "1.2.3" is equivalent to "^1.2.3" which means ">= 1.2.3, < 2.0.0"
@@ -134,18 +145,21 @@ module Dependabot
 
       sig { params(constraint: String).returns(T::Array[String]) }
       private_class_method def self.normalize_range_constraint(constraint)
-        start_version, end_version = constraint.split("-")
-        end_parts = T.must(end_version).split(".")
-
-        next_minor = if end_parts.length >= 2
-                       major = T.must(end_parts[0])
-                       minor = T.must(end_parts[1])
-                       "#{major}.#{minor.to_i + 1}.0"
-                     else
-                       "#{T.must(end_parts[0]).to_i + 1}.0.0"
-                     end
-
-        [">= #{start_version}", "< #{next_minor}"]
+        match = T.must(constraint.match(HYPHEN_RANGE_PATTERN))
+        start_version = T.must(match[1])
+        end_version = T.must(match[2])
+        end_parts = end_version.split(".")
+
+        # Julia hyphen-range semantics (https://pkgdocs.julialang.org/v1/compatibility/):
+        # a fully-specified end is inclusive ("1.2.3 - 4.5.6" admits exactly 4.5.6),
+        # while a partial end acts as a wildcard ("0.2 - 0.5" means up to 0.5.*).
+        upper_bound = case end_parts.length
+                      when 1 then "< #{T.must(end_parts[0]).to_i + 1}.0.0"
+                      when 2 then "< #{T.must(end_parts[0])}.#{T.must(end_parts[1]).to_i + 1}.0"
+                      else "<= #{end_version}"
+                      end
+
+        [">= #{start_version}", upper_bound]
       end
     end
   end

data/lib/dependabot/julia/update_checker/latest_version_finder.rb

@@ -19,7 +19,7 @@ module Dependabot
           ignored_versions: T::Array[String],
           security_advisories: T::Array[Dependabot::SecurityAdvisory],
           raise_on_ignored: T::Boolean,
-          cooldown_config: T.nilable(T::Hash[Symbol, T.untyped]),
+          cooldown_config: T.nilable(T::Hash[Symbol, Object]),
           custom_registries: T::Array[T::Hash[Symbol, String]]
         ).void
       end
@@ -45,7 +45,14 @@ module Dependabot
 
       sig { returns(T.nilable(Gem::Version)) }
       def latest_version
-        @latest_version ||= T.let(fetch_latest_version, T.nilable(Gem::Version))
+        @latest_version ||= T.let(available_versions.max, T.nilable(Gem::Version))
+      end
+
+      # All selectable versions after cooldown, ignored-version and
+      # vulnerability filtering, in ascending order.
+      sig { returns(T::Array[Gem::Version]) }
+      def available_versions
+        @available_versions ||= T.let(fetch_available_versions, T.nilable(T::Array[Gem::Version]))
       end
 
       private
@@ -68,14 +75,14 @@ module Dependabot
       sig { returns(T::Boolean) }
       attr_reader :raise_on_ignored
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       attr_reader :cooldown_config
 
       sig { returns(T::Array[T::Hash[Symbol, String]]) }
       attr_reader :custom_registries
 
-      sig { returns(T.nilable(Gem::Version)) }
-      def fetch_latest_version
+      sig { returns(T::Array[Gem::Version]) }
+      def fetch_available_versions
         # Fetch all package releases using the PackageDetailsFetcher
         package_fetcher = Julia::Package::PackageDetailsFetcher.new(
           dependency: dependency,
@@ -84,32 +91,34 @@ module Dependabot
         )
 
         releases = package_fetcher.fetch_package_releases
-        return nil if releases.empty?
+        return [] if releases.empty?
 
         # Filter releases based on cooldown
         if cooldown_config
           releases = filter_releases_by_cooldown(releases)
-          return nil if releases.empty?
+          return [] if releases.empty?
         end
 
         # Convert to versions for further filtering
         versions = releases.map(&:version).sort
 
+        # Filter out prereleases unless the dependency is already on one
+        versions = filter_prerelease_versions(versions)
+        return [] if versions.empty?
+
         # Filter out ignored versions
         versions = filter_ignored_versions(versions)
-        return nil if versions.empty?
+        return [] if versions.empty?
 
         # Filter out lower versions
         versions = filter_lower_versions(versions)
-        return nil if versions.empty?
+        return [] if versions.empty?
 
         # Filter out vulnerable versions
-        filtered_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+        Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
           versions,
           security_advisories
         )
-
-        filtered_versions.max
       end
 
       sig do
@@ -126,6 +135,21 @@ module Dependabot
         end
       end
 
+      sig { params(versions: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
+      def filter_prerelease_versions(versions)
+        return versions if wants_prerelease?
+
+        versions.reject(&:prerelease?)
+      end
+
+      sig { returns(T::Boolean) }
+      def wants_prerelease?
+        version = dependency.version
+        return false unless version
+
+        Dependabot::Julia::Version.new(version).prerelease?
+      end
+
       sig { params(versions: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
       def filter_ignored_versions(versions)
         filtered = versions.reject do |version|
@@ -148,7 +172,7 @@ module Dependabot
       def filter_lower_versions(versions)
         return versions unless dependency.version
 
-        current_version = Gem::Version.new(dependency.version)
+        current_version = Dependabot::Julia::Version.new(dependency.version)
         versions.select { |v| v > current_version }
       end
 
@@ -180,19 +204,27 @@ module Dependabot
         excludes = T.cast(config[:exclude], T.nilable(T::Array[String]))
 
         # Check exclusions first
-        return false if excludes&.any? { |pattern| dependency.name.match?(Regexp.new(pattern.gsub("*", ".*"))) }
+        return false if excludes&.any? { |pattern| dependency.name.match?(cooldown_pattern_regex(pattern)) }
 
         # Check inclusions (if specified, dependency must match)
-        return includes.any? { |pattern| dependency.name.match?(Regexp.new(pattern.gsub("*", ".*"))) } if includes&.any?
+        return includes.any? { |pattern| dependency.name.match?(cooldown_pattern_regex(pattern)) } if includes&.any?
 
         true # Include by default if no include patterns specified
       end
 
+      # Cooldown include/exclude entries are shell-style globs where only "*"
+      # is a wildcard; everything else matches literally and the whole name
+      # must match (so "JSON" doesn't also cover "JSON3" or "LazyJSON").
+      sig { params(pattern: String).returns(Regexp) }
+      def cooldown_pattern_regex(pattern)
+        Regexp.new("\\A#{pattern.split('*', -1).map { |part| Regexp.escape(part) }.join('.*')}\\z")
+      end
+
       sig { params(version: Gem::Version).returns(T.nilable(Integer)) }
       def determine_cooldown_days(version)
         return nil unless cooldown_config
 
-        current_version = dependency.version ? Gem::Version.new(dependency.version) : nil
+        current_version = dependency.version ? Dependabot::Julia::Version.new(dependency.version) : nil
         return nil unless current_version
 
         version_bump_type = determine_version_bump_type(version, current_version)

data/lib/dependabot/julia/update_checker/requirements_updater.rb

@@ -23,12 +23,15 @@ module Dependabot
           T::Array[Dependabot::DependencyRequirement]
         )
         @target_version = target_version
-        @update_strategy = T.let(update_strategy || :bump_versions, Symbol)
+        # Julia's ecosystem convention (CompatHelper) is to append a new spec
+        # to the existing compat entry, i.e. widen, so that is the default.
+        @update_strategy = T.let(update_strategy || :widen_ranges, Symbol)
       end
 
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
         return requirements unless target_version
+        return requirements if update_strategy == :lockfile_only
 
         target_version_obj = Dependabot::Julia::Version.new(target_version)
 
@@ -69,17 +72,29 @@ module Dependabot
 
       sig { params(requirement_string: String, target_version: Dependabot::Julia::Version).returns(String) }
       def updated_version_requirement(requirement_string, target_version)
-        # Don't update range requirements (e.g., "0.34-0.35") - these are explicit manual constraints
-        return requirement_string if requirement_string.match?(/^\d+(?:\.\d+)*-\d+(?:\.\d+)*$/)
+        # Don't update range requirements (e.g., "0.34 - 0.35") - these are explicit manual constraints
+        return requirement_string if requirement_string.match?(Dependabot::Julia::Requirement::HYPHEN_RANGE_PATTERN)
 
         # Parse all constraints in the requirement string
         reqs = Dependabot::Julia::Requirement.requirements_array(requirement_string)
 
         # Check if any requirement is satisfied by the target version
         # Note: This uses the implicit caret semantics from the Requirement class
-        return requirement_string if reqs.any? { |req| req.satisfied_by?(target_version) }
+        satisfied = reqs.any? { |req| req.satisfied_by?(target_version) }
+
+        case update_strategy
+        when :bump_versions
+          simplified_version_spec(target_version)
+        when :bump_versions_if_necessary
+          satisfied ? requirement_string : simplified_version_spec(target_version)
+        else # :widen_ranges
+          satisfied ? requirement_string : append_spec(requirement_string, target_version)
+        end
+      end
 
-        # Otherwise, append a new requirement that includes the target version
+      sig { params(requirement_string: String, target_version: Dependabot::Julia::Version).returns(String) }
+      def append_spec(requirement_string, target_version)
+        # Append a new requirement that includes the target version
         # Following CompatHelper.jl's approach: use major.minor for versions >= 1.0,
         # 0.minor for 0.x versions, and 0.0.patch for 0.0.x versions
         new_spec = simplified_version_spec(target_version)

data/lib/dependabot/julia/update_checker.rb

@@ -77,19 +77,24 @@ module Dependabot
 
       sig { override.returns(T.nilable(T.any(Dependabot::Version, String))) }
       def latest_resolvable_version_with_no_unlock
-        # Return latest version that satisfies current requirement constraints
-        return nil unless latest_version
+        # Return the highest available version that satisfies the current
+        # requirement constraints. requirements_array applies Julia compat
+        # semantics (implicit caret, tilde, hyphen ranges) and returns
+        # alternatives that are OR'd together.
+        candidates = latest_version_finder.available_versions
+        return nil if candidates.empty?
 
         current_requirement = T.cast(dependency.requirements.first&.fetch(:requirement, nil), T.nilable(String))
 
-        if current_requirement.nil? || current_requirement == "*"
-          return Dependabot::Julia::Version.new(latest_version.to_s)
-        end
-
-        req = requirement_class.new(current_requirement)
-        return unless T.cast(req.satisfied_by?(latest_version), T::Boolean)
+        best = if current_requirement.nil? || current_requirement.strip == "*"
+                 candidates.max
+               else
+                 reqs = requirement_class.requirements_array(current_requirement)
+                 candidates.select { |version| reqs.any? { |req| req.satisfied_by?(version) } }.max
+               end
+        return nil unless best
 
-        Dependabot::Julia::Version.new(latest_version.to_s)
+        Dependabot::Julia::Version.new(best.to_s)
       end
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
@@ -131,8 +136,9 @@ module Dependabot
           semver_major_days: cooldown.semver_major_days,
           semver_minor_days: cooldown.semver_minor_days,
           semver_patch_days: cooldown.semver_patch_days,
-          include: cooldown.include,
-          exclude: cooldown.exclude
+          # ReleaseCooldownOptions stores these as Sets; LatestVersionFinder expects Arrays.
+          include: cooldown.include.to_a,
+          exclude: cooldown.exclude.to_a
         }
       end
 

data/lib/dependabot/julia/version.rb

@@ -6,16 +6,21 @@ require "dependabot/version"
 module Dependabot
   module Julia
     class Version < Dependabot::Version
-      # Julia follows semantic versioning for most packages
+      # Julia follows semantic versioning, including prerelease tags and build
+      # metadata. Build metadata is significant in Julia: JLL packages register
+      # versions like "1.6.10+0", "1.6.10+1" where the build number orders new
+      # builds of the same upstream version.
       # See: https://docs.julialang.org/en/v1/stdlib/Pkg/#Version-specifier-format
-      VERSION_PATTERN = T.let(/^v?(\d+(?:\.\d+)*)(?:[-+].*)?$/, Regexp)
+      VERSION_PATTERN = T.let(
+        /^v?\d+(?:\.\d+)*(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/,
+        Regexp
+      )
 
       sig { override.params(version: T.nilable(T.any(String, Integer, Gem::Version))).returns(T::Boolean) }
       def self.correct?(version)
         return false if version.nil?
 
-        version_string = version.to_s
-        VERSION_PATTERN.match?(version_string)
+        VERSION_PATTERN.match?(version.to_s.strip)
       end
 
       sig { override.params(version: T.nilable(T.any(String, Integer, Gem::Version))).void }
@@ -26,7 +31,7 @@ module Dependabot
         version_string = version_string.sub(/^v/, "") if version_string.match?(/^v\d/)
 
         @version_string = T.let(version_string, String)
-        super(version_string)
+        super(self.class.gem_compatible_version_string(version_string))
       end
 
       sig do
@@ -37,6 +42,29 @@ module Dependabot
       def self.new(version)
         T.cast(super, Dependabot::Julia::Version)
       end
+
+      # Gem::Version rejects "+" so build metadata has to be folded away before
+      # calling super. A numeric build becomes an extra segment, which preserves
+      # Julia's ordering between builds ("1.6.10+1" > "1.6.10+0") and against
+      # neighbouring versions ("1.6.10+1" < "1.6.11"). Non-numeric builds are
+      # dropped for comparison purposes.
+      sig { params(version_string: String).returns(String) }
+      def self.gem_compatible_version_string(version_string)
+        base, build = version_string.split("+", 2)
+        return version_string unless build
+
+        build.match?(/\A\d+\z/) ? "#{base}.#{build}" : T.must(base)
+      end
+
+      sig { returns(String) }
+      def to_s
+        @version_string
+      end
+
+      sig { override.returns(String) }
+      def to_semver
+        @version_string
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-julia
 version: !ruby/object:Gem::Version
-  version: 0.386.0
+  version: 0.387.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
 rdoc_options: []
 require_paths:
 - lib