dependabot-julia 0.387.0 → 0.388.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76dfbce20089045f1450b8e8c2c48a7b3c9b57fb48036014d0df8408a22c2603
-  data.tar.gz: f3594883c239208218847751d87eecbd3f04f9af019e4f9044d8a7da57ee6ac5
+  metadata.gz: 2628b507fdc47bc850a7e6dc73e4530808e4f52639ce522da5360679f594ce70
+  data.tar.gz: 34546cecf9663484a9b3b0d01644587933eda20e6d04f5c6d19e24e37671ecd0
 SHA512:
-  metadata.gz: 27f432eee3b36aa258ae409c4afe26aaa4bc8f41589025d1f4147ba4737d4fe0543225c8765178797e5dbc6c66728e93dec966fd8849223b3731b42e29034dce
-  data.tar.gz: 6b414d534a79f3d9098878652fd5554091cd3faccdb36cab1236ce6972f74e3a24cc7ac68986b46276829b178961132d16971eb2285b47cecc658a23a572246b
+  metadata.gz: a6b3aaaa79728c4bafdd42c8a18aa0955325de301b7ad54811d3da1e6365e933f01002074d97bf6e63174e56ad48f9f1a68d9d9bd2104f9eb72722cd14a00ec8
+  data.tar.gz: 402220f3b7ef021f4b8d34df16814853e2194211fdeec4bf6e0d1cf54c399d2f15a86ec9f50f985fc6745936f7c2cd107661b24d4dcdef4fff0cfdb0ecbd62ab

data/lib/dependabot/julia/file_parser.rb

@@ -105,9 +105,36 @@ module Dependabot
       def project_file_dependencies
         dependencies_map = T.let({}, T::Hash[String, Dependabot::Dependency])
 
-        # Parse all project files in the workspace
-        all_project_files.each do |proj_file|
-          parse_single_project_file(proj_file, dependencies_map)
+        parsed_projects = all_project_files.filter_map do |proj_file|
+          result = parse_project_file(proj_file)
+          [proj_file, result] if result
+        end
+
+        # Packages that are themselves workspace projects (the root package or
+        # a sibling member) resolve by path within the workspace, never from a
+        # registry, so they must not be treated as updatable dependencies.
+        workspace_package_uuids = parsed_projects.filter_map do |_, result|
+          T.cast(result["uuid"], T.nilable(String))
+        end
+
+        parsed_projects.each do |proj_file, result|
+          parsed_deps = T.cast(result["dependencies"] || [], T::Array[T.untyped])
+          merge_dependencies_from_list(
+            parsed_deps,
+            ["deps"],
+            proj_file.name,
+            dependencies_map,
+            workspace_package_uuids
+          )
+
+          parsed_weak_deps = T.cast(result["weak_dependencies"] || [], T::Array[T.untyped])
+          merge_dependencies_from_list(
+            parsed_weak_deps,
+            ["weakdeps"],
+            proj_file.name,
+            dependencies_map,
+            workspace_package_uuids
+          )
         end
 
         apply_manifest_versions(dependencies_map)
@@ -181,8 +208,8 @@ module Dependabot
         end
       end
 
-      sig { params(proj_file: Dependabot::DependencyFile, dependencies_map: T::Hash[String, Dependabot::Dependency]).void }
-      def parse_single_project_file(proj_file, dependencies_map)
+      sig { params(proj_file: Dependabot::DependencyFile).returns(T.nilable(T::Hash[String, T.untyped])) }
+      def parse_project_file(proj_file)
         temp_dir = Dir.mktmpdir("julia_project")
         # File names like "../Project.toml" (a workspace root fetched from a
         # member directory) must not escape the temp dir; fall back to the
@@ -197,15 +224,9 @@ module Dependabot
         begin
           result = registry_client.parse_project(project_path: project_path)
 
-          return if result["error"]
+          return nil if result["error"]
 
-          # Process dependencies
-          parsed_deps = T.cast(result["dependencies"] || [], T::Array[T.untyped])
-          merge_dependencies_from_list(parsed_deps, ["deps"], proj_file.name, dependencies_map)
-
-          # Process weak dependencies
-          parsed_weak_deps = T.cast(result["weak_dependencies"] || [], T::Array[T.untyped])
-          merge_dependencies_from_list(parsed_weak_deps, ["weakdeps"], proj_file.name, dependencies_map)
+          result
         ensure
           FileUtils.rm_rf(temp_dir)
         end
@@ -216,10 +237,11 @@ module Dependabot
           dep_list: T::Array[T.untyped],
           groups: T::Array[String],
           file_name: String,
-          dependencies_map: T::Hash[String, Dependabot::Dependency]
+          dependencies_map: T::Hash[String, Dependabot::Dependency],
+          workspace_package_uuids: T::Array[String]
         ).void
       end
-      def merge_dependencies_from_list(dep_list, groups, file_name, dependencies_map)
+      def merge_dependencies_from_list(dep_list, groups, file_name, dependencies_map, workspace_package_uuids)
         dep_list.each do |dep_info|
           dep_hash = T.cast(dep_info, T::Hash[String, T.untyped])
           name = T.cast(dep_hash["name"], String)
@@ -228,6 +250,8 @@ module Dependabot
           uuid = T.cast(dep_hash["uuid"], T.nilable(String))
           requirement_string = T.cast(dep_hash["requirement"], T.nilable(String))
 
+          next if skip_dependency?(uuid, requirement_string, file_name, workspace_package_uuids)
+
           new_requirement = {
             requirement: requirement_string,
             file: file_name,
@@ -287,6 +311,32 @@ module Dependabot
         dependency_files.select { |f| f.name.match?(/Project\.toml$/i) }
       end
 
+      sig do
+        params(
+          uuid: T.nilable(String),
+          requirement_string: T.nilable(String),
+          file_name: String,
+          workspace_package_uuids: T::Array[String]
+        ).returns(T::Boolean)
+      end
+      def skip_dependency?(uuid, requirement_string, file_name, workspace_package_uuids)
+        return true if uuid && workspace_package_uuids.include?(uuid)
+
+        # A dep with no compat entry in a workspace member file (test/,
+        # docs/, ...) must not get one synthesized: Julia convention
+        # (CompatHelper) only adds compat bounds to the package's own
+        # Project.toml. Existing member compat entries are still updated.
+        requirement_string.nil? && workspace_member_file?(file_name)
+      end
+
+      # Anything outside the target directory ("test/Project.toml", or
+      # "../Project.toml" when Dependabot targets a member directory) was
+      # discovered via workspace membership rather than requested directly.
+      sig { params(file_name: String).returns(T::Boolean) }
+      def workspace_member_file?(file_name)
+        file_name.include?("/")
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def project_file
         @project_file ||= T.let(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-julia
 version: !ruby/object:Gem::Version
-  version: 0.387.0
+  version: 0.388.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.387.0
+        version: 0.388.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
 rdoc_options: []
 require_paths:
 - lib