dependabot-julia 0.395.0 → 0.397.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54579433c6beab3470827fa806a2e620123a56fd2d4b52e1b20573558630cb4c
-  data.tar.gz: 9d9d3d58871d1cfbc2ef1dd47f51628d6b9af1473f0559ebc58783433f5f53d1
+  metadata.gz: 22d7169f4f9c92f586ed2d26a1a3de76469344cb572f48cc6d40767ba283ecd9
+  data.tar.gz: 5c23460a41984bd7bc0e1614cf4ec2dbe52a10bdc2bde328ff169ca75ef8e486
 SHA512:
-  metadata.gz: 84c9be79e65dd54336e7d4edf6547099dcc9454f9199774f1b7781f322eafd869622740d7197183dcf35211495cd1d712fdc7aac0e27d322064119d0902117d4
-  data.tar.gz: c94d643415848f2ff46c5c69303321a535404f64eb53a39ca1ba39035a528711a9ecf2ecde5c1b8835e851bf390469a7ed58d0c0363f8e87798166f0d696e4ca
+  metadata.gz: 7dd64c80617989cbb44e0c80cf744a2250ce158556607e9070ffd2364ec1e949b62c77c5e3e70e53b6fd221110aa4b8da30192510bd255f7c9cfba6b62633a82
+  data.tar.gz: 9c3c6c62bac976740ea9871380d9ac00d5d8fee5bb54c42f79fbfc273f233d17dff453441fdd372270a1aae64cb22e95559171573fac5a297780b669f7f36169

data/lib/dependabot/julia/file_parser.rb

@@ -105,10 +105,7 @@ module Dependabot
       def project_file_dependencies
         dependencies_map = T.let({}, T::Hash[String, Dependabot::Dependency])
 
-        parsed_projects = all_project_files.filter_map do |proj_file|
-          result = parse_project_file(proj_file)
-          [proj_file, result] if result
-        end
+        parsed_projects = parse_project_files
 
         # Packages that are themselves workspace projects (the root package or
         # a sibling member) resolve by path within the workspace, never from a
@@ -148,6 +145,11 @@ module Dependabot
         return if versions.empty?
 
         dependencies_map.transform_values! do |dep|
+          # Julia pins a stdlib itself, so its manifest entry is not something
+          # Dependabot can bump; with no version recorded only the compat
+          # entry is maintained
+          next dep if dep.metadata.key?(:julia_stdlib_versions)
+
           uuid = T.cast(dep.metadata[:julia_uuid], T.nilable(String))
           version = uuid && versions[uuid]
           next dep unless version
@@ -206,30 +208,28 @@ module Dependabot
         end
       end
 
-      sig do
-        params(proj_file: Dependabot::DependencyFile)
-          .returns(T.nilable(Dependabot::Julia::RegistryClient::Result::Project))
-      end
-      def parse_project_file(proj_file)
-        temp_dir = Dir.mktmpdir("julia_project")
-        # File names like "../Project.toml" (a workspace root fetched from a
-        # member directory) must not escape the temp dir; fall back to the
-        # basename since each project file gets its own directory anyway.
-        project_path = File.expand_path(File.join(temp_dir, proj_file.name))
-        unless project_path.start_with?("#{File.expand_path(temp_dir)}#{File::SEPARATOR}")
-          project_path = File.join(temp_dir, File.basename(proj_file.name))
-        end
-        FileUtils.mkdir_p(File.dirname(project_path))
-        File.write(project_path, proj_file.content)
-
-        begin
-          result = registry_client.parse_project(project_path: project_path)
+      # The project files are laid out together as in the repository so that
+      # the helper can find a member's workspace root (or a test
+      # environment's package) and bound it by that parent's julia compat.
+      sig { returns(T::Array[[Dependabot::DependencyFile, Dependabot::Julia::RegistryClient::Result::Project]]) }
+      def parse_project_files
+        Dir.mktmpdir("julia_project") do |temp_dir|
+          project_paths = all_project_files.map do |proj_file|
+            # DependencyFile#path resolves a name like "../Project.toml" (a
+            # workspace root fetched from a member directory) against the
+            # file's directory, so it cannot escape the temp dir
+            project_path = File.join(temp_dir, proj_file.path)
+            FileUtils.mkdir_p(File.dirname(project_path))
+            File.write(project_path, proj_file.content)
+            [proj_file, project_path]
+          end
 
-          return nil if result.is_a?(Dependabot::Julia::RegistryClient::Result::Failure)
+          project_paths.filter_map do |proj_file, project_path|
+            result = registry_client.parse_project(project_path: project_path)
+            next if result.is_a?(Dependabot::Julia::RegistryClient::Result::Failure)
 
-          result
-        ensure
-          FileUtils.rm_rf(temp_dir)
+            [proj_file, result]
+          end
         end
       end
 
@@ -250,7 +250,7 @@ module Dependabot
           uuid = dependency.uuid
           requirement_string = dependency.requirement
 
-          next if skip_dependency?(uuid, requirement_string, file_name, workspace_package_uuids)
+          next if skip_dependency?(dependency, file_name, workspace_package_uuids)
 
           new_requirement = {
             requirement: requirement_string,
@@ -270,7 +270,7 @@ module Dependabot
               version: nil,
               requirements: existing_requirements,
               package_manager: "julia",
-              metadata: existing_dep.metadata
+              metadata: dependency_metadata(dependency, file_name, existing_dep.metadata)
             )
           else
             # Create new dependency
@@ -279,12 +279,28 @@ module Dependabot
               version: nil,
               requirements: [new_requirement],
               package_manager: "julia",
-              metadata: { julia_uuid: uuid }
+              metadata: dependency_metadata(dependency, file_name, { julia_uuid: uuid })
             )
           end
         end
       end
 
+      # A stdlib carries the versions its compat entry has to admit, keyed by
+      # project file since every file has its own effective julia range
+      sig do
+        params(
+          dependency: Dependabot::Julia::RegistryClient::Result::ProjectDependency,
+          file_name: String,
+          metadata: T::Hash[Symbol, T.untyped]
+        ).returns(T::Hash[Symbol, T.untyped])
+      end
+      def dependency_metadata(dependency, file_name, metadata)
+        return metadata unless dependency.stdlib
+
+        versions_by_file = T.cast(metadata[:julia_stdlib_versions], T.nilable(T::Hash[String, T::Array[String]])) || {}
+        metadata.merge(julia_stdlib_versions: versions_by_file.merge(file_name => dependency.stdlib_versions))
+      end
+
       # UUID is a package's identity in Julia: two same-named entries with
       # different UUIDs are different packages, and merging them would run
       # updates against the wrong UUID.
@@ -313,20 +329,34 @@ module Dependabot
 
       sig do
         params(
-          uuid: T.nilable(String),
-          requirement_string: T.nilable(String),
+          dependency: Dependabot::Julia::RegistryClient::Result::ProjectDependency,
           file_name: String,
           workspace_package_uuids: T::Array[String]
         ).returns(T::Boolean)
       end
-      def skip_dependency?(uuid, requirement_string, file_name, workspace_package_uuids)
-        return true if uuid && workspace_package_uuids.include?(uuid)
+      def skip_dependency?(dependency, file_name, workspace_package_uuids)
+        return true if workspace_package_uuids.include?(dependency.uuid)
+
+        # Pkg pins a standard library to the version bundled with Julia, so
+        # a compat entry tracking its registry releases (a legacy bridge for
+        # older Julia, or an "upgradable" stdlib release) can make the
+        # project uninstallable on part of its supported Julia range. The
+        # helper flags packages that ship with any Julia release admitted by
+        # the project's julia compat and reports the versions the entry has
+        # to admit instead; without those there is nothing safe to propose.
+        if dependency.stdlib && dependency.stdlib_versions.empty?
+          Dependabot.logger.info(
+            "Skipping #{dependency.name} in #{file_name}: standard library with no known versions " \
+            "for the project's Julia range"
+          )
+          return true
+        end
 
         # A dep with no compat entry in a workspace member file (test/,
         # docs/, ...) must not get one synthesized: Julia convention
         # (CompatHelper) only adds compat bounds to the package's own
         # Project.toml. Existing member compat entries are still updated.
-        requirement_string.nil? && workspace_member_file?(file_name)
+        dependency.requirement.nil? && workspace_member_file?(file_name)
       end
 
       # Anything outside the target directory ("test/Project.toml", or

data/lib/dependabot/julia/registry_client/result.rb

@@ -51,6 +51,23 @@ module Dependabot
             optional_string_value(hash[key], "#{context} #{key}")
           end
 
+          sig { params(hash: ObjectHash, key: String, context: String).returns(T::Boolean) }
+          def self.optional_boolean(hash, key, context)
+            case hash[key]
+            when nil, false then false
+            when true then true
+            else raise TypeError, "#{context} #{key} must be a boolean or nil"
+            end
+          end
+
+          sig { params(hash: ObjectHash, key: String, context: String).returns(T::Array[String]) }
+          def self.optional_string_array(hash, key, context)
+            value = hash[key]
+            return [] if value.nil?
+
+            string_array(value, "#{context} #{key}")
+          end
+
           sig { params(value: Object, context: String).returns(String) }
           def self.string_value(value, context)
             return value if value.is_a?(String)
@@ -165,6 +182,13 @@ module Dependabot
           const :name, String
           const :uuid, String
           const :requirement, T.nilable(String), default: nil
+          # Ships with at least one Julia release admitted by the project's
+          # julia compat entry
+          const :stdlib, T::Boolean, default: false
+          # For a stdlib, the versions its compat entry has to admit across
+          # that Julia range (lowest per caret line, sorted); see the helper's
+          # stdlib_versions_for_julia_compat
+          const :stdlib_versions, T::Array[String], default: []
 
           sig { params(value: Object).returns(ProjectDependency) }
           def self.from_object(value)
@@ -174,7 +198,9 @@ module Dependabot
             new(
               name: ValueParser.string(hash, "name", context),
               uuid: ValueParser.string(hash, "uuid", context),
-              requirement: ValueParser.optional_string(hash, "requirement", context)
+              requirement: ValueParser.optional_string(hash, "requirement", context),
+              stdlib: ValueParser.optional_boolean(hash, "stdlib", context),
+              stdlib_versions: ValueParser.optional_string_array(hash, "stdlib_versions", context)
             )
           end
         end

data/lib/dependabot/julia/update_checker/requirements_updater.rb

@@ -14,10 +14,11 @@ module Dependabot
         params(
           requirements: T::Array[Dependabot::DependencyRequirement],
           target_version: T.nilable(String),
-          update_strategy: T.nilable(Symbol)
+          update_strategy: T.nilable(Symbol),
+          stdlib_versions: T::Hash[String, T::Array[String]]
         ).void
       end
-      def initialize(requirements:, target_version:, update_strategy:)
+      def initialize(requirements:, target_version:, update_strategy:, stdlib_versions: {})
         @requirements = T.let(
           requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
           T::Array[Dependabot::DependencyRequirement]
@@ -26,16 +27,22 @@ module Dependabot
         # Julia's ecosystem convention (CompatHelper) is to append a new spec
         # to the existing compat entry, i.e. widen, so that is the default.
         @update_strategy = T.let(update_strategy || :widen_ranges, Symbol)
+        # For a standard library: the versions its compat entry has to admit,
+        # keyed by project file (see FileParser#dependency_metadata)
+        @stdlib_versions = stdlib_versions
       end
 
       sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        return requirements unless target_version
         return requirements if update_strategy == :lockfile_only
 
-        target_version_obj = Dependabot::Julia::Version.new(target_version)
+        target_version_obj = target_version && Dependabot::Julia::Version.new(target_version)
 
         requirements.map do |requirement|
+          floor = stdlib_versions.fetch(requirement.file.to_s, [])
+          next update_stdlib_requirement(requirement, floor) if floor.any?
+          next requirement unless target_version_obj
+
           update_requirement(requirement, target_version_obj)
         end
       end
@@ -51,6 +58,60 @@ module Dependabot
       sig { returns(Symbol) }
       attr_reader :update_strategy
 
+      sig { returns(T::Hash[String, T::Array[String]]) }
+      attr_reader :stdlib_versions
+
+      # A stdlib's compat entry has to admit every version the project can
+      # meet across its Julia range rather than track the registry's latest
+      # release, so it is only ever widened to cover the missing ones,
+      # whatever strategy is configured.
+      sig do
+        params(
+          requirement: Dependabot::DependencyRequirement,
+          floor: T::Array[String]
+        ).returns(Dependabot::DependencyRequirement)
+      end
+      def update_stdlib_requirement(requirement, floor)
+        current_requirement = requirement.requirement_string
+        # Explicit ranges are manual constraints, as in updated_version_requirement
+        return requirement if current_requirement&.match?(Dependabot::Julia::Requirement::HYPHEN_RANGE_PATTERN)
+
+        versions = floor.map { |version| Dependabot::Julia::Version.new(version) }
+        new_requirement = if current_requirement.nil?
+                            versions.map { |version| stdlib_version_spec(version) }.join(", ")
+                          else
+                            widened_stdlib_requirement(current_requirement, versions)
+                          end
+        return requirement if new_requirement == current_requirement
+
+        Dependabot::DependencyRequirement.create(requirement.merge(requirement: new_requirement))
+      end
+
+      sig { params(requirement_string: String, versions: T::Array[Dependabot::Julia::Version]).returns(String) }
+      def widened_stdlib_requirement(requirement_string, versions)
+        reqs = Dependabot::Julia::Requirement.requirements_array(requirement_string)
+        missing = versions.reject { |version| reqs.any? { |req| req.satisfied_by?(version) } }
+
+        missing.reduce(requirement_string) do |entry, version|
+          append_spec_string(entry, stdlib_version_spec(version))
+        end
+      end
+
+      # Same shape as simplified_version_spec, except that "1.0.0" reads as
+      # "1" (the stdlib line, not a particular release) and 0.0.0 stands for
+      # the old test sandbox pin, written as the PSA recommends
+      sig { params(version: Dependabot::Julia::Version).returns(String) }
+      def stdlib_version_spec(version)
+        major = (version.segments[0] || 0).to_i
+        minor = (version.segments[1] || 0).to_i
+        patch = (version.segments[2] || 0).to_i
+
+        return "< 0.0.1" if major.zero? && minor.zero? && patch.zero?
+        return major.to_s if major.positive? && minor.zero?
+
+        simplified_version_spec(version)
+      end
+
       sig do
         params(
           requirement: Dependabot::DependencyRequirement,
@@ -97,8 +158,11 @@ module Dependabot
         # Append a new requirement that includes the target version
         # Following CompatHelper.jl's approach: use major.minor for versions >= 1.0,
         # 0.minor for 0.x versions, and 0.0.patch for 0.0.x versions
-        new_spec = simplified_version_spec(target_version)
+        append_spec_string(requirement_string, simplified_version_spec(target_version))
+      end
 
+      sig { params(requirement_string: String, new_spec: String).returns(String) }
+      def append_spec_string(requirement_string, new_spec)
         # Append the new spec to the existing requirement (CompatHelper KeepEntry behavior)
         # Detect whether the existing requirement uses spaces after commas and preserve that format
         # and default to ", " if no commas found

data/lib/dependabot/julia/update_checker.rb

@@ -49,6 +49,10 @@ module Dependabot
 
       sig { override.returns(T.nilable(Gem::Version)) }
       def latest_version
+        # A standard library has no registry target: Julia pins the version,
+        # only its compat entry is maintained (see #updated_requirements)
+        return nil if stdlib?
+
         @latest_version ||= T.let(latest_version_finder.latest_version, T.nilable(Gem::Version))
       end
 
@@ -77,6 +81,8 @@ module Dependabot
 
       sig { override.returns(T.nilable(T.any(Dependabot::Version, String))) }
       def latest_resolvable_version_with_no_unlock
+        return nil if stdlib?
+
         # Return the highest available version that satisfies the current
         # requirement constraints. requirements_array applies Julia compat
         # semantics (implicit caret, tilde, hyphen ranges) and returns
@@ -102,12 +108,26 @@ module Dependabot
         Dependabot::Julia::RequirementsUpdater.new(
           requirements: dependency.requirements,
           target_version: latest_resolvable_version&.to_s,
-          update_strategy: requirements_update_strategy&.to_s&.to_sym
+          update_strategy: requirements_update_strategy&.to_s&.to_sym,
+          stdlib_versions: stdlib_versions
         ).updated_requirements
       end
 
       private
 
+      # Versions a stdlib's compat entry has to admit, by project file; set by
+      # the file parser for packages that ship with any Julia release the
+      # project supports
+      sig { returns(T::Hash[String, T::Array[String]]) }
+      def stdlib_versions
+        T.cast(dependency.metadata[:julia_stdlib_versions], T.nilable(T::Hash[String, T::Array[String]])) || {}
+      end
+
+      sig { returns(T::Boolean) }
+      def stdlib?
+        stdlib_versions.any?
+      end
+
       sig { returns(Dependabot::Julia::LatestVersionFinder) }
       def latest_version_finder
         @latest_version_finder ||= T.let(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-julia
 version: !ruby/object:Gem::Version
-  version: 0.395.0
+  version: 0.397.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.397.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.395.0
+        version: 0.397.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.397.0
 rdoc_options: []
 require_paths:
 - lib