dependabot-julia 0.398.0 → 0.399.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91b67df0bf6edaecd8f73982a91d18d9bf7f1a47d8709b1c00b10dd8db414970
-  data.tar.gz: 5c23460a41984bd7bc0e1614cf4ec2dbe52a10bdc2bde328ff169ca75ef8e486
+  metadata.gz: 6c3e654c12908a919461515b6c592e15e2382f106f203b0def25ed45bc68205b
+  data.tar.gz: b9c55d333c085e4cd51fd74d88e33fd98c8d379ea41be890fcf83c561f4c06ba
 SHA512:
-  metadata.gz: aedc088fe9f5a59c56640d3260e67d0004093510f0933c183060b265a4d1550a7e072ccbb7bb7ca7a1af0cc081858ad8e99a4b11b504958ca188bd556ac13841
-  data.tar.gz: 9c3c6c62bac976740ea9871380d9ac00d5d8fee5bb54c42f79fbfc273f233d17dff453441fdd372270a1aae64cb22e95559171573fac5a297780b669f7f36169
+  metadata.gz: 3a1cdb18bb53b82740729fd4ce2c8276457dd0ac796f38263844fc5ec6e20a36c84d9d2882f04d0834d006080136b5f5b457eed630ad9434625912a174362baf
+  data.tar.gz: a74b876e844080eb47dad827cef47cef9c861e999e8afcc013da8d12206a6a8e2131fc5810af4e82260f38c179b053d3dae0b64c2badb8bfb3ba3af3c9950f19

data/lib/dependabot/julia/file_fetcher.rb

@@ -34,19 +34,47 @@ module Dependabot
       def fetch_files_using_julia_helper(temp_dir)
         workspace_info = registry_client.find_workspace_project_files(temp_dir.to_s)
         if workspace_info.is_a?(Dependabot::Julia::RegistryClient::Result::Failure)
-          raise Dependabot::DependencyFileNotFound, "No Project.toml or JuliaProject.toml found."
+          raise_workspace_failure(workspace_info, temp_dir.to_s)
         end
 
         project_files = workspace_info.project_files
-        manifest_path = workspace_info.manifest_file
+        manifest_paths = workspace_info.manifest_files
+        manifest_paths = [workspace_info.manifest_file] if manifest_paths.empty?
 
         fetched_files = fetch_all_project_files(project_files, temp_dir.to_s)
         raise Dependabot::DependencyFileNotFound, "No Project.toml or JuliaProject.toml found." if fetched_files.empty?
 
-        fetch_manifest_file(fetched_files, manifest_path, project_files, temp_dir.to_s)
+        manifest_paths.each do |manifest_path|
+          fetch_manifest_file(fetched_files, manifest_path, project_files, temp_dir.to_s)
+        end
         fetched_files
       end
 
+      # Pkg refuses a project it cannot read (a [compat] entry for a package
+      # in no dependency section, say), so report its reason against the
+      # project file rather than claiming there is none
+      sig do
+        params(failure: Dependabot::Julia::RegistryClient::Result::Failure, temp_dir: String).returns(T.noreturn)
+      end
+      def raise_workspace_failure(failure, temp_dir)
+        project_name = %w(JuliaProject.toml Project.toml).find { |name| File.exist?(File.join(temp_dir, name)) }
+        raise Dependabot::DependencyFileNotFound, "No Project.toml or JuliaProject.toml found." unless project_name
+
+        raise Dependabot::DependencyFileNotParseable.new(
+          File.join(directory, project_name),
+          relative_to(failure.message, temp_dir)
+        )
+      end
+
+      # Pkg may report the temporary directory by its realpath
+      # ("/private/tmp/..." on macOS); strip that first so the shorter form
+      # cannot match inside it
+      sig { params(message: String, dir: String).returns(String) }
+      def relative_to(message, dir)
+        prefixes = [File.exist?(dir) ? File.realpath(dir) : dir, dir].uniq.map { |prefix| File.join(prefix, "") }
+        prefixes.reduce(message) { |text, prefix| text.gsub(prefix, "") }
+      end
+
       sig { params(project_files: T::Array[String], base_dir: String).returns(T::Array[Dependabot::DependencyFile]) }
       def fetch_all_project_files(project_files, base_dir)
         project_files.filter_map do |project_path|

data/lib/dependabot/julia/file_parser.rb

@@ -130,6 +130,14 @@ module Dependabot
             dependencies_map,
             workspace_package_uuids
           )
+
+          merge_dependencies_from_list(
+            result.extra_dependencies,
+            ["extras"],
+            proj_file.name,
+            dependencies_map,
+            workspace_package_uuids
+          )
         end
 
         apply_manifest_versions(dependencies_map)
@@ -150,6 +158,12 @@ module Dependabot
           # entry is maintained
           next dep if dep.metadata.key?(:julia_stdlib_versions)
 
+          # A weakdep or extra found in the manifest is there as an indirect
+          # dependency of something else; the helper only bumps [deps]
+          # entries, so a version would announce a manifest update that never
+          # happens. It gets compat updates only.
+          next dep unless direct_dependency?(dep)
+
           uuid = T.cast(dep.metadata[:julia_uuid], T.nilable(String))
           version = uuid && versions[uuid]
           next dep unless version
@@ -164,22 +178,34 @@ module Dependabot
         end
       end
 
+      sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
+      def direct_dependency?(dep)
+        dep.requirements.any? { |req| req.groups&.include?("deps") }
+      end
+
+      # An environment can have a manifest per Julia release (Manifest-v1.12.toml
+      # beside Manifest.toml). The oldest version across them is the current one,
+      # so a manifest that lags behind the others still gets updated.
       sig { returns(T::Hash[String, String]) }
       def manifest_versions_by_uuid
-        manifest = manifest_file
-        return {} unless manifest
+        manifest_files.each_with_object(T.let({}, T::Hash[String, String])) do |manifest, map|
+          result = parse_manifest_content(T.must(manifest.content))
 
-        result = parse_manifest_content(T.must(manifest.content))
+          if result.is_a?(Dependabot::Julia::RegistryClient::Result::Failure)
+            Dependabot.logger.warn("Failed to parse Julia manifest #{manifest.name}: #{result.message}")
+            next
+          end
 
-        if result.is_a?(Dependabot::Julia::RegistryClient::Result::Failure)
-          Dependabot.logger.warn("Failed to parse Julia manifest: #{result.message}")
-          return {}
-        end
+          result.dependencies.each do |dependency|
+            next if dependency.version.empty?
 
-        result.dependencies.each_with_object({}) do |dependency, map|
-          next if dependency.version.empty?
+            current = map[dependency.uuid]
+            if current && Dependabot::Julia::Version.new(current) <= Dependabot::Julia::Version.new(dependency.version)
+              next
+            end
 
-          map[dependency.uuid] = dependency.version
+            map[dependency.uuid] = dependency.version
+          end
         end
       end
 
@@ -201,9 +227,9 @@ module Dependabot
         end
       end
 
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      def manifest_file
-        dependency_files.find do |f|
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def manifest_files
+        dependency_files.select do |f|
           File.basename(f.name).match?(/^(Julia)?Manifest(?:-v[\d.]+)?\.toml$/i)
         end
       end
@@ -250,7 +276,7 @@ module Dependabot
           uuid = dependency.uuid
           requirement_string = dependency.requirement
 
-          next if skip_dependency?(dependency, file_name, workspace_package_uuids)
+          next if skip_dependency?(dependency, groups, file_name, workspace_package_uuids)
 
           new_requirement = {
             requirement: requirement_string,
@@ -330,13 +356,19 @@ module Dependabot
       sig do
         params(
           dependency: Dependabot::Julia::RegistryClient::Result::ProjectDependency,
+          groups: T::Array[String],
           file_name: String,
           workspace_package_uuids: T::Array[String]
         ).returns(T::Boolean)
       end
-      def skip_dependency?(dependency, file_name, workspace_package_uuids)
+      def skip_dependency?(dependency, groups, file_name, workspace_package_uuids)
         return true if workspace_package_uuids.include?(dependency.uuid)
 
+        # A test dependency under [extras] is only maintained once the project
+        # has given it a compat entry, as CompatHelper does by default
+        # (IfExistingCompatExtras); nothing is synthesized for the rest.
+        return true if dependency.requirement.nil? && groups.include?("extras")
+
         # Pkg pins a standard library to the version bundled with Julia, so
         # a compat entry tracking its registry releases (a legacy bridge for
         # older Julia, or an "upgradable" stdlib release) can make the

data/lib/dependabot/julia/file_updater.rb

@@ -58,23 +58,25 @@ module Dependabot
         SharedHelpers.in_a_temporary_repo_directory(T.must(dependency_files.first).directory, repo_contents_path) do
           # Update all project files (main + workspace members)
           updated_project_files = update_all_project_files
-          actual_manifest = find_manifest_file
+          manifests = find_manifest_files
 
-          return all_projects_only_update(updated_project_files) if actual_manifest.nil?
+          return all_projects_only_update(updated_project_files) if manifests.empty?
 
           # Requirement-only updates (no target versions) have nothing to tell
           # Pkg; ship the Project.toml changes on their own.
           return all_projects_only_update(updated_project_files) if build_updates_hash.empty?
 
           # Write all updated project files to disk for Julia's Pkg
-          write_all_temporary_files(updated_project_files, actual_manifest)
-          result = call_julia_helper
+          write_all_temporary_files(updated_project_files, manifests)
+          updated_files.concat(all_projects_only_update(updated_project_files))
 
-          if result.is_a?(Dependabot::Julia::RegistryClient::Result::Failure)
-            return handle_julia_helper_error_multi(result, actual_manifest, updated_project_files)
+          # Each manifest is resolved separately, by the Julia release that uses it
+          manifests.each do |manifest|
+            updated_manifest = updated_manifest_file(manifest)
+            updated_files << updated_manifest if updated_manifest
           end
-
-          build_updated_files_multi(updated_files, updated_project_files, actual_manifest, result)
+          # A manifest that could not be resolved is reported in a notice instead
+          return updated_files if updated_files.empty? && notices.any?
         end
 
         raise "No files changed!" if updated_files.empty?
@@ -129,10 +131,10 @@ module Dependabot
       sig do
         params(
           updated_project_files: T::Array[T::Hash[Symbol, T.untyped]],
-          actual_manifest: Dependabot::DependencyFile
+          manifests: T::Array[Dependabot::DependencyFile]
         ).void
       end
-      def write_all_temporary_files(updated_project_files, actual_manifest)
+      def write_all_temporary_files(updated_project_files, manifests)
         # Write all updated project files
         updated_project_files.each do |update_info|
           file = T.cast(update_info[:file], Dependabot::DependencyFile)
@@ -143,45 +145,41 @@ module Dependabot
           File.write(file_path, content)
         end
 
-        # Write manifest file
-        manifest_path = actual_manifest.name
-        FileUtils.mkdir_p(File.dirname(manifest_path)) if manifest_path.include?("/")
-        File.write(manifest_path, actual_manifest.content)
+        manifests.each do |manifest|
+          FileUtils.mkdir_p(File.dirname(manifest.name)) if manifest.name.include?("/")
+          File.write(manifest.name, manifest.content)
+        end
       end
 
-      sig do
-        returns(
-          T.any(
-            Dependabot::Julia::RegistryClient::Result::ManifestUpdate,
-            Dependabot::Julia::RegistryClient::Result::Failure
-          )
-        )
-      end
-      def call_julia_helper
-        registry_client.update_manifest(
+      sig { params(manifest: Dependabot::DependencyFile).returns(T.nilable(Dependabot::DependencyFile)) }
+      def updated_manifest_file(manifest)
+        result = registry_client.update_manifest(
           project_path: Dir.pwd,
+          manifest_path: File.expand_path(manifest.name),
           updates: build_updates_hash
         )
+
+        if result.is_a?(Dependabot::Julia::RegistryClient::Result::Failure)
+          handle_julia_helper_error(result, manifest)
+          return nil
+        end
+        return nil if result.manifest_content == manifest.content
+
+        updated_file(file: manifest_file_for_path(result.manifest_path), content: result.manifest_content)
       end
 
       sig do
         params(
           result: Dependabot::Julia::RegistryClient::Result::Failure,
-          actual_manifest: Dependabot::DependencyFile,
-          updated_project_files: T::Array[T::Hash[Symbol, T.untyped]]
-        ).returns(T::Array[Dependabot::DependencyFile])
+          manifest: Dependabot::DependencyFile
+        ).void
       end
-      def handle_julia_helper_error_multi(result, actual_manifest, updated_project_files)
+      def handle_julia_helper_error(result, manifest)
         error_message = result.message
-        manifest_path = actual_manifest.name
-
-        is_resolver_error = resolver_error?(error_message)
-        raise error_message unless is_resolver_error
-
-        add_manifest_update_notice(manifest_path, error_message)
+        raise error_message unless resolver_error?(error_message)
 
-        # Return all updated Project.toml files
-        all_projects_only_update(updated_project_files)
+        # The Project.toml changes still go out without this manifest
+        add_manifest_update_notice(manifest.name, error_message)
       end
 
       sig { params(error_message: String).returns(T::Boolean) }
@@ -216,31 +214,6 @@ module Dependabot
         )
       end
 
-      sig do
-        params(
-          updated_files: T::Array[Dependabot::DependencyFile],
-          updated_project_files: T::Array[T::Hash[Symbol, T.untyped]],
-          actual_manifest: Dependabot::DependencyFile,
-          result: Dependabot::Julia::RegistryClient::Result::ManifestUpdate
-        ).void
-      end
-      def build_updated_files_multi(updated_files, updated_project_files, actual_manifest, result)
-        # Add all updated project files
-        updated_project_files.each do |update_info|
-          file = T.cast(update_info[:file], Dependabot::DependencyFile)
-          content = T.cast(update_info[:content], String)
-          next if content == file.content
-
-          updated_files << updated_file(file: file, content: content)
-        end
-
-        updated_manifest_content = result.manifest_content
-        return unless updated_manifest_content != actual_manifest.content
-
-        manifest_for_update = manifest_file_for_path(result.manifest_path)
-        updated_files << updated_file(file: manifest_for_update, content: updated_manifest_content)
-      end
-
       private
 
       sig { returns(T::Hash[String, T::Hash[String, String]]) }
@@ -251,6 +224,10 @@ module Dependabot
             dependencies.each do |dependency|
               version = dependency.version
               next unless version
+              # Only a [deps] entry has a manifest entry of its own to bump;
+              # the helper leaves weakdeps and extras alone, so their updates
+              # are compat-only and need no Pkg run
+              next unless dependency.requirements.any? { |req| req.groups&.include?("deps") }
 
               uuid = dependency.metadata[:julia_uuid]
               unless uuid.is_a?(String)
@@ -294,15 +271,15 @@ module Dependabot
         )
       end
 
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      def find_manifest_file
-        # The file fetcher has already identified the correct manifest file
-        # For regular packages: manifest in same directory
-        # For workspace packages: manifest in parent directory
-        # We just need to find it in dependency_files
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def find_manifest_files
+        # The file fetcher has already identified the environment's manifests
+        # For regular packages: manifests in same directory
+        # For workspace packages: manifests in parent directory
+        # We just need to find them in dependency_files
         project_dir = T.must(project_file).directory
 
-        dependency_files.find do |f|
+        dependency_files.select do |f|
           # Use basename to get just the filename, not the full path with ../
           is_manifest = File.basename(f.name).match?(/^(Julia)?Manifest(?:-v[\d.]+)?\.toml$/i)
           is_manifest && (f.directory == project_dir || parent_directory_of?(f.directory, project_dir))

data/lib/dependabot/julia/package/package_details_fetcher.rb

@@ -14,6 +14,7 @@ module Dependabot
         extend T::Sig
 
         PACKAGE_LANGUAGE = "julia"
+        RELEASE_DATE_PENDING = "release_date_pending"
 
         sig do
           params(
@@ -73,9 +74,14 @@ module Dependabot
 
           available_versions.map do |version_string|
             version = Julia::Version.new(version_string)
-            release_date = release_dates[version_string]
+            date_result = release_dates[version_string]
+            date_result = nil if date_result.is_a?(RegistryClient::Result::Failure)
 
-            create_package_release(version, release_date)
+            create_package_release(
+              version,
+              convert_single_date(date_result&.release_date),
+              release_date_pending: date_result&.pending || false
+            )
           end
         end
 
@@ -84,7 +90,9 @@ module Dependabot
             registry_client: RegistryClient,
             available_versions: T::Array[String],
             uuid: T.nilable(String)
-          ).returns(T::Hash[String, T.nilable(Time)])
+          ).returns(
+            T::Hash[String, T.any(RegistryClient::Result::ReleaseDate, RegistryClient::Result::Failure)]
+          )
         end
         def fetch_release_dates_batch(registry_client, available_versions, uuid)
           return {} if available_versions.empty?
@@ -103,20 +111,7 @@ module Dependabot
           dates_for_package = result.packages[dependency.name]
           return {} unless dates_for_package.is_a?(RegistryClient::Result::ReleaseDates)
 
-          convert_dates_to_time_objects(dates_for_package)
-        end
-
-        sig do
-          params(
-            release_dates: RegistryClient::Result::ReleaseDates
-          ).returns(T::Hash[String, T.nilable(Time)])
-        end
-        def convert_dates_to_time_objects(release_dates)
-          release_dates.dates.transform_values do |result|
-            next if result.is_a?(RegistryClient::Result::Failure)
-
-            convert_single_date(result.release_date)
-          end
+          dates_for_package.dates
         end
 
         sig { params(date_value: T.nilable(String)).returns(T.nilable(Time)) }
@@ -131,16 +126,18 @@ module Dependabot
         sig do
           params(
             version: Julia::Version,
-            release_date: T.nilable(Time)
+            release_date: T.nilable(Time),
+            release_date_pending: T::Boolean
           ).returns(Dependabot::Package::PackageRelease)
         end
-        def create_package_release(version, release_date)
+        def create_package_release(version, release_date, release_date_pending:)
           Dependabot::Package::PackageRelease.new(
             version: version,
             released_at: release_date,
             latest: false, # Will be determined later
             yanked: false, # Yanked versions are filtered out by the Julia registry helper
-            language: Dependabot::Package::PackageLanguage.new(name: PACKAGE_LANGUAGE)
+            language: Dependabot::Package::PackageLanguage.new(name: PACKAGE_LANGUAGE),
+            details: release_date_pending ? { RELEASE_DATE_PENDING => true } : {}
           )
         end
 

data/lib/dependabot/julia/registry_client/result.rb

@@ -214,6 +214,7 @@ module Dependabot
           const :julia_version, String
           const :dependencies, T::Array[ProjectDependency]
           const :weak_dependencies, T::Array[ProjectDependency]
+          const :extra_dependencies, T::Array[ProjectDependency]
           const :project_path, String
 
           sig { params(value: Object).returns(T.any(Project, Failure)) }
@@ -230,6 +231,7 @@ module Dependabot
               julia_version: ValueParser.string(hash, "julia_version", context),
               dependencies: parse_dependencies(hash, "dependencies", context),
               weak_dependencies: parse_dependencies(hash, "weak_dependencies", context),
+              extra_dependencies: parse_dependencies(hash, "extra_dependencies", context),
               project_path: ValueParser.string(hash, "project_path", context)
             )
           end
@@ -336,6 +338,8 @@ module Dependabot
 
           const :project_files, T::Array[String]
           const :manifest_file, String
+          # Every manifest of the environment, including version-specific ones
+          const :manifest_files, T::Array[String], default: []
           const :workspace_root, String
 
           sig { params(value: Object).returns(T.any(WorkspaceFiles, Failure)) }
@@ -351,6 +355,7 @@ module Dependabot
                 "#{context} project_files"
               ),
               manifest_file: ValueParser.string(hash, "manifest_file", context),
+              manifest_files: ValueParser.optional_string_array(hash, "manifest_files", context),
               workspace_root: ValueParser.string(hash, "workspace_root", context)
             )
           end
@@ -429,6 +434,8 @@ module Dependabot
           extend T::Sig
 
           const :release_date, T.nilable(String)
+          # Registered in General after the last GeneralMetadata.jl build, so no date is published yet
+          const :pending, T::Boolean, default: false
 
           sig { params(value: Object, context: String).returns(T.any(ReleaseDate, Failure)) }
           def self.from_object(value, context:)
@@ -436,7 +443,10 @@ module Dependabot
             failure = Result.failure_from(hash, context)
             return failure if failure
 
-            new(release_date: ValueParser.nilable_string(hash, "release_date", context))
+            new(
+              release_date: ValueParser.nilable_string(hash, "release_date", context),
+              pending: ValueParser.optional_boolean(hash, "release_date_pending", context)
+            )
           end
 
           sig { params(value: Object, context: String).returns(T.any(ReleaseDate, Failure)) }

data/lib/dependabot/julia/registry_client.rb

@@ -178,15 +178,17 @@ module Dependabot
       sig do
         params(
           project_path: String,
-          updates: T::Hash[String, T::Hash[String, String]]
+          updates: T::Hash[String, T::Hash[String, String]],
+          manifest_path: T.nilable(String)
         ).returns(T.any(Result::ManifestUpdate, Result::Failure))
       end
-      def update_manifest(project_path:, updates:)
+      def update_manifest(project_path:, updates:, manifest_path: nil)
         Result::ManifestUpdate.from_object(
           call_julia_helper(
             function: "update_manifest",
             args: {
               project_path: project_path,
+              manifest_path: manifest_path,
               updates: updates
             }
           )

data/lib/dependabot/julia/requirement.rb

@@ -41,8 +41,11 @@ module Dependabot
         # intersection semantics for operator-style lists anyway because this
         # method also parses Dependabot ignore conditions (e.g. ">= 2.a, < 3"),
         # which are always intersections; treating those as unions would make
-        # every ignore condition match all versions.
+        # every ignore condition match all versions. A list of equalities only
+        # ("=0.5.4, =0.5.5") would admit nothing as an intersection, so it is
+        # read as the union Pkg takes.
         return false if constraints.length <= 1
+        return false if constraints.all? { |c| c.start_with?("=") }
 
         constraints.all? { |c| c.match?(/^[<>=]/) }
       end
@@ -65,6 +68,18 @@ module Dependabot
         requirements_array(requirement_string)
       end
 
+      # Whether a compat entry admits the version. Pkg compares a bound
+      # against major.minor.patch only, so a JLL rebuild ("0.0.43+1") is
+      # admitted by "=0.0.43" or "0.0.42 - 0.0.43" exactly as the version it
+      # rebuilds is, and a prerelease exactly as its release ("1" rejects
+      # "2.0.0-rc1"). Ignore conditions go through satisfied_by? instead and
+      # keep the ordering between builds ("> 1.6.10" ignores "1.6.10+1").
+      sig { params(version: T.any(Gem::Version, String)).returns(T::Boolean) }
+      def admits?(version)
+        release = Dependabot::Julia::Version.new(version.to_s).compat_version_string
+        T.cast(satisfied_by?(Dependabot::Julia::Version.new(release)), T::Boolean)
+      end
+
       sig { params(version: String).returns(String) }
       def self.normalize_version(version)
         # Remove 'v' prefix if present (common in Julia)

data/lib/dependabot/julia/update_checker/latest_version_finder.rb

@@ -55,6 +55,13 @@ module Dependabot
         @available_versions ||= T.let(fetch_available_versions, T.nilable(T::Array[Gem::Version]))
       end
 
+      # Lowest non-vulnerable version above the current one. Like
+      # Package::PackageLatestVersionFinder, security fixes skip the cooldown.
+      sig { returns(T.nilable(Gem::Version)) }
+      def lowest_security_fix_version
+        @lowest_security_fix_version ||= T.let(fetch_lowest_security_fix_version, T.nilable(Gem::Version))
+      end
+
       private
 
       sig { returns(Dependabot::Dependency) }
@@ -81,16 +88,29 @@ module Dependabot
       sig { returns(T::Array[T::Hash[Symbol, String]]) }
       attr_reader :custom_registries
 
-      sig { returns(T::Array[Gem::Version]) }
-      def fetch_available_versions
-        # Fetch all package releases using the PackageDetailsFetcher
-        package_fetcher = Julia::Package::PackageDetailsFetcher.new(
-          dependency: dependency,
-          credentials: credentials,
-          custom_registries: custom_registries
+      sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
+      def package_releases
+        @package_releases ||= T.let(
+          Julia::Package::PackageDetailsFetcher.new(
+            dependency: dependency,
+            credentials: credentials,
+            custom_registries: custom_registries
+          ).fetch_package_releases,
+          T.nilable(T::Array[Dependabot::Package::PackageRelease])
         )
+      end
 
-        releases = package_fetcher.fetch_package_releases
+      sig { returns(T.nilable(Gem::Version)) }
+      def fetch_lowest_security_fix_version
+        versions = filter_prerelease_versions(package_releases.map(&:version).sort)
+        versions = filter_ignored_versions(versions)
+        versions = filter_lower_versions(versions)
+        Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(versions, security_advisories).min
+      end
+
+      sig { returns(T::Array[Gem::Version]) }
+      def fetch_available_versions
+        releases = package_releases
         return [] if releases.empty?
 
         # Filter releases based on cooldown
@@ -110,8 +130,10 @@ module Dependabot
         versions = filter_ignored_versions(versions)
         return [] if versions.empty?
 
-        # Filter out lower versions
-        versions = filter_lower_versions(versions)
+        # Filter out lower versions, keeping the current release so that an
+        # up-to-date dependency reports it as the latest: the base class takes
+        # a nil latest_version as out of date and goes on to look for unlocks
+        versions = filter_lower_versions(versions, keep_current: true)
         return [] if versions.empty?
 
         # Filter out vulnerable versions
@@ -168,12 +190,12 @@ module Dependabot
         filtered
       end
 
-      sig { params(versions: T::Array[Gem::Version]).returns(T::Array[Gem::Version]) }
-      def filter_lower_versions(versions)
+      sig { params(versions: T::Array[Gem::Version], keep_current: T::Boolean).returns(T::Array[Gem::Version]) }
+      def filter_lower_versions(versions, keep_current: false)
         return versions unless dependency.version
 
         current_version = Dependabot::Julia::Version.new(dependency.version)
-        versions.select { |v| v > current_version }
+        versions.select { |v| v > current_version || (keep_current && v == current_version) }
       end
 
       sig { returns(T::Array[Dependabot::Requirement]) }
@@ -187,6 +209,8 @@ module Dependabot
       def cooldown_active_for_release?(release)
         cooldown_days = determine_cooldown_days(release.version)
         return false unless cooldown_days&.positive?
+        # A General release too new to have a published date is at most about a day old
+        return true if release.details[Julia::Package::PackageDetailsFetcher::RELEASE_DATE_PENDING]
         return false unless release.released_at
 
         # Check if enough time has passed since release
@@ -225,7 +249,10 @@ module Dependabot
         return nil unless cooldown_config
 
         current_version = dependency.version ? Dependabot::Julia::Version.new(dependency.version) : nil
-        return nil unless current_version
+        # Without a Manifest there is no version to measure a bump from; like
+        # CooldownCalculation.cooldown_days_for, fall back to default_days
+        # rather than skipping the cooldown
+        return cooldown_days_for_bump_type(:default) unless current_version
 
         version_bump_type = determine_version_bump_type(version, current_version)
         cooldown_days_for_bump_type(version_bump_type)

data/lib/dependabot/julia/update_checker/requirements_updater.rb

@@ -90,7 +90,7 @@ module Dependabot
       sig { params(requirement_string: String, versions: T::Array[Dependabot::Julia::Version]).returns(String) }
       def widened_stdlib_requirement(requirement_string, versions)
         reqs = Dependabot::Julia::Requirement.requirements_array(requirement_string)
-        missing = versions.reject { |version| reqs.any? { |req| req.satisfied_by?(version) } }
+        missing = versions.reject { |version| reqs.any? { |req| req.admits?(version) } }
 
         missing.reduce(requirement_string) do |entry, version|
           append_spec_string(entry, stdlib_version_spec(version))
@@ -106,7 +106,7 @@ module Dependabot
         minor = (version.segments[1] || 0).to_i
         patch = (version.segments[2] || 0).to_i
 
-        return "< 0.0.1" if major.zero? && minor.zero? && patch.zero?
+        return "<0.0.1" if major.zero? && minor.zero? && patch.zero?
         return major.to_s if major.positive? && minor.zero?
 
         simplified_version_spec(version)
@@ -121,9 +121,11 @@ module Dependabot
       def update_requirement(requirement, target_version)
         current_requirement = requirement.requirement_string
 
-        # If requirement is nil (no compat entry), use target version
+        # If requirement is nil (no compat entry), use target version. A JLL's
+        # "1.6.10+0" has to be written as "1.6.10": Pkg rejects the build
+        # number in a compat entry, and the bound admits every build anyway.
         new_requirement = if current_requirement.nil?
-                            target_version.to_s
+                            target_version.compat_version_string
                           else
                             updated_version_requirement(current_requirement, target_version)
                           end
@@ -141,7 +143,7 @@ module Dependabot
 
         # Check if any requirement is satisfied by the target version
         # Note: This uses the implicit caret semantics from the Requirement class
-        satisfied = reqs.any? { |req| req.satisfied_by?(target_version) }
+        satisfied = reqs.any? { |req| req.admits?(target_version) }
 
         case update_strategy
         when :bump_versions
@@ -163,11 +165,26 @@ module Dependabot
 
       sig { params(requirement_string: String, new_spec: String).returns(String) }
       def append_spec_string(requirement_string, new_spec)
-        # Append the new spec to the existing requirement (CompatHelper KeepEntry behavior)
+        # Add the new spec to the existing requirement (CompatHelper KeepEntry behavior)
         # Detect whether the existing requirement uses spaces after commas and preserve that format
         # and default to ", " if no commas found
         separator = requirement_string.include?(",") && !requirement_string.include?(", ") ? "," : ", "
-        "#{requirement_string}#{separator}#{new_spec}"
+        # Keep the entry in ascending order ("<0.0.1, 1", not "1, <0.0.1"):
+        # the new spec goes before the first one that starts above it
+        specs = requirement_string.split(",").map(&:strip)
+        index = specs.index { |spec| spec_lower_bound(spec) > spec_lower_bound(new_spec) }
+        return "#{requirement_string}#{separator}#{new_spec}" unless index
+
+        specs.insert(index, new_spec).join(separator)
+      end
+
+      # The lowest version a single spec in an entry admits, for ordering; an
+      # upper bound alone ("<0.0.1") starts at zero
+      sig { params(spec: String).returns(Dependabot::Julia::Version) }
+      def spec_lower_bound(spec)
+        return Dependabot::Julia::Version.new("0") if spec.start_with?("<", "≤")
+
+        Dependabot::Julia::Version.new(spec[/\d+(?:\.\d+)*/] || "0")
       end
 
       sig { params(target_version: Dependabot::Julia::Version).returns(String) }

data/lib/dependabot/julia/update_checker.rb

@@ -79,6 +79,19 @@ module Dependabot
         @latest_resolvable_version ||= T.let(latest_version, T.nilable(Gem::Version))
       end
 
+      sig { override.returns(T.nilable(Gem::Version)) }
+      def lowest_security_fix_version
+        return nil if stdlib?
+
+        latest_version_finder.lowest_security_fix_version
+      end
+
+      sig { override.returns(T.nilable(Gem::Version)) }
+      def lowest_resolvable_security_fix_version
+        # Resolvability is not checked, as for latest_resolvable_version
+        lowest_security_fix_version
+      end
+
       sig { override.returns(T.nilable(T.any(Dependabot::Version, String))) }
       def latest_resolvable_version_with_no_unlock
         return nil if stdlib?
@@ -96,7 +109,7 @@ module Dependabot
                  candidates.max
                else
                  reqs = requirement_class.requirements_array(current_requirement)
-                 candidates.select { |version| reqs.any? { |req| req.satisfied_by?(version) } }.max
+                 candidates.select { |version| reqs.any? { |req| req.admits?(version) } }.max
                end
         return nil unless best
 
@@ -107,7 +120,7 @@ module Dependabot
       def updated_requirements
         Dependabot::Julia::RequirementsUpdater.new(
           requirements: dependency.requirements,
-          target_version: latest_resolvable_version&.to_s,
+          target_version: preferred_resolvable_version&.to_s,
           update_strategy: requirements_update_strategy&.to_s&.to_sym,
           stdlib_versions: stdlib_versions
         ).updated_requirements
@@ -115,6 +128,12 @@ module Dependabot
 
       private
 
+      sig { override.returns(T::Boolean) }
+      def latest_version_resolvable_with_full_unlock?
+        # Full unlock checks aren't implemented for Julia (yet)
+        false
+      end
+
       # Versions a stdlib's compat entry has to admit, by project file; set by
       # the file parser for packages that ship with any Julia release the
       # project supports

data/lib/dependabot/julia/version.rb

@@ -59,6 +59,14 @@ module Dependabot
         @version_string
       end
 
+      # The "major.minor.patch" part, which is all a [compat] entry can carry:
+      # Pkg rejects "1.6.10+0" or "1.6.10-rc1" as a specifier, and its bounds
+      # compare major, minor and patch only, so "1.6.10" admits both.
+      sig { returns(String) }
+      def compat_version_string
+        T.must(@version_string[/\A\d+(?:\.\d+){0,2}/])
+      end
+
       sig { override.returns(String) }
       def to_semver
         @version_string

data/lib/dependabot/julia.rb

@@ -69,5 +69,12 @@ Dependabot::PullRequestCreator::Labeler
   .register_label_details("julia", name: "julia", colour: "a270ba")
 
 require "dependabot/dependency"
-Dependabot::Dependency
-  .register_production_check("julia", ->(_) { true })
+# [extras] hold test-only packages; weakdeps are loaded on demand by
+# extensions and count as runtime, like [deps]
+Dependabot::Dependency.register_production_check(
+  "julia",
+  lambda do |groups|
+    groups = T.cast(groups, T::Array[String])
+    groups.empty? || groups.any? { |group| group != "extras" }
+  end
+)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-julia
 version: !ruby/object:Gem::Version
-  version: 0.398.0
+  version: 0.399.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.398.0
+        version: 0.399.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.398.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
 rdoc_options: []
 require_paths:
 - lib