dependabot-julia 0.399.0 → 0.400.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c3e654c12908a919461515b6c592e15e2382f106f203b0def25ed45bc68205b
-  data.tar.gz: b9c55d333c085e4cd51fd74d88e33fd98c8d379ea41be890fcf83c561f4c06ba
+  metadata.gz: 22c71ce1df7cae71a73e4cf03663b35be32f1026a1f84f4615450ba449062261
+  data.tar.gz: 408a55df020bd8588d50a2cc0db837e524bf2a3dc3d59588ec3bf20aed071d5b
 SHA512:
-  metadata.gz: 3a1cdb18bb53b82740729fd4ce2c8276457dd0ac796f38263844fc5ec6e20a36c84d9d2882f04d0834d006080136b5f5b457eed630ad9434625912a174362baf
-  data.tar.gz: a74b876e844080eb47dad827cef47cef9c861e999e8afcc013da8d12206a6a8e2131fc5810af4e82260f38c179b053d3dae0b64c2badb8bfb3ba3af3c9950f19
+  metadata.gz: f714959e016ac030a54c39aa8d59e3302ad06419dc812e466a755a746f68e0f25a42e2762da0f8d92889b082c098bfff9946284e6584801561fc2eb56437ae4d
+  data.tar.gz: f5175b774a60457d5e84d8f68aefb54a985bc05f6a6859f1d9ded13aae32109442d72ae3f27998916062e96fc4bafd87d1d78b0735ad2e8c3129ce72dd4d651f

data/lib/dependabot/julia/file_updater.rb

@@ -19,6 +19,12 @@ module Dependabot
       # comment ("[compat]  # pins")
       COMPAT_HEADER_PATTERN = /^\s*\[compat\]\s*(?:#.*)?$/
 
+      # A compat entry part that admits only 0.0.0 ("<0.0.1", "< 0.0.1")
+      ZERO_VERSION_BOUND_PATTERN = /\A<\s*0\.0\.1\z/
+
+      STDLIB_COMPAT_PSA_URL =
+        "https://discourse.julialang.org/t/psa-compat-requirements-in-the-general-registry-are-changing/104958"
+
       sig { returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [/(?:Julia)?Project\.toml$/i, /(?:Julia)?Manifest(?:-v[\d.]+)?\.toml$/i]
@@ -48,7 +54,9 @@ module Dependabot
 
         # Use DependabotHelper.jl for manifest updating
         # This works for both standard packages and workspace packages
-        updated_files_with_julia_helper
+        updated_files = updated_files_with_julia_helper
+        add_zero_version_bound_notice
+        updated_files
       end
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -216,6 +224,41 @@ module Dependabot
 
       private
 
+      # A "<0.0.1" bound on a stdlib looks like a bug unless explained
+      sig { void }
+      def add_zero_version_bound_notice
+        names = dependencies.filter_map do |dependency|
+          next unless dependency.metadata.key?(:julia_stdlib_versions)
+          next if zero_version_bound?(dependency.previous_requirements)
+          next unless zero_version_bound?(dependency.requirements)
+
+          "`#{dependency.name}`"
+        end
+        return if names.empty?
+
+        subject = names.one? ? "#{names.first} is a standard library" : "#{names.join(', ')} are standard libraries"
+        @notices << Dependabot::Notice.new(
+          mode: Dependabot::Notice::NoticeMode::INFO,
+          type: "julia_stdlib_zero_version_bound",
+          package_manager_name: "Pkg",
+          title: "Why stdlib compat entries include `<0.0.1`",
+          description: "#{subject}. Before Julia 1.10, `Pkg.test()` gave standard libraries version 0.0.0, " \
+                       "so while the `julia` compat entry admits those releases, a stdlib compat entry needs " \
+                       "`<0.0.1` for tests to resolve. Raising the `julia` compat entry to `1.10` or later " \
+                       "removes the need for it. See the [stdlib compat PSA](#{STDLIB_COMPAT_PSA_URL}).",
+          show_in_pr: true,
+          show_alert: false
+        )
+      end
+
+      sig { params(requirements: T.nilable(T::Array[T::Hash[Symbol, T.untyped]])).returns(T::Boolean) }
+      def zero_version_bound?(requirements)
+        (requirements || []).any? do |req|
+          requirement = T.cast(req[:requirement], T.nilable(String)).to_s
+          requirement.split(",").any? { |part| part.strip.match?(ZERO_VERSION_BOUND_PATTERN) }
+        end
+      end
+
       sig { returns(T::Hash[String, T::Hash[String, String]]) }
       def build_updates_hash
         @build_updates_hash ||= T.let(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-julia
 version: !ruby/object:Gem::Version
-  version: 0.399.0
+  version: 0.400.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.399.0
+        version: 0.400.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.399.0
+        version: 0.400.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
 rdoc_options: []
 require_paths:
 - lib