dependabot-julia 0.399.0 → 0.401.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c3e654c12908a919461515b6c592e15e2382f106f203b0def25ed45bc68205b
-  data.tar.gz: b9c55d333c085e4cd51fd74d88e33fd98c8d379ea41be890fcf83c561f4c06ba
+  metadata.gz: 398595cb4fa23d10fc7222d9efabbe19233383ad331a3db60cdf9d7d4305db42
+  data.tar.gz: 9017711a76c26f29f4d783028772647ad3977291ce08d63e73cb47889dfba4ce
 SHA512:
-  metadata.gz: 3a1cdb18bb53b82740729fd4ce2c8276457dd0ac796f38263844fc5ec6e20a36c84d9d2882f04d0834d006080136b5f5b457eed630ad9434625912a174362baf
-  data.tar.gz: a74b876e844080eb47dad827cef47cef9c861e999e8afcc013da8d12206a6a8e2131fc5810af4e82260f38c179b053d3dae0b64c2badb8bfb3ba3af3c9950f19
+  metadata.gz: c0bdb2c5caeb3e37db65702f1eaa3713b16687772fef049aea556d60c33946bd445aca6eb1ba6aaa8c55bfc814172d6dbf9107a27ed9db063c151ddab4737870
+  data.tar.gz: 0b409f8b384e0690a26fb697750e30551d7f4e8fb07f246f276d068dfa2225d9027d99bd088fb1fa0fc8d3e577ec2d977c5ea0b737b1cbb531237df49b7e2f1d

data/lib/dependabot/julia/file_updater.rb

@@ -19,6 +19,12 @@ module Dependabot
       # comment ("[compat]  # pins")
       COMPAT_HEADER_PATTERN = /^\s*\[compat\]\s*(?:#.*)?$/
 
+      # A compat entry part that admits only 0.0.0 ("<0.0.1", "< 0.0.1")
+      ZERO_VERSION_BOUND_PATTERN = /\A<\s*0\.0\.1\z/
+
+      STDLIB_COMPAT_PSA_URL =
+        "https://discourse.julialang.org/t/psa-compat-requirements-in-the-general-registry-are-changing/104958"
+
       sig { returns(T::Array[Regexp]) }
       def self.updated_files_regex
         [/(?:Julia)?Project\.toml$/i, /(?:Julia)?Manifest(?:-v[\d.]+)?\.toml$/i]
@@ -48,7 +54,9 @@ module Dependabot
 
         # Use DependabotHelper.jl for manifest updating
         # This works for both standard packages and workspace packages
-        updated_files_with_julia_helper
+        updated_files = updated_files_with_julia_helper
+        add_zero_version_bound_notice
+        updated_files
       end
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -216,6 +224,40 @@ module Dependabot
 
       private
 
+      # A "<0.0.1" bound on a stdlib looks like a bug unless explained.
+      # The text names no packages, so a PR across several directories shows it only once.
+      sig { void }
+      def add_zero_version_bound_notice
+        bound_added = dependencies.any? do |dependency|
+          dependency.metadata.key?(:julia_stdlib_versions) &&
+            !zero_version_bound?(dependency.previous_requirements) &&
+            zero_version_bound?(dependency.requirements)
+        end
+        return unless bound_added
+
+        @notices << Dependabot::Notice.new(
+          mode: Dependabot::Notice::NoticeMode::INFO,
+          type: "julia_stdlib_zero_version_bound",
+          package_manager_name: "Pkg",
+          title: "Why stdlib compat entries include `<0.0.1`",
+          description: "This update adds `<0.0.1` to standard library compat entries. Before Julia 1.10, " \
+                       "`Pkg.test()` gave standard libraries version 0.0.0, so while the `julia` compat entry " \
+                       "admits those releases, a stdlib compat entry needs `<0.0.1` for tests to resolve. " \
+                       "Raising the `julia` compat entry to `1.10` or later removes the need for it. " \
+                       "See the [stdlib compat PSA](#{STDLIB_COMPAT_PSA_URL}).",
+          show_in_pr: true,
+          show_alert: false
+        )
+      end
+
+      sig { params(requirements: T.nilable(T::Array[T::Hash[Symbol, T.untyped]])).returns(T::Boolean) }
+      def zero_version_bound?(requirements)
+        (requirements || []).any? do |req|
+          requirement = T.cast(req[:requirement], T.nilable(String)).to_s
+          requirement.split(",").any? { |part| part.strip.match?(ZERO_VERSION_BOUND_PATTERN) }
+        end
+      end
+
       sig { returns(T::Hash[String, T::Hash[String, String]]) }
       def build_updates_hash
         @build_updates_hash ||= T.let(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-julia
 version: !ruby/object:Gem::Version
-  version: 0.399.0
+  version: 0.401.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.399.0
+        version: 0.401.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.399.0
+        version: 0.401.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -262,7 +262,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.399.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
 rdoc_options: []
 require_paths:
 - lib