dependabot-nix 0.383.0 → 0.384.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9400dda6e00c6bfbbf31f20efd478924245fb89da9d1f0dd0d9f5e8256783bba
-  data.tar.gz: dedd3122805ca51fa7c18bb859383d6ba236c54a8c2e9e42ee20d14eeac02e37
+  metadata.gz: cc6760fd535e74086902529169aa58860943e51c3b7210d0a2608b12b5cfdf47
+  data.tar.gz: 239b9f0415ca75a7451d184baaa88a50c3e95af54c9a7351f0b08bceb2a6694b
 SHA512:
-  metadata.gz: d7db92f0a7b58867248fdb971d96a3c3353a9d613ec05ae1635ac982459ad41662aab7c1ef54e80219886a51eee7b529ebd909c9790c877d496f7f7451d6a535
-  data.tar.gz: c42a5326b2cfa670d36e5865d5d4c2e40426e7f23665f6c65ed8ae49367672ea13bbd875e5866fd44473e329d7d9f3fc310816f089d5140bac94361e8884b58b
+  metadata.gz: 47dd160601292ee0357e80c8011e67c18b5cb42afc361d3df5d0b1e59f444a2c2ae0a53a9e1f18c7471d35d77267e79f80ebc8f40ba9e27fc473acec88f67f98
+  data.tar.gz: 020f4cfed1fc8b9ada9e1cf97c806614e07ea27dc8b322614928e403709140d61ffb34d9565bdc34e84ef7b3a91c7a2d42957bd46cb6b4a13aee1cc0d8eb5017

data/lib/dependabot/nix/channel.rb

@@ -0,0 +1,55 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/nix/versioned_name"
+
+module Dependabot
+  module Nix
+    # A NixOS channel: a VersionedName plus helpers for channel tarball URLs
+    # (channels.nixos.org/<channel>/nixexprs.tar.xz).
+    class Channel < VersionedName
+      extend T::Sig
+
+      CHANNEL_HOST = "channels.nixos.org"
+      DEFAULT_EXTENSION = "xz"
+
+      # e.g. https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz
+      # The suffix is captured so a bump keeps the flake's existing format.
+      CHANNEL_URL_PATTERN = %r{
+        \Ahttps?://channels\.nixos\.org/
+        (?<channel>[a-zA-Z0-9][a-zA-Z0-9._-]*)
+        /nixexprs\.tar\.(?<extension>xz|gz|bz2)\z
+      }x
+
+      sig { params(url: T.nilable(String)).returns(T::Boolean) }
+      def self.channel_url?(url)
+        return false unless url
+
+        CHANNEL_URL_PATTERN.match?(url)
+      end
+
+      sig { params(url: T.nilable(String)).returns(T.nilable(String)) }
+      def self.channel_name_from_url(url)
+        return unless url
+
+        CHANNEL_URL_PATTERN.match(url)&.[](:channel)
+      end
+
+      # The compression suffix (xz, gz, bz2) of a channel tarball URL.
+      sig { params(url: T.nilable(String)).returns(T.nilable(String)) }
+      def self.extension_from_url(url)
+        return unless url
+
+        CHANNEL_URL_PATTERN.match(url)&.[](:extension)
+      end
+
+      # Preserves the flake's suffix so a bump keeps its compression format.
+      sig { params(channel_name: String, extension: String).returns(String) }
+      def self.url_for(channel_name, extension: DEFAULT_EXTENSION)
+        "https://#{CHANNEL_HOST}/#{channel_name}/nixexprs.tar.#{extension}"
+      end
+    end
+  end
+end

data/lib/dependabot/nix/file_parser.rb

@@ -8,6 +8,7 @@ require "dependabot/dependency"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
+require "dependabot/nix/channel"
 require "dependabot/nix/package_manager"
 
 module Dependabot
@@ -15,8 +16,8 @@ module Dependabot
     class FileParser < Dependabot::FileParsers::Base
       extend T::Sig
 
-      # Source types that are backed by git and can be updated via revision tracking
-      SUPPORTED_SOURCE_TYPES = T.let(%w(github gitlab sourcehut git).freeze, T::Array[String])
+      # Updatable source types: git-backed sources plus NixOS channel tarballs.
+      SUPPORTED_SOURCE_TYPES = T.let(%w(github gitlab sourcehut git tarball).freeze, T::Array[String])
 
       SUPPORTED_LOCK_VERSION = 7
 
@@ -134,9 +135,28 @@ module Dependabot
         source_type = locked.fetch("type", nil)
         return unless SUPPORTED_SOURCE_TYPES.include?(source_type)
 
+        # Skip inputs pinned to a bare commit SHA: no branch or tag to track.
+        return if revision_pinned?(original)
+
         rev = locked.fetch("rev", nil)
         return unless rev
 
+        if source_type == "tarball"
+          build_tarball_dependency(input_name, original, rev)
+        else
+          build_git_dependency(input_name, locked, original, rev)
+        end
+      end
+
+      sig do
+        params(
+          input_name: String,
+          locked: T::Hash[String, T.untyped],
+          original: T::Hash[String, T.untyped],
+          rev: String
+        ).returns(T.nilable(Dependabot::Dependency))
+      end
+      def build_git_dependency(input_name, locked, original, rev)
         url = build_url(locked)
         return unless url
 
@@ -155,6 +175,38 @@ module Dependabot
         )
       end
 
+      sig { params(original: T::Hash[String, T.untyped]).returns(T::Boolean) }
+      def revision_pinned?(original)
+        !original.fetch("rev", nil).nil?
+      end
+
+      # Channel tarballs track a channel in the URL (e.g. nixos-26.05), not a git
+      # ref. Non-channel tarballs aren't updatable, so they're skipped.
+      sig do
+        params(
+          input_name: String,
+          original: T::Hash[String, T.untyped],
+          rev: String
+        ).returns(T.nilable(Dependabot::Dependency))
+      end
+      def build_tarball_dependency(input_name, original, rev)
+        url = original.fetch("url", nil)
+        channel = Channel.channel_name_from_url(url)
+        return unless channel
+
+        Dependency.new(
+          name: input_name,
+          version: rev,
+          package_manager: "nix",
+          requirements: [{
+            requirement: nil,
+            file: "flake.lock",
+            source: { type: "tarball", url: url, branch: nil, ref: channel },
+            groups: []
+          }]
+        )
+      end
+
       sig { params(locked: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
       def build_url(locked)
         case locked["type"]

data/lib/dependabot/nix/flake_nix_parser.rb

@@ -3,6 +3,8 @@
 
 require "sorbet-runtime"
 
+require "dependabot/nix/channel"
+
 module Dependabot
   module Nix
     # Parses flake.nix content to locate input URL declarations and extract
@@ -62,35 +64,9 @@ module Dependabot
 
         url_str = match[:url]
 
-        # Try shorthand scheme first (github:, gitlab:, sourcehut:)
-        url_match = FLAKE_URL_PATTERN.match(url_str)
-        if url_match
-          return InputUrl.new(
-            full_url: url_str,
-            scheme: T.must(url_match[:scheme]),
-            owner: T.must(url_match[:owner]),
-            repo: T.must(url_match[:repo]),
-            ref: url_match[:ref],
-            query: url_match[:query],
-            match_start: match[:url_start],
-            match_end: match[:url_end]
-          )
-        end
-
-        # Try indirect/registry shorthand (e.g. nixpkgs/nixos-24.11)
-        indirect_match = INDIRECT_URL_PATTERN.match(url_str)
-        return unless indirect_match
-
-        InputUrl.new(
-          full_url: url_str,
-          scheme: "indirect",
-          owner: T.must(indirect_match[:id]),
-          repo: "",
-          ref: indirect_match[:ref],
-          query: nil,
-          match_start: match[:url_start],
-          match_end: match[:url_end]
-        )
+        build_shorthand_input(url_str, match) ||
+          build_tarball_input(url_str, match) ||
+          build_indirect_input(url_str, match)
       end
 
       sig { params(new_ref: String).returns(T.nilable(String)) }
@@ -117,6 +93,60 @@ module Dependabot
       sig { returns(String) }
       attr_reader :input_name
 
+      # Shorthand scheme URLs: github:, gitlab:, sourcehut:
+      sig { params(url_str: String, match: T::Hash[Symbol, T.untyped]).returns(T.nilable(InputUrl)) }
+      def build_shorthand_input(url_str, match)
+        url_match = FLAKE_URL_PATTERN.match(url_str)
+        return unless url_match
+
+        InputUrl.new(
+          full_url: url_str,
+          scheme: T.must(url_match[:scheme]),
+          owner: T.must(url_match[:owner]),
+          repo: T.must(url_match[:repo]),
+          ref: url_match[:ref],
+          query: url_match[:query],
+          match_start: match[:url_start],
+          match_end: match[:url_end]
+        )
+      end
+
+      # NixOS channel tarball URL, e.g. channels.nixos.org/nixos-26.05/nixexprs.tar.xz
+      sig { params(url_str: String, match: T::Hash[Symbol, T.untyped]).returns(T.nilable(InputUrl)) }
+      def build_tarball_input(url_str, match)
+        channel = Channel.channel_name_from_url(url_str)
+        return unless channel
+
+        InputUrl.new(
+          full_url: url_str,
+          scheme: "tarball",
+          owner: "",
+          repo: "",
+          ref: channel,
+          query: nil,
+          match_start: match[:url_start],
+          match_end: match[:url_end]
+        )
+      end
+
+      # Indirect/registry shorthand (e.g. nixpkgs/nixos-24.11)
+      sig { params(url_str: String, match: T::Hash[Symbol, T.untyped]).returns(T.nilable(InputUrl)) }
+      def build_indirect_input(url_str, match)
+        indirect_match = INDIRECT_URL_PATTERN.match(url_str)
+        return unless indirect_match
+
+        InputUrl.new(
+          full_url: url_str,
+          scheme: "indirect",
+          owner: T.must(indirect_match[:id]),
+          repo: "",
+          ref: indirect_match[:ref],
+          query: nil,
+          match_start: match[:url_start],
+          match_end: match[:url_end]
+        )
+      end
+
       # Returns a hash with :url, :url_start, :url_end if found, or nil.
       sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def find_url_match
@@ -180,8 +210,12 @@ module Dependabot
 
       sig { params(input_url: InputUrl, new_ref: String).returns(String) }
       def build_updated_url(input_url, new_ref)
-        if input_url.scheme == "indirect"
+        case input_url.scheme
+        when "indirect"
           "#{input_url.owner}/#{new_ref}"
+        when "tarball"
+          old_channel = T.must(input_url.ref)
+          input_url.full_url.sub("/#{old_channel}/", "/#{new_ref}/")
         else
           base = "#{input_url.scheme}:#{input_url.owner}/#{input_url.repo}/#{new_ref}"
           input_url.query ? "#{base}?#{input_url.query}" : base

data/lib/dependabot/nix/ignore_filter.rb

@@ -0,0 +1,44 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/nix/requirement"
+
+module Dependabot
+  module Nix
+    # Tests YY.MM version strings against Dependabot ignore conditions.
+    class IgnoreFilter
+      extend T::Sig
+
+      sig { params(ignored_versions: T::Array[String]).void }
+      def initialize(ignored_versions)
+        @ignored_versions = ignored_versions
+        @requirements = T.let(nil, T.nilable(T::Array[Gem::Requirement]))
+      end
+
+      sig { params(version_str: T.nilable(String)).returns(T::Boolean) }
+      def ignored?(version_str)
+        return false unless version_str
+        return false if requirements.empty?
+
+        gem_version = Gem::Version.new(version_str)
+        requirements.any? { |req| req.satisfied_by?(gem_version) }
+      end
+
+      private
+
+      sig { returns(T::Array[String]) }
+      attr_reader :ignored_versions
+
+      sig { returns(T::Array[Gem::Requirement]) }
+      def requirements
+        @requirements ||= ignored_versions.flat_map do |req|
+          Dependabot::Nix::Requirement.requirements_array(req)
+        rescue Gem::Requirement::BadRequirementError
+          []
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/nix/metadata_finder.rb

@@ -5,18 +5,24 @@ require "sorbet-runtime"
 
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
+require "dependabot/nix/channel"
 
 module Dependabot
   module Nix
     class MetadataFinder < Dependabot::MetadataFinders::Base
       extend T::Sig
 
+      # Channel tarballs resolve to nixpkgs revisions, so metadata points there.
+      NIXPKGS_SOURCE_URL = "https://github.com/NixOS/nixpkgs"
+
       private
 
       sig { override.returns(T.nilable(Dependabot::Source)) }
       def look_up_source
-        url = dependency.requirements.first&.fetch(:source)&.fetch(:url) ||
-              dependency.requirements.first&.fetch(:source)&.fetch("url")
+        source = dependency.requirements.first&.fetch(:source, nil)
+        url = source && (source[:url] || source["url"])
+
+        return Source.from_url(NIXPKGS_SOURCE_URL) if Channel.channel_url?(url)
 
         Source.from_url(url)
       end

data/lib/dependabot/nix/update_checker/channel_version_finder.rb

@@ -0,0 +1,126 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/nix/update_checker"
+require "dependabot/nix/channel"
+require "dependabot/nix/ignore_filter"
+require "dependabot/registry_client"
+
+module Dependabot
+  module Nix
+    class UpdateChecker
+      # Finds the latest NixOS channel and its revision: channels come from the
+      # channels.nixos.org S3 listing, revisions from each channel's git-revision marker.
+      class ChannelVersionFinder
+        extend T::Sig
+
+        CHANNELS_BASE_URL = "https://channels.nixos.org"
+        CHANNEL_KEY_PATTERN = %r{<Key>([^<]+)</Key>}
+        SHA_PATTERN = /\A[0-9a-f]{40}\z/
+
+        sig do
+          params(
+            current_channel: String,
+            credentials: T::Array[Dependabot::Credential],
+            ignored_versions: T::Array[String],
+            extension: String
+          ).void
+        end
+        def initialize(current_channel:, credentials:, ignored_versions: [], extension: Channel::DEFAULT_EXTENSION)
+          @current_channel = T.let(Channel.new(current_channel), Channel)
+          @credentials = credentials
+          @ignored_versions = ignored_versions
+          @extension = extension
+          @available_channels = T.let(nil, T.nilable(T::Array[String]))
+          @ignore_filter = T.let(nil, T.nilable(IgnoreFilter))
+        end
+
+        # Newest same-family channel with its revision, or nil (rolling channel,
+        # already latest, or revision unresolvable).
+        sig { returns(T.nilable(T::Hash[Symbol, String])) }
+        def latest_channel
+          return unless current_channel.versioned?
+
+          candidate = newest_candidate
+          return unless candidate
+
+          rev = resolve_revision(candidate.name)
+          return unless rev
+
+          { channel: candidate.name, url: Channel.url_for(candidate.name, extension: extension), commit_sha: rev }
+        end
+
+        # Current channel's revision (refresh path).
+        sig { returns(T.nilable(String)) }
+        def current_channel_revision
+          resolve_revision(current_channel.name)
+        end
+
+        private
+
+        sig { returns(Channel) }
+        attr_reader :current_channel
+
+        sig { returns(T::Array[Dependabot::Credential]) }
+        attr_reader :credentials
+
+        sig { returns(T::Array[String]) }
+        attr_reader :ignored_versions
+
+        sig { returns(String) }
+        attr_reader :extension
+
+        sig { returns(T.nilable(Channel)) }
+        def newest_candidate
+          candidates = available_channels
+                       .map { |name| Channel.new(name) }
+                       .select { |channel| channel.same_family?(current_channel) }
+                       .select { |channel| channel.newer_than?(current_channel) }
+                       .reject { |channel| ignore_filter.ignored?(channel.version_string) }
+
+          candidates.max_by { |channel| T.must(channel.version) }
+        end
+
+        sig { returns(T::Array[String]) }
+        def available_channels
+          @available_channels ||= fetch_available_channels
+        end
+
+        sig { returns(T::Array[String]) }
+        def fetch_available_channels
+          prefix = current_channel.prefix
+          return [] unless prefix
+
+          url = "#{CHANNELS_BASE_URL}/?delimiter=/&list-type=2&prefix=#{prefix}"
+          response = Dependabot::RegistryClient.get(url: url)
+          return [] unless response.status == 200
+
+          response.body.to_s.scan(CHANNEL_KEY_PATTERN).flatten
+        rescue StandardError => e
+          Dependabot.logger.info("Failed to list NixOS channels: #{e.class}: #{e.message}")
+          []
+        end
+
+        sig { params(channel: String).returns(T.nilable(String)) }
+        def resolve_revision(channel)
+          url = "#{CHANNELS_BASE_URL}/#{channel}/git-revision"
+          response = Dependabot::RegistryClient.get(url: url)
+          return unless response.status == 200
+
+          rev = response.body.to_s.strip
+          rev if rev.match?(SHA_PATTERN)
+        rescue StandardError => e
+          Dependabot.logger.info("Failed to resolve revision for #{channel}: #{e.class}: #{e.message}")
+          nil
+        end
+
+        sig { returns(IgnoreFilter) }
+        def ignore_filter
+          @ignore_filter ||= IgnoreFilter.new(ignored_versions)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/nix/update_checker/versioned_branch_finder.rb

@@ -4,7 +4,8 @@
 require "sorbet-runtime"
 
 require "dependabot/nix/update_checker"
-require "dependabot/nix/requirement"
+require "dependabot/nix/versioned_name"
+require "dependabot/nix/ignore_filter"
 require "dependabot/git_metadata_fetcher"
 require "dependabot/git_ref"
 
@@ -16,14 +17,6 @@ module Dependabot
       class VersionedBranchFinder
         extend T::Sig
 
-        # Matches branch names with a YY.MM version segment and optional suffix.
-        # Captures: prefix (including separator), version, and optional suffix.
-        # Examples: "nixos-24.11" => prefix="nixos-", version="24.11", suffix=nil
-        #           "nixos-24.11-small" => prefix="nixos-", version="24.11", suffix="-small"
-        #           "release-24.11-aarch64" => prefix="release-", version="24.11", suffix="-aarch64"
-        VERSIONED_BRANCH_PATTERN = /\A(.+[.\-_])(\d{2}\.\d{2})(-[a-zA-Z0-9]+)?\z/
-        private_constant :VERSIONED_BRANCH_PATTERN
-
         sig do
           params(
             current_ref: String,
@@ -42,22 +35,16 @@ module Dependabot
         # Returns true if the current ref looks like a versioned branch.
         sig { returns(T::Boolean) }
         def versioned_branch?
-          !branch_version_match.nil?
+          current_name.versioned?
         end
 
         # Returns the latest versioned branch info or nil if no newer branch exists.
         # Returns { branch: "nixos-25.05", commit_sha: "abc123" } or nil.
         sig { returns(T.nilable(T::Hash[Symbol, String])) }
         def latest_versioned_branch
-          match = branch_version_match
-          return unless match
-
-          prefix = match[1]
-          current_version = parse_version(T.must(match[2]))
-          return unless current_version
+          return unless current_name.versioned?
 
-          suffix = match[3] # nil if no suffix, e.g. "-small" if present
-          find_latest_branch(T.must(prefix), current_version, suffix)
+          find_latest_branch
         end
 
         private
@@ -74,25 +61,14 @@ module Dependabot
         sig { returns(T::Array[String]) }
         attr_reader :ignored_versions
 
-        sig { returns(T.nilable(MatchData)) }
-        def branch_version_match
-          @branch_version_match ||= T.let(
-            VERSIONED_BRANCH_PATTERN.match(current_ref),
-            T.nilable(MatchData)
-          )
+        sig { returns(VersionedName) }
+        def current_name
+          @current_name ||= T.let(VersionedName.new(current_ref), T.nilable(VersionedName))
         end
 
-        sig do
-          params(
-            prefix: String,
-            current_version: T::Array[Integer],
-            suffix: T.nilable(String)
-          ).returns(T.nilable(T::Hash[Symbol, String]))
-        end
-        def find_latest_branch(prefix, current_version, suffix)
-          candidates = remote_branches.filter_map do |ref|
-            build_candidate(ref, prefix, current_version, suffix)
-          end
+        sig { returns(T.nilable(T::Hash[Symbol, String])) }
+        def find_latest_branch
+          candidates = remote_branches.filter_map { |ref| build_candidate(ref) }
 
           latest = candidates.max_by { |c| c[:version] }
           return unless latest
@@ -100,62 +76,19 @@ module Dependabot
           { branch: latest[:branch].to_s, commit_sha: latest[:commit_sha].to_s }
         end
 
-        sig do
-          params(
-            ref: Dependabot::GitRef,
-            prefix: String,
-            current_version: T::Array[Integer],
-            suffix: T.nilable(String)
-          ).returns(T.nilable(T::Hash[Symbol, T.untyped]))
-        end
-        def build_candidate(ref, prefix, current_version, suffix)
-          branch_match = VERSIONED_BRANCH_PATTERN.match(ref.name)
-          return unless branch_match
-          return unless branch_match[1] == prefix
-          return unless branch_match[3] == suffix
-
-          version_str = T.must(branch_match[2])
-          version = parse_version(version_str)
-          return unless version
-          return unless (version <=> current_version) == 1
-          return if version_ignored?(version_str)
-
-          { branch: ref.name, commit_sha: ref.commit_sha, version: version }
-        end
-
-        sig { params(version_str: String).returns(T::Boolean) }
-        def version_ignored?(version_str)
-          return false if ignore_requirements.empty?
+        sig { params(ref: Dependabot::GitRef).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def build_candidate(ref)
+          candidate = VersionedName.new(ref.name)
+          return unless candidate.same_family?(current_name)
+          return unless candidate.newer_than?(current_name)
+          return if ignore_filter.ignored?(candidate.version_string)
 
-          gem_version = Gem::Version.new(version_str)
-          ignore_requirements.any? { |req| req.satisfied_by?(gem_version) }
+          { branch: ref.name, commit_sha: ref.commit_sha, version: candidate.version }
         end
 
-        # Parses "YY.MM" into [year, month] for comparison.
-        sig { params(version_str: String).returns(T.nilable(T::Array[Integer])) }
-        def parse_version(version_str)
-          parts = version_str.split(".")
-          return unless parts.length == 2
-
-          year = Integer(T.must(parts[0]), 10)
-          month = Integer(T.must(parts[1]), 10)
-          return unless month.between?(1, 12)
-
-          [year, month]
-        rescue ArgumentError
-          nil
-        end
-
-        sig { returns(T::Array[Gem::Requirement]) }
-        def ignore_requirements
-          @ignore_requirements ||= T.let(
-            ignored_versions.flat_map do |req|
-              Dependabot::Nix::Requirement.requirements_array(req)
-            rescue Gem::Requirement::BadRequirementError
-              []
-            end,
-            T.nilable(T::Array[Gem::Requirement])
-          )
+        sig { returns(IgnoreFilter) }
+        def ignore_filter
+          @ignore_filter ||= T.let(IgnoreFilter.new(ignored_versions), T.nilable(IgnoreFilter))
         end
 
         sig { returns(T::Array[Dependabot::GitRef]) }

data/lib/dependabot/nix/update_checker.rb

@@ -7,6 +7,7 @@ require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/nix/version"
 require "dependabot/nix/requirement"
+require "dependabot/nix/channel"
 require "dependabot/git_commit_checker"
 
 module Dependabot
@@ -16,6 +17,7 @@ module Dependabot
 
       require_relative "update_checker/latest_version_finder"
       require_relative "update_checker/versioned_branch_finder"
+      require_relative "update_checker/channel_version_finder"
 
       sig { override.returns(T.nilable(T.any(String, Dependabot::Version))) }
       def latest_version
@@ -38,7 +40,9 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        if ref_pinned_to_version_tag?
+        if tarball_channel_input?
+          wrap_requirements(updated_requirements_for_channel)
+        elsif ref_pinned_to_version_tag?
           wrap_requirements(updated_requirements_for_tag)
         elsif ref_is_versioned_branch?
           wrap_requirements(updated_requirements_for_versioned_branch)
@@ -61,7 +65,9 @@ module Dependabot
 
       sig { returns(T.nilable(String)) }
       def fetch_latest_version
-        if ref_pinned_to_version_tag?
+        if tarball_channel_input?
+          fetch_latest_version_for_channel
+        elsif ref_pinned_to_version_tag?
           fetch_latest_version_for_tag
         elsif ref_is_versioned_branch?
           fetch_latest_version_for_versioned_branch || fetch_latest_version_for_commit
@@ -70,6 +76,75 @@ module Dependabot
         end
       end
 
+      # --- Tarball channel support ---
+
+      sig { returns(T::Boolean) }
+      def tarball_channel_input?
+        source = dependency.source_details(allowed_types: ["tarball"])
+        return false unless source
+
+        Channel.channel_url?(source[:url] || source["url"])
+      end
+
+      sig { returns(T.nilable(String)) }
+      def fetch_latest_version_for_channel
+        latest_channel&.fetch(:commit_sha) || channel_version_finder.current_channel_revision
+      end
+
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def updated_requirements_for_channel
+        result = latest_channel
+        return dependency.requirements unless result
+
+        dependency.requirements.map do |req|
+          source = req[:source]
+          next req unless source
+
+          req.merge(source: source.merge(ref: result[:channel], url: result[:url]))
+        end
+      end
+
+      sig { returns(T.nilable(T::Hash[Symbol, String])) }
+      def latest_channel
+        @latest_channel ||= T.let(
+          channel_version_finder.latest_channel,
+          T.nilable(T::Hash[Symbol, String])
+        )
+      end
+
+      sig { returns(ChannelVersionFinder) }
+      def channel_version_finder
+        @channel_version_finder ||= T.let(
+          ChannelVersionFinder.new(
+            current_channel: T.must(tarball_channel_name),
+            credentials: credentials,
+            ignored_versions: ignored_versions,
+            extension: tarball_channel_extension
+          ),
+          T.nilable(ChannelVersionFinder)
+        )
+      end
+
+      sig { returns(T.nilable(String)) }
+      def tarball_channel_name
+        source = dependency.source_details(allowed_types: ["tarball"])
+        return unless source
+
+        ref = source[:ref] || source["ref"]
+        return ref if ref
+
+        # Fall back to the URL's channel when the source omits a ref.
+        Channel.channel_name_from_url(source[:url] || source["url"])
+      end
+
+      # Preserve the flake's existing tarball suffix (xz, gz, bz2) on a bump.
+      sig { returns(String) }
+      def tarball_channel_extension
+        source = dependency.source_details(allowed_types: ["tarball"])
+        url = source && (source[:url] || source["url"])
+        Channel.extension_from_url(url) || Channel::DEFAULT_EXTENSION
+      end
+
       # --- Tag-pinned ref support ---
 
       sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }

data/lib/dependabot/nix/versioned_name.rb

@@ -0,0 +1,88 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Nix
+    # Parses a NixOS-style versioned name (e.g. "nixos-26.05", "nixpkgs-24.11-darwin")
+    # into prefix, YY.MM version, and suffix, and compares names within a family.
+    class VersionedName
+      extend T::Sig
+
+      # prefix + YY.MM version + optional suffix, e.g. "nixpkgs-26.05-darwin".
+      VERSIONED_NAME_PATTERN =
+        /\A(?<prefix>.+[.\-_])(?<version>\d{2}\.\d{2})(?<suffix>-[a-zA-Z0-9]+)?\z/
+
+      sig { params(name: String).void }
+      def initialize(name)
+        @name = name
+        @match = T.let(VERSIONED_NAME_PATTERN.match(name), T.nilable(MatchData))
+      end
+
+      sig { returns(String) }
+      attr_reader :name
+
+      sig { returns(T::Boolean) }
+      def versioned?
+        !@match.nil?
+      end
+
+      sig { returns(T.nilable(String)) }
+      def prefix
+        @match&.[](:prefix)
+      end
+
+      sig { returns(T.nilable(String)) }
+      def suffix
+        @match&.[](:suffix)
+      end
+
+      sig { returns(T.nilable(String)) }
+      def version_string
+        @match&.[](:version)
+      end
+
+      # YY.MM as a comparable [year, month], or nil.
+      sig { returns(T.nilable(T::Array[Integer])) }
+      def version
+        version_str = version_string
+        return unless version_str
+
+        parse_version(version_str)
+      end
+
+      # Same prefix and suffix, so bumps stay within e.g. nixos-* (not nixos-*-small).
+      sig { params(other: VersionedName).returns(T::Boolean) }
+      def same_family?(other)
+        versioned? && other.versioned? &&
+          prefix == other.prefix && suffix == other.suffix
+      end
+
+      sig { params(other: VersionedName).returns(T::Boolean) }
+      def newer_than?(other)
+        this_version = version
+        other_version = other.version
+        return false unless this_version && other_version
+
+        (this_version <=> other_version) == 1
+      end
+
+      private
+
+      sig { params(version_str: String).returns(T.nilable(T::Array[Integer])) }
+      def parse_version(version_str)
+        parts = version_str.split(".")
+        return unless parts.length == 2
+
+        year = Integer(T.must(parts[0]), 10)
+        month = Integer(T.must(parts[1]), 10)
+        return unless month.between?(1, 12)
+
+        [year, month]
+      rescue ArgumentError
+        nil
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nix
 version: !ruby/object:Gem::Version
-  version: 0.383.0
+  version: 0.384.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.383.0
+        version: 0.384.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -242,24 +242,28 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/dependabot/nix.rb
+- lib/dependabot/nix/channel.rb
 - lib/dependabot/nix/file_fetcher.rb
 - lib/dependabot/nix/file_parser.rb
 - lib/dependabot/nix/file_updater.rb
 - lib/dependabot/nix/flake_nix_parser.rb
+- lib/dependabot/nix/ignore_filter.rb
 - lib/dependabot/nix/metadata_finder.rb
 - lib/dependabot/nix/package/package_details_fetcher.rb
 - lib/dependabot/nix/package_manager.rb
 - lib/dependabot/nix/requirement.rb
 - lib/dependabot/nix/update_checker.rb
+- lib/dependabot/nix/update_checker/channel_version_finder.rb
 - lib/dependabot/nix/update_checker/latest_version_finder.rb
 - lib/dependabot/nix/update_checker/versioned_branch_finder.rb
 - lib/dependabot/nix/version.rb
+- lib/dependabot/nix/versioned_name.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.383.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
 rdoc_options: []
 require_paths:
 - lib
@@ -274,7 +278,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.14
 specification_version: 4
 summary: Provides Dependabot support for Nix
 test_files: []