upd-cli 0.0.24__tar.gz → 0.0.25__tar.gz

{upd_cli-0.0.24 → upd_cli-0.0.25}/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+
+## [0.0.25](https://github.com/rvben/upd/compare/v0.0.24...v0.0.25) - 2026-04-15
+
+### Fixed
+
+- **pypi**: handle string-valued yanked field in PEP 691 JSON Simple API ([b17034b](https://github.com/rvben/upd/commit/b17034b540f6a5b62e446131c6e87f43695bbd9b))
+
 ## [0.0.24] - 2026-03-23
 
 ### Added

{upd_cli-0.0.24 → upd_cli-0.0.25}/Cargo.lock

@@ -1780,7 +1780,7 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "upd"
-version = "0.0.24"
+version = "0.0.25"
 dependencies = [
  "anyhow",
  "async-trait",

{upd_cli-0.0.24 → upd_cli-0.0.25}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "upd"
-version = "0.0.24"
+version = "0.0.25"
 edition = "2024"
 rust-version = "1.91.1"
 description = "A fast dependency updater for Python, Node.js, Rust, Go, Ruby, Terraform, GitHub Actions, pre-commit, and Mise projects"

upd_cli-0.0.25/Makefile

@@ -0,0 +1,57 @@
+.PHONY: build release test lint fmt check clean run install release-patch release-minor release-major
+
+# Build debug binary
+build:
+	cargo build
+
+# Build release binary
+release:
+	cargo build --release
+
+# Run all tests
+test:
+	cargo test
+
+# Run tests with output
+test-verbose:
+	cargo test -- --nocapture
+
+# Run clippy lints
+lint:
+	cargo clippy -- -D warnings
+
+# Format code
+fmt:
+	cargo fmt
+
+# Check formatting without changing files
+fmt-check:
+	cargo fmt -- --check
+
+# Run all checks (format, lint, test)
+check: fmt-check lint test
+
+# Clean build artifacts
+clean:
+	cargo clean
+
+# Run debug build
+run:
+	cargo run
+
+# Run with arguments
+run-release:
+	./target/release/upd
+
+# Install to ~/.cargo/bin
+install:
+	cargo install --path .
+
+release-patch:
+	vership bump patch
+
+release-minor:
+	vership bump minor
+
+release-major:
+	vership bump major

{upd_cli-0.0.24 → upd_cli-0.0.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: upd-cli
-Version: 0.0.24
+Version: 0.0.25
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -595,8 +595,8 @@ Add `upd` to your `.pre-commit-config.yaml`:
 
 ```yaml
 repos:
-  - repo: https://github.com/rvben/upd
-    rev: v0.0.24  # Use the latest version
+  - repo: https://github.com/rvben/upd-pre-commit
+    rev: v0.0.24
     hooks:
       - id: upd-check
         # Optional: only check specific ecosystems
@@ -610,9 +610,7 @@ Available hooks:
 | `upd-check` | Fail if any dependencies are outdated |
 | `upd-check-major` | Fail only on major (breaking) updates |
 
-Both hooks run on `pre-push` by default and trigger when dependency files change.
-
-**Note:** Requires `upd` to be installed and available in PATH.
+Both hooks run on `pre-push` by default. Uses `language: python` which installs `upd-cli` from PyPI automatically — no manual installation needed.
 
 ## Development
 

{upd_cli-0.0.24 → upd_cli-0.0.25}/README.md

@@ -572,8 +572,8 @@ Add `upd` to your `.pre-commit-config.yaml`:
 
 ```yaml
 repos:
-  - repo: https://github.com/rvben/upd
-    rev: v0.0.24  # Use the latest version
+  - repo: https://github.com/rvben/upd-pre-commit
+    rev: v0.0.24
     hooks:
       - id: upd-check
         # Optional: only check specific ecosystems
@@ -587,9 +587,7 @@ Available hooks:
 | `upd-check` | Fail if any dependencies are outdated |
 | `upd-check-major` | Fail only on major (breaking) updates |
 
-Both hooks run on `pre-push` by default and trigger when dependency files change.
-
-**Note:** Requires `upd` to be installed and available in PATH.
+Both hooks run on `pre-push` by default. Uses `language: python` which installs `upd-cli` from PyPI automatically — no manual installation needed.
 
 ## Development
 

{upd_cli-0.0.24 → upd_cli-0.0.25}/src/registry/pypi.rs

@@ -60,11 +60,50 @@ struct SimpleApiResponse {
     files: Vec<SimpleApiFile>,
 }
 
+/// Deserialize the `yanked` field from PyPI's Simple API (PEP 592 / PEP 700).
+/// The field can be:
+/// - absent / `null`  → not yanked (false)
+/// - `false`          → not yanked
+/// - `true`           → yanked (rare)
+/// - a non-empty string (the yank reason) → yanked
+fn deserialize_yanked_flag<'de, D>(deserializer: D) -> Result<bool, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    struct YankedVisitor;
+
+    impl<'de> serde::de::Visitor<'de> for YankedVisitor {
+        type Value = bool;
+
+        fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
+            formatter.write_str("a boolean or yank-reason string")
+        }
+
+        fn visit_bool<E: serde::de::Error>(self, v: bool) -> Result<bool, E> {
+            Ok(v)
+        }
+
+        fn visit_str<E: serde::de::Error>(self, v: &str) -> Result<bool, E> {
+            Ok(!v.is_empty())
+        }
+
+        fn visit_string<E: serde::de::Error>(self, v: String) -> Result<bool, E> {
+            Ok(!v.is_empty())
+        }
+
+        fn visit_unit<E: serde::de::Error>(self) -> Result<bool, E> {
+            Ok(false)
+        }
+    }
+
+    deserializer.deserialize_any(YankedVisitor)
+}
+
 #[derive(Debug, Clone, Deserialize)]
 struct SimpleApiFile {
     filename: String,
-    #[serde(default)]
-    yanked: Option<bool>,
+    #[serde(default, deserialize_with = "deserialize_yanked_flag")]
+    yanked: bool,
 }
 
 #[derive(Debug, Deserialize)]
@@ -457,7 +496,7 @@ impl PyPiRegistry {
 
         for file in &data.files {
             // Skip yanked packages
-            if file.yanked.unwrap_or(false) {
+            if file.yanked {
                 continue;
             }
 
@@ -920,19 +959,19 @@ mod tests {
             files: vec![
                 SimpleApiFile {
                     filename: "my_package-1.0.0.tar.gz".to_string(),
-                    yanked: Some(false),
+                    yanked: false,
                 },
                 SimpleApiFile {
                     filename: "my_package-1.1.0.tar.gz".to_string(),
-                    yanked: None,
+                    yanked: false,
                 },
                 SimpleApiFile {
                     filename: "my_package-1.2.0-py3-none-any.whl".to_string(),
-                    yanked: Some(false),
+                    yanked: false,
                 },
                 SimpleApiFile {
                     filename: "my_package-2.0.0a1.tar.gz".to_string(),
-                    yanked: Some(false),
+                    yanked: false,
                 },
             ],
         };
@@ -961,19 +1000,19 @@ mod tests {
             files: vec![
                 SimpleApiFile {
                     filename: "my_package-1.0.0.tar.gz".to_string(),
-                    yanked: Some(false),
+                    yanked: false,
                 },
                 SimpleApiFile {
                     filename: "my_package-1.1.0.tar.gz".to_string(),
-                    yanked: Some(true), // Yanked
+                    yanked: true, // Yanked
                 },
                 SimpleApiFile {
                     filename: "my_package-1.2.0.tar.gz".to_string(),
-                    yanked: Some(true), // Yanked
+                    yanked: true, // Yanked
                 },
                 SimpleApiFile {
                     filename: "my_package-1.3.0.tar.gz".to_string(),
-                    yanked: Some(false),
+                    yanked: false,
                 },
             ],
         };
@@ -987,6 +1026,89 @@ mod tests {
         assert_eq!(versions[1].1, "1.0.0");
     }
 
+    #[test]
+    fn test_parse_simple_api_json_response_string_yanked() {
+        // PyPI can return yanked as a string (the yank reason) per PEP 592 / PEP 700.
+        // Packages with string yanked values used to cause a serde deserialization
+        // failure (Option<bool> vs String), which caused the entire response to be
+        // discarded and fell through to the fallback registry with misleading 404 errors.
+        let registry = PyPiRegistry::new();
+        let json = r#"{
+            "files": [
+                {"filename": "my_package-1.0.0.tar.gz", "yanked": false},
+                {"filename": "my_package-1.1.0.tar.gz", "yanked": "Backward compatibility bug"},
+                {"filename": "my_package-1.2.0.tar.gz", "yanked": "security issue"},
+                {"filename": "my_package-2.0.0.tar.gz", "yanked": false}
+            ]
+        }"#;
+        let data: SimpleApiResponse = serde_json::from_str(json).unwrap();
+        let versions = registry
+            .parse_simple_api_json_response(data, "my-package", false)
+            .unwrap();
+        // 1.1.0 and 1.2.0 are yanked (string reason), should be skipped
+        assert_eq!(versions.len(), 2);
+        assert_eq!(versions[0].1, "2.0.0");
+        assert_eq!(versions[1].1, "1.0.0");
+    }
+
+    #[test]
+    fn test_parse_simple_api_json_response_empty_string_yanked() {
+        // yanked: "" is treated as not-yanked — an empty string carries no yank reason.
+        // PyPI uses true (bool) for no-reason yanks; empty string is not a valid yank signal.
+        let registry = PyPiRegistry::new();
+        let json = r#"{
+            "files": [
+                {"filename": "my_package-1.0.0.tar.gz", "yanked": ""},
+                {"filename": "my_package-2.0.0.tar.gz", "yanked": ""}
+            ]
+        }"#;
+        let data: SimpleApiResponse = serde_json::from_str(json).unwrap();
+        let versions = registry
+            .parse_simple_api_json_response(data, "my-package", false)
+            .unwrap();
+        assert_eq!(versions.len(), 2);
+        assert_eq!(versions[0].1, "2.0.0");
+        assert_eq!(versions[1].1, "1.0.0");
+    }
+
+    #[test]
+    fn test_parse_simple_api_json_response_null_yanked() {
+        // yanked: null must be treated as not-yanked (visit_unit)
+        let registry = PyPiRegistry::new();
+        let json = r#"{
+            "files": [
+                {"filename": "my_package-1.0.0.tar.gz", "yanked": null},
+                {"filename": "my_package-2.0.0.tar.gz", "yanked": null}
+            ]
+        }"#;
+        let data: SimpleApiResponse = serde_json::from_str(json).unwrap();
+        let versions = registry
+            .parse_simple_api_json_response(data, "my-package", false)
+            .unwrap();
+        assert_eq!(versions.len(), 2);
+        assert_eq!(versions[0].1, "2.0.0");
+        assert_eq!(versions[1].1, "1.0.0");
+    }
+
+    #[test]
+    fn test_parse_simple_api_json_response_absent_yanked() {
+        // yanked field absent entirely must be treated as not-yanked (#[serde(default)])
+        let registry = PyPiRegistry::new();
+        let json = r#"{
+            "files": [
+                {"filename": "my_package-1.0.0.tar.gz"},
+                {"filename": "my_package-2.0.0.tar.gz"}
+            ]
+        }"#;
+        let data: SimpleApiResponse = serde_json::from_str(json).unwrap();
+        let versions = registry
+            .parse_simple_api_json_response(data, "my-package", false)
+            .unwrap();
+        assert_eq!(versions.len(), 2);
+        assert_eq!(versions[0].1, "2.0.0");
+        assert_eq!(versions[1].1, "1.0.0");
+    }
+
     #[test]
     fn test_base64_encode() {
         assert_eq!(base64_encode("hello"), "aGVsbG8=");
@@ -1524,18 +1646,20 @@ mod tests {
             let mock_server1 = MockServer::start().await;
             let mock_server2 = MockServer::start().await;
 
-            // Both servers return 404
-            Mock::given(method("GET"))
-                .and(path("/testpkg/json"))
-                .respond_with(ResponseTemplate::new(404))
-                .mount(&mock_server1)
-                .await;
-
-            Mock::given(method("GET"))
-                .and(path("/testpkg/json"))
-                .respond_with(ResponseTemplate::new(404))
-                .mount(&mock_server2)
-                .await;
+            // Both servers: Simple API returns 404, JSON API also returns 404
+            for server in [&mock_server1, &mock_server2] {
+                Mock::given(method("GET"))
+                    .and(path("/simple/testpkg/"))
+                    .respond_with(ResponseTemplate::new(404))
+                    .mount(server)
+                    .await;
+
+                Mock::given(method("GET"))
+                    .and(path("/pypi/testpkg/json"))
+                    .respond_with(ResponseTemplate::new(404))
+                    .mount(server)
+                    .await;
+            }
 
             let primary = PyPiRegistry::with_index_url(mock_server1.uri());
             let extras = vec![mock_server2.uri()];

upd_cli-0.0.25/vership.toml

@@ -0,0 +1,2 @@
+[hooks]
+post-push = "gh api repos/rvben/upd-pre-commit/dispatches -f event_type=pypi_release"

upd_cli-0.0.24/Makefile

@@ -1,127 +0,0 @@
-.PHONY: build release test lint fmt check clean run install version-get version-major version-minor version-patch version-push release-major release-minor release-patch build-wheel verify-release pre-commit-update
-
-# Get version from Cargo.toml
-VERSION := $(shell grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
-
-# Verify release is ready
-verify-release:
-	@echo "Verifying release readiness..."
-	@./scripts/verify-release-ready.sh
-
-# Build Python wheel locally
-build-wheel:
-	@echo "Building Python wheel..."
-	maturin build --release
-
-# Build debug binary
-build:
-	cargo build
-
-# Build release binary
-release:
-	cargo build --release
-
-# Run all tests
-test:
-	cargo test
-
-# Run tests with output
-test-verbose:
-	cargo test -- --nocapture
-
-# Run clippy lints
-lint:
-	cargo clippy -- -D warnings
-
-# Format code
-fmt:
-	cargo fmt
-
-# Check formatting without changing files
-fmt-check:
-	cargo fmt -- --check
-
-# Run all checks (format, lint, test)
-check: fmt-check lint test
-
-# Clean build artifacts
-clean:
-	cargo clean
-
-# Run debug build
-run:
-	cargo run
-
-# Run with arguments
-run-release:
-	./target/release/upd
-
-# Install to ~/.cargo/bin
-install:
-	cargo install --path .
-
-# Show current version
-version-get:
-	@echo "Current version: v$(VERSION)"
-
-# Version tagging targets
-version-major:
-	@echo "Creating new major version tag..."
-	$(eval CURRENT := $(shell git describe --tags --abbrev=0 2>/dev/null || echo v0.0.0))
-	$(eval MAJOR := $(shell echo $(CURRENT) | sed -E 's/v([0-9]+)\.[0-9]+\.[0-9]+/\1/'))
-	$(eval NEW_MAJOR := $(shell echo $$(( $(MAJOR) + 1 ))))
-	$(eval NEW_TAG := v$(NEW_MAJOR).0.0)
-	@echo "Current: $(CURRENT) -> New: $(NEW_TAG)"
-	@sed -i '' 's/^version = ".*"/version = "$(NEW_MAJOR).0.0"/' Cargo.toml
-	@cargo check --quiet
-	@git add Cargo.toml Cargo.lock
-	@git commit -m "chore: bump version to $(NEW_TAG)"
-	@git tag -a $(NEW_TAG) -m "Release $(NEW_TAG)"
-	@echo "Version $(NEW_TAG) created. Run 'make version-push' to trigger release."
-
-version-minor:
-	@echo "Creating new minor version tag..."
-	$(eval CURRENT := $(shell git describe --tags --abbrev=0 2>/dev/null || echo v0.0.0))
-	$(eval MAJOR := $(shell echo $(CURRENT) | sed -E 's/v([0-9]+)\.[0-9]+\.[0-9]+/\1/'))
-	$(eval MINOR := $(shell echo $(CURRENT) | sed -E 's/v[0-9]+\.([0-9]+)\.[0-9]+/\1/'))
-	$(eval NEW_MINOR := $(shell echo $$(( $(MINOR) + 1 ))))
-	$(eval NEW_TAG := v$(MAJOR).$(NEW_MINOR).0)
-	@echo "Current: $(CURRENT) -> New: $(NEW_TAG)"
-	@sed -i '' 's/^version = ".*"/version = "$(MAJOR).$(NEW_MINOR).0"/' Cargo.toml
-	@cargo check --quiet
-	@git add Cargo.toml Cargo.lock
-	@git commit -m "chore: bump version to $(NEW_TAG)"
-	@git tag -a $(NEW_TAG) -m "Release $(NEW_TAG)"
-	@echo "Version $(NEW_TAG) created. Run 'make version-push' to trigger release."
-
-version-patch:
-	@echo "Creating new patch version tag..."
-	$(eval CURRENT := $(shell git describe --tags --abbrev=0 2>/dev/null || echo v0.0.0))
-	$(eval MAJOR := $(shell echo $(CURRENT) | sed -E 's/v([0-9]+)\.[0-9]+\.[0-9]+/\1/'))
-	$(eval MINOR := $(shell echo $(CURRENT) | sed -E 's/v[0-9]+\.([0-9]+)\.[0-9]+/\1/'))
-	$(eval PATCH := $(shell echo $(CURRENT) | sed -E 's/v[0-9]+\.[0-9]+\.([0-9]+)/\1/'))
-	$(eval NEW_PATCH := $(shell echo $$(( $(PATCH) + 1 ))))
-	$(eval NEW_TAG := v$(MAJOR).$(MINOR).$(NEW_PATCH))
-	@echo "Current: $(CURRENT) -> New: $(NEW_TAG)"
-	@sed -i '' 's/^version = ".*"/version = "$(MAJOR).$(MINOR).$(NEW_PATCH)"/' Cargo.toml
-	@cargo check --quiet
-	@git add Cargo.toml Cargo.lock
-	@git commit -m "chore: bump version to $(NEW_TAG)"
-	@git tag -a $(NEW_TAG) -m "Release $(NEW_TAG)"
-	@echo "Version $(NEW_TAG) created. Run 'make version-push' to trigger release."
-
-version-push:
-	$(eval LATEST_TAG := $(shell git describe --tags --abbrev=0))
-	@echo "Pushing latest commit and tag $(LATEST_TAG) to origin..."
-	@git push
-	@git push origin $(LATEST_TAG)
-	@echo "Release workflow triggered for $(LATEST_TAG)"
-
-# Combined release targets
-release-major: version-major version-push
-release-minor: version-minor version-push
-release-patch: version-patch version-push
-
-# Update pre-commit hooks to latest versions
-pre-commit-update:
-	pre-commit autoupdate