upd-cli 0.0.25__tar.gz → 0.0.27__tar.gz

{upd_cli-0.0.25 → upd_cli-0.0.27}/CHANGELOG.md

@@ -6,6 +6,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+
+
+## [0.0.27](https://github.com/rvben/upd/compare/v0.0.26...v0.0.27) - 2026-04-15
+
+### Fixed
+
+- **align**: use pep440_rs for Python stable-version check ([7f132b3](https://github.com/rvben/upd/commit/7f132b351cdd9225a31df96d2a421c8c42926987))
+- **version**: use PEP 440 release segments for precision matching ([fff041d](https://github.com/rvben/upd/commit/fff041d2d2e9508f117012a6bfc857ee57e5cd20))
+
+## [0.0.26](https://github.com/rvben/upd/compare/v0.0.25...v0.0.26) - 2026-04-15
+
+### Fixed
+
+- **pypi**: rewrite HTML Simple API parser to handle multi-line anchor tags ([f9c937b](https://github.com/rvben/upd/commit/f9c937be297112e0556cae205f8c0f3ce54997f4))
+
 ## [0.0.25](https://github.com/rvben/upd/compare/v0.0.24...v0.0.25) - 2026-04-15
 
 ### Fixed

{upd_cli-0.0.25 → upd_cli-0.0.27}/Cargo.lock

@@ -1780,7 +1780,7 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "upd"
-version = "0.0.25"
+version = "0.0.27"
 dependencies = [
  "anyhow",
  "async-trait",

{upd_cli-0.0.25 → upd_cli-0.0.27}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "upd"
-version = "0.0.25"
+version = "0.0.27"
 edition = "2024"
 rust-version = "1.91.1"
 description = "A fast dependency updater for Python, Node.js, Rust, Go, Ruby, Terraform, GitHub Actions, pre-commit, and Mise projects"

{upd_cli-0.0.25 → upd_cli-0.0.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: upd-cli
-Version: 0.0.25
+Version: 0.0.27
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{upd_cli-0.0.25 → upd_cli-0.0.27}/src/align.rs

@@ -8,6 +8,7 @@ use crate::updater::{
     Lang, MiseUpdater, PackageJsonUpdater, ParsedDependency, PreCommitUpdater, PyProjectUpdater,
     RequirementsUpdater, TerraformUpdater, Updater,
 };
+use crate::version::is_stable_pep440;
 use anyhow::Result;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -170,16 +171,7 @@ fn find_highest_version(occurrences: &[PackageOccurrence], lang: Lang) -> Option
 /// Check if a version is stable (not a pre-release)
 fn is_stable_version(version: &str, lang: Lang) -> bool {
     match lang {
-        Lang::Python => {
-            // Python pre-release indicators: a, b, rc, alpha, beta, dev
-            let v = version.to_lowercase();
-            !v.contains("a")
-                && !v.contains("b")
-                && !v.contains("rc")
-                && !v.contains("alpha")
-                && !v.contains("beta")
-                && !v.contains("dev")
-        }
+        Lang::Python => is_stable_pep440(version),
         Lang::Node | Lang::Rust | Lang::Go | Lang::DotNet => {
             // Semver pre-release indicator: hyphen followed by identifier
             !version.contains('-')

{upd_cli-0.0.25 → upd_cli-0.0.27}/src/registry/pypi.rs

@@ -542,38 +542,88 @@ impl PyPiRegistry {
         let mut versions: Vec<(Version, String)> = Vec::new();
         let normalized = package.to_lowercase().replace('_', "-");
 
-        // Extract versions from href attributes in anchor tags
-        // Format: <a href="...">package-version.tar.gz</a> or package-version-py3-none-any.whl
-        // Yanked packages have data-yanked attribute: <a href="..." data-yanked="">...</a>
+        // Use a state machine to collect multi-line <a> opening tags.
+        //
+        // Some registries (e.g. Nexus Repository Manager) spread attributes
+        // across multiple lines:
+        //   <a href="...pkg-1.0.0.whl#sha256=..."
+        //     rel="internal"
+        //     data-requires-python="&gt;=3.10"
+        //     >
+        //       pkg-1.0.0.whl
+        //   </a>
+        //
+        // We extract the filename from the `href` URL (the last path segment
+        // before the `#sha256=...` fragment) rather than the link text, so
+        // both single-line and multi-line formats are handled uniformly.
+        let mut collecting = false;
+        let mut is_yanked = false;
+        let mut href_value: Option<String> = None;
+
         for line in html.lines() {
-            // Skip yanked packages (marked with data-yanked attribute)
-            if line.contains("data-yanked") {
-                continue;
+            let trimmed = line.trim();
+
+            // Detect start of an anchor element
+            if trimmed.starts_with("<a ") || trimmed.starts_with("<a\t") {
+                collecting = true;
+                is_yanked = false;
+                href_value = None;
             }
 
-            let Some(start) = line.find('>') else {
-                continue;
-            };
-            let Some(end) = line[start..].find('<') else {
-                continue;
-            };
-            let filename = &line[start + 1..start + end];
-            let Some(version_str) = Self::extract_version_from_filename(filename, &normalized)
-            else {
-                continue;
-            };
+            if collecting {
+                // Check for yanked attribute (may be on any line of the element)
+                if trimmed.contains("data-yanked") {
+                    is_yanked = true;
+                }
 
-            if !include_prereleases && !Self::is_stable_version(&version_str) {
-                continue;
-            }
+                // Extract href value from whichever line carries it
+                if href_value.is_none()
+                    && let Some(href_start) = trimmed.find("href=\"")
+                {
+                    let after = &trimmed[href_start + 6..];
+                    if let Some(href_end) = after.find('"') {
+                        href_value = Some(after[..href_end].to_string());
+                    }
+                }
 
-            let Ok(version) = version_str.parse::<Version>() else {
-                continue;
-            };
+                // The opening tag ends when we see a bare `>`.
+                // `&gt;` in attribute values (e.g. data-requires-python="&gt;=3.10")
+                // is the HTML entity and does NOT contain a literal `>` byte in the
+                // raw HTTP response, so it won't trigger this check.
+                if trimmed.contains('>') {
+                    collecting = false;
 
-            // Avoid duplicates
-            if !versions.iter().any(|(_, v)| v == &version_str) {
-                versions.push((version, version_str));
+                    if is_yanked {
+                        continue;
+                    }
+
+                    let Some(href) = href_value.take() else {
+                        continue;
+                    };
+
+                    // Filename is the last URL path segment, before any `#fragment`
+                    let url_path = href.split('#').next().unwrap_or(&href);
+                    let filename = url_path.split('/').next_back().unwrap_or("");
+
+                    let Some(version_str) =
+                        Self::extract_version_from_filename(filename, &normalized)
+                    else {
+                        continue;
+                    };
+
+                    if !include_prereleases && !Self::is_stable_version(&version_str) {
+                        continue;
+                    }
+
+                    let Ok(version) = version_str.parse::<Version>() else {
+                        continue;
+                    };
+
+                    // Avoid duplicates (e.g. both .whl and .tar.gz for the same version)
+                    if !versions.iter().any(|(_, v)| v == &version_str) {
+                        versions.push((version, version_str));
+                    }
+                }
             }
         }
 
@@ -846,6 +896,9 @@ mod tests {
     fn test_stable_version_detection() {
         assert!(PyPiRegistry::is_stable_version("1.0.0"));
         assert!(PyPiRegistry::is_stable_version("2.31.0"));
+        // Post-releases are stable releases that fix packaging issues
+        assert!(PyPiRegistry::is_stable_version("1.0.0.post1"));
+        assert!(PyPiRegistry::is_stable_version("2.1117.0.post1"));
         assert!(!PyPiRegistry::is_stable_version("1.0.0a1"));
         assert!(!PyPiRegistry::is_stable_version("1.0.0b2"));
         assert!(!PyPiRegistry::is_stable_version("1.0.0rc1"));
@@ -952,6 +1005,56 @@ mod tests {
         assert_eq!(versions[1].1, "1.0.0");
     }
 
+    #[test]
+    fn test_parse_simple_api_response_multiline_anchor_format() {
+        // Some registries (e.g. Nexus Repository Manager) spread <a> attributes
+        // across multiple lines, with the filename text on a separate line after
+        // the closing '>'. Versions must be extracted from the href URL, not the
+        // link text.
+        let registry = PyPiRegistry::new();
+        let html = r#"
+<!DOCTYPE html>
+<html lang="en">
+<head><title>Links for my-package</title>
+  <meta name="api-version" value="2"/>
+</head>
+<body>
+  <h1>Links for my-package</h1>
+    <a href="../../packages/my-package/2.0.0/my_package-2.0.0.tar.gz#sha256=abc123"
+      rel="internal"
+      data-requires-python="&gt;=3.10"
+
+      >
+        my_package-2.0.0.tar.gz
+    </a>
+    <br/>
+    <a href="../../packages/my-package/2.0.0/my_package-2.0.0-py3-none-any.whl#sha256=def456"
+      rel="internal"
+      data-requires-python="&gt;=3.10"
+
+      >
+        my_package-2.0.0-py3-none-any.whl
+    </a>
+    <br/>
+    <a href="../../packages/my-package/1.9.0/my_package-1.9.0-py3-none-any.whl#sha256=ghi789"
+      rel="internal"
+      data-requires-python="&gt;=3.10"
+      data-yanked="superseded"
+      >
+        my_package-1.9.0-py3-none-any.whl
+    </a>
+</body>
+</html>
+"#;
+        let versions = registry
+            .parse_simple_api_response(html, "my-package", false)
+            .unwrap();
+        // 2.0.0 appears twice (tar.gz + whl) but should be deduplicated
+        // 1.9.0 is yanked and should be excluded
+        assert_eq!(versions.len(), 1);
+        assert_eq!(versions[0].1, "2.0.0");
+    }
+
     #[test]
     fn test_parse_simple_api_json_response() {
         let registry = PyPiRegistry::new();
@@ -1901,7 +2004,6 @@ mod tests {
             let mock_server = MockServer::start().await;
 
             // Server responds with HTML (no PEP 691 support)
-            // Each <a> tag needs to be on its own line for the parser
             let html = r#"<!DOCTYPE html>
 <html>
 <body>

upd_cli-0.0.27/src/version/mod.rs

@@ -0,0 +1,105 @@
+pub mod pep440;
+pub mod semver_util;
+
+pub use pep440::is_stable_pep440;
+pub use semver_util::is_stable_semver;
+
+/// Match the precision of a new version to the original version's precision.
+///
+/// For PEP 440 versions (Python), the release segment length is determined by
+/// parsing with `pep440_rs`, so post-release (`.post1`), dev (`.dev0`), and
+/// pre-release (`a1`, `b1`, `rc1`) suffixes are not counted as release segments
+/// and are preserved when the release segment count matches.
+///
+/// For other version schemes (semver, Go, Ruby…) that `pep440_rs` cannot parse,
+/// the function falls back to counting dot-separated segments.
+///
+/// Examples:
+/// - ("2.0", "3.0.5") → "3.0"
+/// - ("2.0.0", "3.0.5") → "3.0.5"
+/// - ("2", "3.0.5") → "3"
+/// - ("1.2.3.4", "5.6.7.8") → "5.6.7.8" (preserve all parts)
+/// - ("2.1117.0", "2.1117.0.post1") → "2.1117.0.post1" (post-release preserved)
+pub fn match_version_precision(original: &str, new_version: &str) -> String {
+    use pep440_rs::Version;
+
+    // Try PEP 440 parsing first; `.release()` returns only the numeric
+    // release tuple, correctly excluding pre/post/dev labels.
+    if let (Ok(orig), Ok(new)) = (original.parse::<Version>(), new_version.parse::<Version>()) {
+        let orig_len = orig.release().len();
+        let new_len = new.release().len();
+
+        return if orig_len >= new_len {
+            // Same or fewer release segments — keep the full new version string
+            // (including any post/pre/dev suffix) as written by the caller.
+            new_version.to_string()
+        } else {
+            // More release segments than original — truncate to original precision.
+            // Any post/pre/dev suffix on the new version is intentionally dropped
+            // since it belongs to a more specific release than we're tracking.
+            new.release()[..orig_len]
+                .iter()
+                .map(|n| n.to_string())
+                .collect::<Vec<_>>()
+                .join(".")
+        };
+    }
+
+    // Fallback for non-PEP-440 versions (semver, Go modules, etc.)
+    let original_parts: Vec<&str> = original.split('.').collect();
+    let new_parts: Vec<&str> = new_version.split('.').collect();
+    let precision = original_parts.len();
+
+    if precision >= new_parts.len() {
+        new_version.to_string()
+    } else {
+        new_parts[..precision].join(".")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_match_version_precision() {
+        // Major.minor only
+        assert_eq!(match_version_precision("2.0", "3.0.5"), "3.0");
+        assert_eq!(match_version_precision("2.8", "3.1.2"), "3.1");
+
+        // Full precision
+        assert_eq!(match_version_precision("2.0.0", "3.0.5"), "3.0.5");
+        assert_eq!(match_version_precision("1.2.3", "4.5.6"), "4.5.6");
+
+        // Major only
+        assert_eq!(match_version_precision("2", "3.0.5"), "3");
+
+        // New version has fewer parts than original (edge case)
+        assert_eq!(match_version_precision("2.0.0", "3.0"), "3.0");
+        assert_eq!(match_version_precision("2.0.0.0", "3.0.5"), "3.0.5");
+
+        // Same precision
+        assert_eq!(match_version_precision("1.0.0", "2.0.0"), "2.0.0");
+
+        // PEP 440 post-release suffix must be preserved when release precision matches
+        assert_eq!(
+            match_version_precision("2.1117.0", "2.1117.0.post1"),
+            "2.1117.0.post1"
+        );
+        assert_eq!(
+            match_version_precision("1.0.0", "1.0.0.post2"),
+            "1.0.0.post2"
+        );
+
+        // PEP 440 pre-release labels (no dot separator) are also preserved
+        assert_eq!(match_version_precision("2.0.0", "2.0.1a1"), "2.0.1a1");
+        assert_eq!(match_version_precision("2.0.0", "2.0.1b1"), "2.0.1b1");
+        assert_eq!(match_version_precision("2.0.0", "2.0.1rc1"), "2.0.1rc1");
+
+        // PEP 440 dev releases are also preserved
+        assert_eq!(match_version_precision("2.0.0", "2.0.0.dev1"), "2.0.0.dev1");
+
+        // Truncation path: suffix is dropped when original has lower precision
+        assert_eq!(match_version_precision("2.0", "3.0.5.post1"), "3.0");
+    }
+}

{upd_cli-0.0.25 → upd_cli-0.0.27}/src/version/pep440.rs

@@ -28,6 +28,9 @@ mod tests {
         assert!(is_stable_pep440("0.1.0"));
         assert!(is_stable_pep440("1.0"));
         assert!(is_stable_pep440("1"));
+        // Post-releases are stable releases that fix packaging issues
+        assert!(is_stable_pep440("1.0.0.post1"));
+        assert!(is_stable_pep440("2.1117.0.post1"));
     }
 
     #[test]

upd_cli-0.0.25/src/version/mod.rs

@@ -1,55 +0,0 @@
-pub mod pep440;
-pub mod semver_util;
-
-pub use pep440::is_stable_pep440;
-pub use semver_util::is_stable_semver;
-
-/// Match the precision of a new version to the original version's precision.
-///
-/// Examples:
-/// - ("2.0", "3.0.5") → "3.0"
-/// - ("2.0.0", "3.0.5") → "3.0.5"
-/// - ("2", "3.0.5") → "3"
-/// - ("1.2.3.4", "5.6.7.8") → "5.6.7.8" (preserve all parts)
-pub fn match_version_precision(original: &str, new_version: &str) -> String {
-    let original_parts: Vec<&str> = original.split('.').collect();
-    let new_parts: Vec<&str> = new_version.split('.').collect();
-
-    // Count how many parts the original has
-    let precision = original_parts.len();
-
-    // Take the same number of parts from the new version
-    if precision >= new_parts.len() {
-        // Original has same or more precision, use full new version
-        new_version.to_string()
-    } else {
-        // Original has less precision, truncate new version
-        new_parts[..precision].join(".")
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_match_version_precision() {
-        // Major.minor only
-        assert_eq!(match_version_precision("2.0", "3.0.5"), "3.0");
-        assert_eq!(match_version_precision("2.8", "3.1.2"), "3.1");
-
-        // Full precision
-        assert_eq!(match_version_precision("2.0.0", "3.0.5"), "3.0.5");
-        assert_eq!(match_version_precision("1.2.3", "4.5.6"), "4.5.6");
-
-        // Major only
-        assert_eq!(match_version_precision("2", "3.0.5"), "3");
-
-        // New version has fewer parts than original (edge case)
-        assert_eq!(match_version_precision("2.0.0", "3.0"), "3.0");
-        assert_eq!(match_version_precision("2.0.0.0", "3.0.5"), "3.0.5");
-
-        // Same precision
-        assert_eq!(match_version_precision("1.0.0", "2.0.0"), "2.0.0");
-    }
-}