upd-cli 0.1.10__tar.gz → 0.2.0__tar.gz

{upd_cli-0.1.10 → upd_cli-0.2.0}/CHANGELOG.md

@@ -20,6 +20,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 
 
+
+## [0.2.0](https://github.com/rvben/upd/compare/v0.1.10...v0.2.0) - 2026-06-11
+
+### Breaking Changes
+
+- **audit**: give vulnerabilities_found its own exit code 6 as a declared outcome ([0037dc4](https://github.com/rvben/upd/commit/0037dc4e075f7d3cca7e51096fc11d07e1aa1cdb))
+
+### Added
+
+- **audit**: give vulnerabilities_found its own exit code 6 as a declared outcome ([0037dc4](https://github.com/rvben/upd/commit/0037dc4e075f7d3cca7e51096fc11d07e1aa1cdb))
+
 ## [0.1.10](https://github.com/rvben/upd/compare/v0.1.9...v0.1.10) - 2026-06-11
 
 ### Added

{upd_cli-0.1.10 → upd_cli-0.2.0}/Cargo.lock

@@ -2015,7 +2015,7 @@ checksum = "e9df2af067a7953e9c3831320f35c1cc0600c30d44d9f7a12b01db1cd88d6b47"
 
 [[package]]
 name = "upd"
-version = "0.1.10"
+version = "0.2.0"
 dependencies = [
  "anyhow",
  "async-trait",

{upd_cli-0.1.10 → upd_cli-0.2.0}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "upd"
-version = "0.1.10"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.95.0"
 description = "A fast dependency updater for Python, Node.js, Rust, Go, Ruby, Terraform, GitHub Actions, pre-commit, and Mise projects"

{upd_cli-0.1.10 → upd_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: upd-cli
-Version: 0.1.10
+Version: 0.2.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{upd_cli-0.1.10 → upd_cli-0.2.0}/src/lib.rs

@@ -53,15 +53,17 @@ pub fn decide_exit_code(non_mutating: bool, has_pending_updates: bool, has_error
 ///
 /// - `2` — scan errors occurred; errors take precedence over vulnerability
 ///   findings so that CI can distinguish a broken scan from a clean one.
-/// - `3` — vulnerabilities were found and `no_fail` is `false`; distinct from
-///   the update exit codes (1 = pending updates, 2 = errors) so callers can
-///   handle each condition independently.
+/// - `6` — vulnerabilities were found and `no_fail` is `false`; a dedicated
+///   code, distinct from the update exit codes (1 = pending updates,
+///   2 = errors) and from the error exit codes declared in the schema, so
+///   callers can branch on the exit code alone. Declared as the
+///   `vulnerabilities_found` outcome in the schema.
 /// - `0` — no vulnerabilities found, or `no_fail` suppresses the non-zero exit.
 pub fn decide_audit_exit_code(vuln_count: usize, error_count: usize, no_fail: bool) -> i32 {
     if error_count > 0 {
         2
     } else if vuln_count > 0 && !no_fail {
-        3
+        6
     } else {
         0
     }

{upd_cli-0.1.10 → upd_cli-0.2.0}/src/schema.rs

@@ -256,6 +256,11 @@ fn build_schema() -> Value {
                 "code": 1,
                 "name": "updates_available",
                 "description": "Updates are available (dry-run mode only); the report is on stdout. Not an error. Run with --apply to write changes"
+            },
+            {
+                "code": 6,
+                "name": "vulnerabilities_found",
+                "description": "Security vulnerabilities found during audit; the report is on stdout. Not an error. Use --no-fail to exit 0 instead"
             }
         ],
         "errors": [
@@ -282,12 +287,6 @@ fn build_schema() -> Value {
                 "description": "Version conflict detected between files",
                 "exit_code": 5,
                 "retryable": false
-            },
-            {
-                "kind": "vulnerabilities_found",
-                "description": "Security vulnerabilities found during audit (use --no-fail to suppress non-zero exit)",
-                "exit_code": 3,
-                "retryable": false
             }
         ]
     })

{upd_cli-0.1.10 → upd_cli-0.2.0}/tests/exit_codes.rs

@@ -344,8 +344,8 @@ fn decide_audit_exit_code_clean() {
 #[test]
 fn decide_audit_exit_code_vulns_without_no_fail() {
     use upd::decide_audit_exit_code;
-    assert_eq!(decide_audit_exit_code(1, 0, false), 3);
-    assert_eq!(decide_audit_exit_code(162, 0, false), 3);
+    assert_eq!(decide_audit_exit_code(1, 0, false), 6);
+    assert_eq!(decide_audit_exit_code(162, 0, false), 6);
 }
 
 /// Unit test: vulns found, --no-fail present → exit 0.
@@ -388,7 +388,7 @@ fn audit_on_empty_workspace_exits_zero() {
 /// A wiremock server stands in for the OSV API and reports one vulnerability
 /// for `requests==1.0.0`.
 #[tokio::test]
-async fn audit_with_vulns_exits_three() {
+async fn audit_with_vulns_exits_six() {
     use wiremock::matchers::{method, path};
     use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -422,8 +422,8 @@ async fn audit_with_vulns_exits_three() {
     );
 
     assert_eq!(
-        code, 3,
-        "audit with vulns must exit 3 (no --no-fail); stderr: {stderr}"
+        code, 6,
+        "audit with vulns must exit 6, the vulnerabilities_found outcome (no --no-fail); stderr: {stderr}"
     );
 }
 

{upd_cli-0.1.10 → upd_cli-0.2.0}/tests/fix_audit.rs

@@ -159,9 +159,9 @@ async fn fix_audit_dry_run_exits_1_and_leaves_file_unchanged() {
 }
 
 /// When a vulnerability has no `fixed_version`, emit a warning and don't touch the file.
-/// Falls through to normal audit exit code (3 = vulnerable, !no_fail).
+/// Falls through to normal audit exit code (6 = vulnerabilities_found outcome, !no_fail).
 #[tokio::test]
-async fn fix_audit_no_fixed_version_warns_and_exits_3() {
+async fn fix_audit_no_fixed_version_warns_and_exits_6() {
     use wiremock::matchers::{method, path};
     use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -198,10 +198,10 @@ async fn fix_audit_no_fixed_version_warns_and_exits_3() {
     );
 
     // No fixable packages → falls through to normal audit exit code.
-    // Normal audit with vulnerabilities and !no_fail → exit 3.
+    // Normal audit with vulnerabilities and !no_fail → exit 6.
     assert_eq!(
-        code, 3,
-        "should exit 3 (vulnerable, no fix available); stdout: {stdout}\nstderr: {stderr}"
+        code, 6,
+        "should exit 6 (vulnerabilities_found outcome, no fix available); stdout: {stdout}\nstderr: {stderr}"
     );
 
     let content = fs::read_to_string(&req_path).unwrap();