v0.4.0: OSV.dev advisory checks, patchula apply, six new managers, and CLI flag changes

The Count now sniffs out known vulnerabilities in your dependencies, can write updates straight into your working tree with patchula apply, and reads six more kinds of files. Several CLI flags changed, so read Breaking Changes before you upgrade.

Added

• Known vulnerabilities from OSV.dev, on by default (@sweepies). Each dependency's current version is checked against OSV.dev. Updates that fix an advisory are marked in the report, the dashboard and the TUI, and their PRs get the security label. Only package names and versions are sent. To turn the checks off:

  security {
    advisories = false
  }

• Security updates go first (@sweepies). An update that fixes an advisory skips the release-age wait, schedule windows, groups and the prs.concurrent and prs.perHour limits. It gets a PR of its own.

• The lowest fixing release (@sweepies). When no permitted release fixes as many advisories as some other release could, the Count proposes the lowest release that fixes the most, even past permitted and channel. Set lowestFix = false to turn this off.

• Lockfile-only packages (#27, @sweepies). Registry packages in Cargo.lock and package-lock.json are checked too. A vulnerable crate in Cargo.lock gets a PR that changes only Cargo.lock. A vulnerable npm package that only the lockfile records is reported with the release that fixes it, but the Count does not propose the change.

• patchula apply writes updates into the working tree (#31, @sweepies). It opens no branches or PRs. Filters narrow what it writes:

  patchula apply --dry-run                         # print the diff, write nothing
  patchula apply --manager github-actions --type pin
  patchula apply --check                           # exit 3 while selected updates wait

  In a checkout, the TUI applies selected updates to the working tree the same way.

• Copier template updates, reported as notices (#38, @sweepies). The new copier manager lists template updates and never opens a PR. patchula apply --copier, or u on the TUI's Templates tab, runs your own copier update in the working tree, and only when you ask.

• New managers, all on by default:

  • GitLab CI (#30, @sweepies). gitlabci reads images, services and CI/CD component refs in .gitlab-ci.yml. gitlabci-include reads include: project: refs. For a self-hosted instance, set gitlab { host = "gitlab.example.com" }. The host must be gitlab.com or have gitlab in its name.
  • Woodpecker CI (#28, @sweepies). Images in .woodpecker.yml, .woodpecker.yaml and files directly inside .woodpecker/.
  • Forgejo and Gitea Actions (#29, @sweepies). Workflows in .forgejo/workflows/ and .gitea/workflows/ are read by github-actions.
  • Nix flake inputs (#39, @sweepies). Direct inputs in flake.nix are updated through their locked revisions, and flake.lock is refreshed with a pinned static nix.
  • APM (#43, @sweepies). Entries in apm.yml and apm.yaml, with apm.lock.yaml refreshed by apm lock. Commit pins are on by default, with the 24-hour release-age wait.

  To narrow the list, set managers in patchula.pkl.

• Working tree with no config (#32, @sweepies). At a terminal, lookup, run --dry-run and tui in a checkout without patchula.pkl ask whether to use the defaults, write a starter file, or quit. Without a terminal they fail and name --default-config, which uses the defaults for one run.

• GitHub CLI token fallback (#21, @sweepies). With no PATCHULA_TOKEN, GITHUB_TOKEN or GH_TOKEN, lookup and run use the token from gh auth token --hostname github.com.

Changed

• Failed lookups fail checks (#40, @sweepies). The report gains a lookupFailures list, with the kind of failure for each one. lookup and apply --check exit 4 when any lookup failed, so a pre-commit hook no longer passes while a registry is down. run still exits 0.

Fixed

• Pre-commit revs and GitLab refs are written as the exact tag name (#37, f3b091f, @sweepies). A hook pinned at v1.0, where upstream later tagged v1.1, was offered v1.1.0, a tag that does not exist. It is now offered v1.1.

Breaking Changes

The CLI now reads your working tree by default and changes how it reaches a server (#23, @sweepies).

• No repository named means the working tree. lookup, run --dry-run and tui read the patchula.pkl in the current directory, uncommitted changes included, instead of the checkout's GitHub repository. Without a patchula.pkl, use --default-config or --config. To read GitHub, name the repository, as in patchula lookup owner/repo.
• A real run with no repository is strict. It opens PRs for the checkout's GitHub repository, so it refuses a working tree with uncommitted changes, or a HEAD that is not at the remote's default branch. Use --dry-run to plan from the working tree.
• --server <URL> is gone from lookup, run and tui. Use the bare --remote flag with PATCHULA_SERVER set, or with the server the checkout has chosen. patchula auth login --server is unchanged.
• --no-server is now --here.
• --local <DIR> is removed. Run the command from inside that directory instead.
• Unknown flags are errors. They are no longer read as repository names.

# v0.3.0
patchula run --server <server-url> acme/app
patchula lookup --no-server

# v0.4.0
PATCHULA_SERVER=<server-url> patchula run --remote acme/app
patchula lookup --here

Full Changelog: v0.3.0...v0.4.0