Commit Graph

732 Commits

Author SHA1 Message Date
Daniel Chao 1733a4c6e7 Fix: docsite-info is an optional input (#1598) 2026-05-19 15:20:02 -07:00
odenix dc9003d0f1 pkl-config-java: Refine nullness handling in Config and JavaType (#1544)
Motivation:
Config.as() causes nullness warnings when its result is intentionally assigned
to a non-null variable

Changes:

* Introduce Config.asNullable(Class<T>), asNullable(JavaType<T>), and
  asNullable(Type) to explicitly opt into nullable values
* Keep the signatures of Config.as(Class<T>) and Config.as(JavaType<T>)
  unchanged from 0.31 by adding @NullUnmarked
  * This gives users time to migrate from as() to asNullable() where appropriate
  * Avoids introducing new spurious warnings
* Change `<T> T Config.as(Type)` to `<T extends @nullable Object> T Config.as(Type)`
  * This overload is typically used by reflective code such as
    pkl-config-kotlin's Config.to() rather than directly by user code
* Clarify that JavaType<T> represents a non-null top-level type whose type arguments may be nullable
  * Restricting <T> to non-null keeps method signatures understandable for humans and tools
  * Enables full symmetry between Class<T> and JavaType<T> overloads in Config and JavaType
  * Enables future non-null runtime checks in both Config.as() overloads
* Simplify construction of `JavaType`s with nullable type arguments
  * Add ofNullable() variants for most factory methods, e.g., JavaType.listOfNullable()
* Overhaul Javadoc of Config and JavaType

Result:

* Clear separation between accessing nullable and non-null values
* Config.as() is used for the common non-null case
* Config.as() can perform non-null runtime checks in a future release (breaking change)
* More ergonomic construction of types with nullable type arguments
* More detailed and consistent documentation
2026-05-19 12:27:59 -07:00
Daniel Chao e34c3e8c4f Test reporter fixes (#1597)
* Fix error message when an invalid test reporter is supplied in Gradle
* Fix Gradle property name in docs
* Fix Gradle property name in tasks
* Introduce `TestReporter.default`, and use it in places where default
is applied
* Remove calls to `convention()`; this is not required because the input
is optional anyways.
2026-05-19 11:32:51 -07:00
Islon Scherer 3fbcd463e0 Introduce "minimal" test reporter (#1563) 2026-05-19 17:20:26 +02:00
odenix 566c42f44d pkl-doc: Support single-package docsite mode (#1592)
When a docsite has only one package name and no DocsiteInfo.overview,
treat it like Javadoc's single-module output: redirect the top-level
index to the package page and omit the site-title breadcrumb segment
from generated pages.

Add src/test/files/SinglePackageTest fixtures to cover multiple package
versions, redirect behavior, breadcrumb behavior, and unchanged site
structure.

Also:
- Shut down Executor used in test.
- Declare expected output fixtures of DocGenerator as test inputs, not
outputs.
- Fix IntelliJ warning by using a Set for the right-hand side of
collection subtraction.
2026-05-15 18:38:24 -07:00
Daniel Chao a7a64acbac Improve handling of evaling dependency notation URIs (#1595) 2026-05-15 15:51:09 -07:00
Daniel Chao 3ad1cb3645 Ensure local dependency matches PklProject.dep.json version (#1594)
The version of local project dependencies should _always_ exactly match
up with what's declared in a PklProject.deps.json; any package in the
transitive dependency tree should always be delcaring the same import
too.

Closes #1591
2026-05-15 11:48:57 -07:00
Vladimir Matveev 2fe565a0f2 Added support for external readers in Gradle plugins (#1578)
Adds support for configuring external module and resource readers in the Gradle plugin
2026-05-14 11:18:22 -07:00
odenix 1b6e89c971 pkl-doc: Fix/improve Executor handling in DocGenerator (#1590)
run() now creates and closes a default Executor per call. This is fine
because there is no good reason to call this method multiple times.

run(Executor) now lets callers provide their own Executor, which is
customary for a well-behaved library.

Also: Fix IntelliJ warning by calling toSet()

Closes #1583
2026-05-14 11:02:23 -07:00
dependabot[bot] 6171dbde28 Bump org.msgpack:msgpack-core from 0.9.11 to 0.9.12 (#1587) 2026-05-14 08:51:52 -07:00
dependabot[bot] 99b29ef3c7 Bump github/codeql-action from 4.35.2 to 4.35.4 (#1586) 2026-05-14 08:49:18 -07:00
dependabot[bot] c428f7abd0 Bump com.palantir.javapoet:javapoet from 0.14.0 to 0.15.0 (#1588) 2026-05-14 08:48:29 -07:00
dependabot[bot] 366b51bd21 Bump nu.validator:validator from 26.4.16 to 26.5.7 (#1589) 2026-05-14 08:47:25 -07:00
Jeaeun Kim 14085c18bb Add support for customizing HTTP headers (#1196)
This PR adds support for custom HTTP headers, introducing a
`--http-header` CLI flag to accept `key=value` pairs. These headers can
also be specified within the `setting.pkl` file.

Closes #633

SPICE: https://github.com/apple/pkl-evolution/pull/24

---------

Co-authored-by: Jen Basch <jbasch94@gmail.com>
Co-authored-by: Islon Scherer <islonscherer@gmail.com>
2026-05-12 13:53:59 -07:00
Jen Basch fe58405220 Improve some doc comments in pkl:Command (#1582) 2026-05-12 13:53:15 -07:00
Vladimir Matveev bac8b47ba8 Add resource readers from service providers in CLI (#1581)
This omission, in particular, prevents Gradle plugins (which rely on CLI
classes) from adding custom resource readers via the service loading
mechanism. This change seems benign, especially since this is already
done for module key factories.
2026-05-11 16:54:36 -07:00
Jen Basch 713fbc5043 Add missing javadoc for org.pkl.core.CommandSpec (#1577) 2026-05-08 20:29:05 -07:00
Daniel Chao 38733e5781 Fix parsing of dependency notation URIs (#1570)
Fixes a thrown exception when path segments contain characters that
aren't URI safe (e.g. `import "@foo/bar baz.pkl"`).

Closes #1545
2026-05-07 13:00:52 -07:00
dependabot[bot] 8ff03cfac0 Bump gradle-wrapper from 9.4.1 to 9.5.0 (#1575)
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.4.1 to
9.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/gradle/releases">gradle-wrapper's
releases</a>.</em></p>
<blockquote>
<h2>9.5.0</h2>
<p>The Gradle team is excited to announce Gradle 9.5.0.</p>
<p>Here are the highlights of this release:</p>
<ul>
<li>Task provenance in reports and failure messages</li>
<li>Type-safe accessors for precompiled Kotlin Settings plugins</li>
</ul>
<p><a href="https://docs.gradle.org/9.5.0/release-notes.html">Read the
Release Notes</a></p>
<p>We would like to thank the following community members for their
contributions to this release of Gradle:
<a href="https://github.com/atm1020">atm1020</a>,
<a href="https://github.com/mataha">mataha</a>,
<a href="https://github.com/aSemy">Adam</a>,
<a href="https://github.com/kelemen">Attila Kelemen</a>,
<a href="https://github.com/britter">Benedikt Ritter</a>,
<a href="https://github.com/Vampire">Björn Kautler</a>,
<a href="https://github.com/budindepunk">Caro Silva Rode</a>,
<a href="https://github.com/chanani">CHANHAN</a>,
<a href="https://github.com/DmitryNez">Dmitry Nezavitin</a>,
<a href="https://github.com/Juneezee">Eng Zer Jun</a>,
<a href="https://github.com/KugelLibelle">KugelLibelle</a>,
<a href="https://github.com/vmadalin">Madalin Valceleanu</a>,
<a href="https://github.com/quijote">Markus Gaisbauer</a>,
<a href="https://github.com/koppor">Oliver Kopp</a>,
<a href="https://github.com/hfhbd">Philip Wedemann</a>,
<a href="https://github.com/ploober">ploober</a>,
<a href="https://github.com/rpalcolea">Roberto Perez Alcolea</a>,
<a href="https://github.com/R0h1tAnand">Rohit Anand</a>,
<a href="https://github.com/Suvrat1629">Suvrat Acharya</a>,
<a href="https://github.com/usv240">Ujwal Suresh Vanjare</a>,
<a href="https://github.com/urdak">Victor Merkulov</a></p>
<h2>Upgrade instructions</h2>
<p>Switch your build to use Gradle 9.5.0 by updating your wrapper:</p>
<pre><code>./gradlew wrapper --gradle-version=9.5.0 &amp;&amp; ./gradlew
wrapper
</code></pre>
<p>See the Gradle <a
href="https://docs.gradle.org/9.5.0/userguide/upgrading_version_9.html">9.x
upgrade guide</a> to learn about deprecations, breaking changes and
other considerations when upgrading.</p>
<p>For Java, Groovy, Kotlin and Android compatibility, see the <a
href="https://docs.gradle.org/9.5.0/userguide/compatibility.html">full
compatibility notes</a>.</p>
<h2>Reporting problems</h2>
<p>If you find a problem with this release, please file a bug on <a
href="https://github.com/gradle/gradle/issues">GitHub Issues</a>
adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the <a
href="https://discuss.gradle.org/c/help-discuss">forum</a>.</p>
<p>We hope you will build happiness with Gradle, and we look forward to
your feedback via <a href="https://twitter.com/gradle">Twitter</a> or on
<a href="https://github.com/gradle">GitHub</a>.</p>
<h2>9.5.0 RC4</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/gradle/commit/3fe117d68f3907790f3809f121aa36303a9151f8"><code>3fe117d</code></a>
Update jdks.yaml (<a
href="https://redirect.github.com/gradle/gradle/issues/37703">#37703</a>)</li>
<li><a
href="https://github.com/gradle/gradle/commit/33d145af6fbe7cf7c9d84646b6d7f32fea91d5e2"><code>33d145a</code></a>
Update jdks.yaml</li>
<li><a
href="https://github.com/gradle/gradle/commit/f7a05d1ed48442eb5da4d6e2b6593da55cdec1da"><code>f7a05d1</code></a>
Update Gradle wrapper to version 9.5.0-rc-4 (<a
href="https://redirect.github.com/gradle/gradle/issues/37654">#37654</a>)</li>
<li><a
href="https://github.com/gradle/gradle/commit/266facdcbcb0b4c60120cc118eaf0f652bfcdfe5"><code>266facd</code></a>
Update Gradle wrapper to version 9.5.0-rc-4</li>
<li><a
href="https://github.com/gradle/gradle/commit/0ad6dd8e143455707e444aa7e3d38327a3366513"><code>0ad6dd8</code></a>
Suppress OSC taskbar reset on plain/piped stdout (<a
href="https://redirect.github.com/gradle/gradle/issues/37646">#37646</a>)</li>
<li><a
href="https://github.com/gradle/gradle/commit/966025d5850d46c9158a2f25e4096222277ecf57"><code>966025d</code></a>
Suppress OSC taskbar reset on plain/piped stdout</li>
<li><a
href="https://github.com/gradle/gradle/commit/e7455734449e422accebf44cf7b31bf93e3a770c"><code>e745573</code></a>
Polish IP docs (<a
href="https://redirect.github.com/gradle/gradle/issues/37642">#37642</a>)</li>
<li><a
href="https://github.com/gradle/gradle/commit/d5cfd079acd2c8f1182edd6ec23dbab571132d0a"><code>d5cfd07</code></a>
Ensure BuildOperationQueue will progress without extra leases (<a
href="https://redirect.github.com/gradle/gradle/issues/37629">#37629</a>)</li>
<li><a
href="https://github.com/gradle/gradle/commit/acdf0c36fa13ba09a7ff5b51f79b9af4b1a097ee"><code>acdf0c3</code></a>
Ensure BuildOperationQueue will progress without extra leases</li>
<li><a
href="https://github.com/gradle/gradle/commit/f7d0e4f6f7896426a8b24091388e4c252b62faef"><code>f7d0e4f</code></a>
Rename anchor</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/gradle/compare/v9.4.1...v9.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gradle-wrapper&package-manager=gradle&previous-version=9.4.1&new-version=9.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-07 12:28:59 -07:00
dependabot[bot] be8366a975 Bump jline from 4.0.12 to 4.0.14 (#1574)
Bumps `jline` from 4.0.12 to 4.0.14.

Updates `org.jline:jline-reader` from 4.0.12 to 4.0.14
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.12...4.0.14)

Updates `org.jline:jline-terminal` from 4.0.12 to 4.0.14
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.12...4.0.14)

Updates `org.jline:jline-terminal-jni` from 4.0.12 to 4.0.14
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@4.0.12...4.0.14)

---
updated-dependencies:
- dependency-name: org.jline:jline-reader
  dependency-version: 4.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal
  dependency-version: 4.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jline:jline-terminal-jni
  dependency-version: 4.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-07 11:17:45 -07:00
Jen Basch 8a4821c4e7 Power assertions: change source section check to an assert (#1572) 2026-05-04 13:53:40 -07:00
Jen Basch b7ba6a8649 Fix pkl:test fact power assertions when member source section is unavailable (#1571)
Power assertions only work when the source section is available. If it
is unavailable, power assertions throw a ParserError (unexpected EOF on
an empty input) when re-parsing the expression for presentation.
2026-05-04 12:25:15 -07:00
dependabot[bot] 9c1a9cb4f8 Bump kotlinToolchain from 2.3.20 to 2.3.21 (#1567)
Updates `org.jetbrains.kotlin:kotlin-gradle-plugin` from 2.3.20 to 2.3.21
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.3.20...v2.3.21)

Updates `org.jetbrains.kotlin.plugin.serialization` from 2.3.20 to 2.3.21
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.3.20...v2.3.21)

---
updated-dependencies:
- dependency-name: org.jetbrains.kotlin:kotlin-gradle-plugin
  dependency-version: 2.3.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.jetbrains.kotlin.plugin.serialization
  dependency-version: 2.3.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-30 08:31:46 -07:00
dependabot[bot] 5d4bac8f61 Bump com.uber.nullaway:nullaway from 0.13.2 to 0.13.4 (#1568)
Bumps [com.uber.nullaway:nullaway](https://github.com/uber/NullAway) from 0.13.2 to 0.13.4.
- [Release notes](https://github.com/uber/NullAway/releases)
- [Changelog](https://github.com/uber/NullAway/blob/master/CHANGELOG.md)
- [Commits](uber/NullAway@v0.13.2...v0.13.4)

---
updated-dependencies:
- dependency-name: com.uber.nullaway:nullaway
  dependency-version: 0.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-30 08:31:14 -07:00
Daniel Chao 4a25320995 Fix import/read verification when encountering glob wildcards (#1559)
Fixes an issue where the import verifier can possibly throw when
packaging on Windows due to `*` being an invalid filename.
2026-04-29 20:20:49 -07:00
Vladimir Matveev df063f17f3 Added pkg module key factory and resource reader to project loading (#1547)
This change allows `PklProject` files, usually loaded via the `Project`
static methods, to have references to external packages via `package://`
URIs.

This is helpful for centralizing and sharing common package
configuration via packages.
2026-04-29 16:45:14 -07:00
Kushal Pisavadia d3a3a14aaa Fix CRLF handling in line continuation escapes (#1564) 2026-04-29 13:53:55 -07:00
Daniel Chao 39c01c24ba Add another commit to ignore revs file (#1561)
Add commit from https://github.com/apple/pkl/pull/1560
2026-04-25 11:58:55 -07:00
Daniel Chao 2b3603b544 Reformat Kotlin code (#1560)
ktfmt has much improved how it formats Kotlin code. Unfortunately, this
means that whenever we touch a single line in a Kotlin file, we get a
_lot_ more changes thanks to ratcheting now picking up this file for
formatting.

This PR just reformats every single Kotlin file so we don't have to deal
with this churn in future PRs that touch Kotlin code.
2026-04-25 06:14:44 -07:00
Daniel Chao c4f56bf20d Fix setting DEBUG_ARGS (#1558)
Looks like context variable `runner` isn't available on the job level
`env`. It's available on the step level `env` though.
2026-04-24 19:34:08 -07:00
Daniel Chao 87b15f7a70 Only set --stacktrace --info if verbose logging is enabled (#1557)
This is a quality-of-life improvement; make our build logs more easy to
read through for the default case.

If we need more information, we can click on the "Enable debug logging"
checkbox when re-running a job, which then populates the `runner.debug`
context variable.
2026-04-24 15:28:57 -07:00
Daniel Chao e07ff96de8 Switch CodeQL to use PklCI API (#1555) 2026-04-23 11:28:16 -07:00
dependabot[bot] 88a56198a8 Bump nu.validator:validator from 26.4.2 to 26.4.16 (#1550)
Bumps [nu.validator:validator](https://github.com/validator/validator) from 26.4.2 to 26.4.16.
- [Release notes](https://github.com/validator/validator/releases)
- [Commits](https://github.com/validator/validator/commits/26.4.16)

---
updated-dependencies:
- dependency-name: nu.validator:validator
  dependency-version: 26.4.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-23 11:19:19 -07:00
dependabot[bot] de22705add Bump com.google.errorprone:error_prone_core from 2.48.0 to 2.49.0 (#1552)
Bumps [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) from 2.48.0 to 2.49.0.
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.48.0...v2.49.0)

---
updated-dependencies:
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-23 10:14:28 -07:00
Jen Basch e07abb7311 SPICE-0028: Add support for multi-line string line continuations (#1507)
SPICE: https://github.com/apple/pkl-evolution/pull/31
2026-04-21 10:29:52 -07:00
dependabot[bot] d85f06be27 Bump org.snakeyaml:snakeyaml-engine from 2.10 to 3.0.1 (#1538)
Bumps [org.snakeyaml:snakeyaml-engine](https://bitbucket.org/snakeyaml/snakeyaml-engine) from 2.10 to 3.0.1.
- [Commits](https://bitbucket.org/snakeyaml/snakeyaml-engine/branches/compare/snakeyaml-engine-3.0.1..snakeyaml-engine-2.10)

---
updated-dependencies:
- dependency-name: org.snakeyaml:snakeyaml-engine
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Chao <dan.chao@apple.com>
2026-04-20 22:28:57 -07:00
Lucas Shadler d4dacd5a0f Implement gradle configuration cache support (#1500)
Modern versions of Gradle support configuration caching
to prevent the gradual increase of project size to affect
the overall developer experience of Gradle builds. To
prepare the PKL project, and specificall pkl-gradle, for
configuration support, we introduce an integration test to
vet configuration cache rules, and then perform the necessary
updates to provide configuration cache support.
2026-04-20 22:02:13 -07:00
dependabot[bot] 7b70a44272 Bump com.uber.nullaway:nullaway from 0.13.1 to 0.13.2 (#1540)
Bumps [com.uber.nullaway:nullaway](https://github.com/uber/NullAway) from 0.13.1 to 0.13.2.
- [Release notes](https://github.com/uber/NullAway/releases)
- [Changelog](https://github.com/uber/NullAway/blob/master/CHANGELOG.md)
- [Commits](uber/NullAway@v0.13.1...v0.13.2)

---
updated-dependencies:
- dependency-name: com.uber.nullaway:nullaway
  dependency-version: 0.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-20 11:30:30 -07:00
Daniel Chao a33e431433 Enable codeql scanning (#1532)
This enables security vulnerability scanning using CodeQL.
2026-04-20 11:28:31 -07:00
Daniel Chao 4058f391a3 Fix dependabot (#1537)
Looks like `directory` is a required property; we should also fix our
schema but that's orthogonal to this actual fix.
2026-04-20 11:17:31 -07:00
odenix 7a75ab57f5 pkl-config-java: Replace Config.fromPklBinary() with ConfigDecoder (#1533)
Motivation:
- `Config` mixes configuration representation with decoding logic
- `Config.fromPklBinary()` does not scale as decoding gains options
(e.g., binary versions or formats)
- The decoding API is inconsistent with `ConfigEvaluator`

Changes:
- Introduce `ConfigDecoder` (with builder) and move
`Config.fromPklBinary()` logic into it
- Deprecate `Config.fromPklBinary()` methods for removal
- Add `ConfigDecoder.forKotlin()` extension function
- Update and improve tests

Result:
- Decoding is separated from `Config` and exposed via a dedicated API
- Decoding can evolve independently (e.g., adding options such as binary
versions or supporting new formats)
- Evaluation and decoding APIs follow a consistent design
2026-04-20 11:09:42 -07:00
Daniel Chao 07c68239b9 Remove lockfiles, manage Gradle dependencies with Dependabot (#1535)
Dependabot currently does not update lockfiles in multi-module projects
(see https://github.com/dependabot/dependabot-core/issues/14633)

To work around this issue, we will simply remove our lockfiles, and
change our version catalog to use fully specified versions.
The removal of lockfiles introduces two issues:

1. It is less visible what our dependency graph is
2. Our builds are potentially non-reproducible

To work around this, two mitigations are in place:

1. Enable `failOnDynamicVersions()`, which causes Gradle to fail the
build if any dependencies declare a version range
2. Enable GitHub dependency submission, which provides insight into the
project SBOM
2026-04-20 09:29:33 -07:00
Daniel Chao 9046221e03 Fix dependency scopes (#1534)
Fixes the following pom.xml issues:

1. pkl-doc and pkl-codegen-java sets the wrong dependency scopes for
pkl-commons-cli/pkl-base
2. pkl-config-kotlin sets the wrong dependency scope for
pkl-config-java-all

Closes #1293
Closes #1517
2026-04-20 08:54:49 -07:00
odenix 2e49a319b3 pkl-gradle: Migrate nullness to jSpecify (#1530) 2026-04-17 12:34:54 -07:00
Daniel Chao b1a5d8c915 Remove Config.makeConfig (#1531)
This doesn't really make sense as part of the `Config` API.

We can maybe make class `ConfigUtils` public, but, I don't know how useful it
is anyways; it's more of an implementation detail.
2026-04-17 11:19:02 -07:00
odenix 1571d72111 pkl-config-java: Migrate nullness to jSpecify (#1528) 2026-04-17 08:56:12 -07:00
Daniel Chao 2dd0e2de21 Only include *runtimeClasspath and *compileClasspath dependencies (#1529) 2026-04-16 17:09:08 -07:00
odenix 8103b7759f pkl-executor: Migrate nullness to jSpecify (#1527)
Annotating SPI classes is binary compatible (forward and backward).
2026-04-16 15:02:40 -07:00
Islon Scherer 03a641354e Add nullability check to pkl-formatter (#1526) 2026-04-16 08:37:56 -07:00
Jen Basch eeb0970dc4 Fix bug where reusing a pklbinary#Renderer could result in incorrect output (#1525) 2026-04-15 23:12:36 -07:00