Commit Graph

697 Commits

Author SHA1 Message Date
dependabot[bot]
d85f06be27 Bump org.snakeyaml:snakeyaml-engine from 2.10 to 3.0.1 (#1538)
Bumps [org.snakeyaml:snakeyaml-engine](https://bitbucket.org/snakeyaml/snakeyaml-engine) from 2.10 to 3.0.1.
- [Commits](https://bitbucket.org/snakeyaml/snakeyaml-engine/branches/compare/snakeyaml-engine-3.0.1..snakeyaml-engine-2.10)

---
updated-dependencies:
- dependency-name: org.snakeyaml:snakeyaml-engine
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Chao <dan.chao@apple.com>
2026-04-20 22:28:57 -07:00
Lucas Shadler
d4dacd5a0f Implement gradle configuration cache support (#1500)
Modern versions of Gradle support configuration caching
to prevent the gradual increase of project size to affect
the overall developer experience of Gradle builds. To
prepare the PKL project, and specificall pkl-gradle, for
configuration support, we introduce an integration test to
vet configuration cache rules, and then perform the necessary
updates to provide configuration cache support.
2026-04-20 22:02:13 -07:00
dependabot[bot]
7b70a44272 Bump com.uber.nullaway:nullaway from 0.13.1 to 0.13.2 (#1540)
Bumps [com.uber.nullaway:nullaway](https://github.com/uber/NullAway) from 0.13.1 to 0.13.2.
- [Release notes](https://github.com/uber/NullAway/releases)
- [Changelog](https://github.com/uber/NullAway/blob/master/CHANGELOG.md)
- [Commits](uber/NullAway@v0.13.1...v0.13.2)

---
updated-dependencies:
- dependency-name: com.uber.nullaway:nullaway
  dependency-version: 0.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-20 11:30:30 -07:00
Daniel Chao
a33e431433 Enable codeql scanning (#1532)
This enables security vulnerability scanning using CodeQL.
2026-04-20 11:28:31 -07:00
Daniel Chao
4058f391a3 Fix dependabot (#1537)
Looks like `directory` is a required property; we should also fix our
schema but that's orthogonal to this actual fix.
2026-04-20 11:17:31 -07:00
odenix
7a75ab57f5 pkl-config-java: Replace Config.fromPklBinary() with ConfigDecoder (#1533)
Motivation:
- `Config` mixes configuration representation with decoding logic
- `Config.fromPklBinary()` does not scale as decoding gains options
(e.g., binary versions or formats)
- The decoding API is inconsistent with `ConfigEvaluator`

Changes:
- Introduce `ConfigDecoder` (with builder) and move
`Config.fromPklBinary()` logic into it
- Deprecate `Config.fromPklBinary()` methods for removal
- Add `ConfigDecoder.forKotlin()` extension function
- Update and improve tests

Result:
- Decoding is separated from `Config` and exposed via a dedicated API
- Decoding can evolve independently (e.g., adding options such as binary
versions or supporting new formats)
- Evaluation and decoding APIs follow a consistent design
2026-04-20 11:09:42 -07:00
Daniel Chao
07c68239b9 Remove lockfiles, manage Gradle dependencies with Dependabot (#1535)
Dependabot currently does not update lockfiles in multi-module projects
(see https://github.com/dependabot/dependabot-core/issues/14633)

To work around this issue, we will simply remove our lockfiles, and
change our version catalog to use fully specified versions.
The removal of lockfiles introduces two issues:

1. It is less visible what our dependency graph is
2. Our builds are potentially non-reproducible

To work around this, two mitigations are in place:

1. Enable `failOnDynamicVersions()`, which causes Gradle to fail the
build if any dependencies declare a version range
2. Enable GitHub dependency submission, which provides insight into the
project SBOM
2026-04-20 09:29:33 -07:00
Daniel Chao
9046221e03 Fix dependency scopes (#1534)
Fixes the following pom.xml issues:

1. pkl-doc and pkl-codegen-java sets the wrong dependency scopes for
pkl-commons-cli/pkl-base
2. pkl-config-kotlin sets the wrong dependency scope for
pkl-config-java-all

Closes #1293
Closes #1517
2026-04-20 08:54:49 -07:00
odenix
2e49a319b3 pkl-gradle: Migrate nullness to jSpecify (#1530) 2026-04-17 12:34:54 -07:00
Daniel Chao
b1a5d8c915 Remove Config.makeConfig (#1531)
This doesn't really make sense as part of the `Config` API.

We can maybe make class `ConfigUtils` public, but, I don't know how useful it
is anyways; it's more of an implementation detail.
2026-04-17 11:19:02 -07:00
odenix
1571d72111 pkl-config-java: Migrate nullness to jSpecify (#1528) 2026-04-17 08:56:12 -07:00
Daniel Chao
2dd0e2de21 Only include *runtimeClasspath and *compileClasspath dependencies (#1529) 2026-04-16 17:09:08 -07:00
odenix
8103b7759f pkl-executor: Migrate nullness to jSpecify (#1527)
Annotating SPI classes is binary compatible (forward and backward).
2026-04-16 15:02:40 -07:00
Islon Scherer
03a641354e Add nullability check to pkl-formatter (#1526) 2026-04-16 08:37:56 -07:00
Jen Basch
eeb0970dc4 Fix bug where reusing a pklbinary#Renderer could result in incorrect output (#1525) 2026-04-15 23:12:36 -07:00
Daniel Chao
a8500b6b03 Add dependency submission (#1523)
This adds jobs to add Gradle dependencies to [GitHub's dependency
submission
API](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/using-the-dependency-submission-api),
and to review when these dependencies change.
2026-04-15 22:21:17 -07:00
odenix
4faf35a66a Gradle: Replace legacy buildSrc mechanism with included build (#1524)
Motivation:
buildSrc is a special-case legacy mechanism.
Gradle recommends using an included build named build-logic instead:

https://docs.gradle.org/current/userguide/best_practices_structuring_builds.html#favor_composite_builds

Changes:
- Rename buildSrc/ to build-logic/
  - triggers reformatting
- Replace occurrences of "buildSrc" with "build-logic"
- Include the build-logic build in the main build (via
settings.gradle.kts)
- Apply convention plugins via plugin IDs instead of type-safe accessors
  - small tradeoff compared to buildSrc

Result:
- Faster and more isolated builds
- Build logic behaves like a normal build, making it easier to evolve
and reason about

---------

Co-authored-by: Daniel Chao <dan.chao@apple.com>
2026-04-15 21:37:10 -07:00
odenix
04a9cc90d2 Improve build logic for Kotlin (#1520)
- Enforce Kotlin version via resolution rule (replaces BOM)
  - fail if kotlin-stdlib/kotlin-reflect exceed target version
- Replace kotlin-stdlib-jdk8 with kotlin-stdlib (jdk7/8 are now shims)
- Port pkl-core annotation processor to Java (with Codex)
- removes kotlin-stdlib from its compile classpath for better dependency
hygiene (Java module)
- Downgrade clikt for Kotlin 2.2 compatibility
- Upgrade kotlinx-serialization

---------

Co-authored-by: Daniel Chao <dan.chao@apple.com>
2026-04-15 09:02:42 -07:00
Islon Scherer
2e0b4a3a97 Fix gradle build issue during spotlessCheck (#1521) 2026-04-15 16:06:14 +02:00
odenix
1ba54f11a9 pkl-parser: Migrate nullness to JSpecify (#1515) 2026-04-14 12:17:17 -07:00
odenix
2d4286ee7b Upgrade JVM toolchain to 25 and Kotlin toolchain to 2.3.20 (#1516)
Motivation
- Enable correct NullAway analysis
- Pick up toolchain fixes and improvements

Toolchains
- Require JDK 25 for JVM toolchain (keep Java 17 runtime compatibility)
- Require Kotlin 2.3.20 for Kotlin toolchain (keep Kotlin 2.2 runtime
compatibility)
- Require JDK 25 for Gradle daemon JVM (via
gradle-daemon-jvm.properties)
- Fix javac and kotlinc warnings from toolchain upgrades

CI
- Bump GitHub workflows to JDK 25

Building Kotlin
- Bump Kotlin language level to 2.2 to match stdlib version
- Consolidate build logic into pklKotlinBase.gradle.kts
- Adopt modern Kotlin plugin syntax
- Fix new kotlinc warnings
- Update ktfmt to 0.62
  - first version compatible with Kotlin 2.3.20
  - changes formatting compared to 0.61
- Replace dependency resolution rule with BOM alignment
  - rule was too broad and interfered with toolchain/runtime separation

Testing
- Expand matrix to JDK 25 (LTS) and 26
- Ensure each matrix task can be run independently
- Fix KotlinCodeGeneratorsTest and EmbeddedExecutorsTest on affected
JDKs
- Disable one test in CliCommandTest on affected JDKs (failure cause
unknown)

Compatibility fixes
- Fix reflective access in DocGenerator on affected JDKs

Build fixes
- Fix misuse of `task.enabled` vs. `report.required`
- Fix `gradlew tasks` on Windows
- Downgrade Spotless to 8.3.0 to (hopefully) work around sporadic
NoClassDefFoundError

Result
- NullAway runs correctly
- Broader JDK test coverage
- More reproducible and potentially faster builds
2026-04-14 11:57:09 -07:00
Daniel Chao
20f403e751 Add spotless formatter step to revert copyright year only changes (#1518)
This avoids an issue where, during the course of development, a file is
touched, thus modifying the copyright year.
Then, undoing the previous change does not undo the copyright year
change.
2026-04-14 09:02:31 -07:00
Daniel Chao
7f173cc8e8 Fix stdlib lockfile (#1519)
Kotlin isn't a dependency of pkl-formatter anymore.
2026-04-14 08:38:30 -07:00
Islon Scherer
1d74e2a869 Move pkl-formatter to Java (#1514) 2026-04-14 16:29:42 +02:00
odenix
4620992743 pkl-parser: Represent "no children" as an empty list instead of null (#1513)
Motivation:
Facilitate the use of the NullAway checker as part of moving to
JSpecify.

Changes:
- represent "no children" as `List.of()` instead of null
- remove obsolete `children != null` assertions
  - NullAway intentionally ignores such assertions
- remove "no children" special-casing where no longer necessary

Result:
- cleaner code with similar performance
- removed a barrier to using the NullAway checker
2026-04-09 08:05:34 -07:00
odenix
2cfd0a0d28 Update JLine to 4.x (#1511)
- Remove dependency org.fusesource.jansi:jansi
- In 4.x, org.fusesource.jansi:jansi was replaced with org.jline:jansi.
Instead of adding this new dependency, this commit replaces Pkl’s single
Jansi usage with custom code that preserves existing behavior. Fixing
existing ANSI quirks is left for a future PR.
- Replace jline-terminal-ansi with jline-terminal-jni
  - In 4.x, only -jni and -ffm are available (-ffm requires Java 22+)
- Configure native-image build for jline-terminal-jni

As updating JLine is delicate, I manually tested `pkl repl` and `jpkl
repl` on Windows 11 (using Windows Terminal) and on Ubuntu, and found no
issues. However, I do not have access to a macOS machine.
2026-04-08 16:25:39 -07:00
odenix
fdeb568343 Clean up Kotlin code in buildSrc/ (#1512)
- fix most IntelliJ warnings (regex refactoring was done by IDE)
- replace hardcoded JVM target versions with BuildInfo.jvmTarget
2026-04-08 16:09:37 -07:00
Daniel Chao
ff6f7223d3 Remove intellij plugin (#1510)
This plugin is being moved to pkl-project-commons. 

Closes #1491

See https://github.com/apple/pkl-project-commons/pull/75
2026-04-08 13:46:23 -07:00
Daniel Chao
aca5a32f8e Bump license year (#1504) 2026-04-08 08:13:58 -07:00
odenix
24e69fd1e2 Improve Parser implementation (#1508)
- Make leaf AST classes final
- Make protected Lexer fields private and add getter
- Split Parser into Parser and ParserImpl
- Using a fresh ParserImpl instance per parse simplifies reasoning
(important) and makes the Parser API thread-safe (nice to have)
- Split GenericParser into GenericParser and GenericParserImpl
  - Same motivation as for Parser

Some of these changes will facilitate the move to JSpecify, which has
proven challenging for this package.
2026-04-08 08:13:39 -07:00
odenix
e793f4bd04 Update ktfmt to 0.61 (#1509) 2026-04-07 14:49:01 -07:00
odenix
09435af54f Improve Formatter API (#1505)
- pass `GrammarVersion` to constructor instead of passing it to each
`format` method
- replace `format(Path): String` with `format(Reader, Appendable)`
- instead of picking which overloads besides `format(String): String`
might be useful, offer a single generalized method that streams input
and output
- add `@Throws(IOException::class)` to ensure that Java callers can
catch this exception
- deprecate old methods
2026-04-07 14:16:12 -07:00
odenix
99cbd07518 Update GraalVM to 25.0.1 (#1506)
The latest version (25.0.2) no longer supports macos-x64.
2026-04-07 13:21:19 -07:00
Daniel Chao
8b892f9409 Bump Gradle to 9.4.1 (#1502) 2026-04-07 08:32:43 -07:00
odenix
7dedddcdb1 Update Gradle plugins (#1503) 2026-04-07 06:48:31 -07:00
odenix
623912eca0 Update msgpack to 0.9.11 and slf4j to 2.x (#1501) 2026-04-06 22:00:07 -07:00
odenix
dcd60b8194 Update nu-validator from 20.x to 26.x (#1499)
Also fix incorrect heading level in two Pkldoc tests, as this issue is
now flagged by nu-validator.
2026-04-06 19:25:00 -07:00
odenix
1251843169 Update Kotlin dependencies (#1498) 2026-04-06 12:06:43 -07:00
Daniel Chao
9868c11e5a Disable flaky test (#1497)
Disabling for now due to #1493
2026-04-06 11:39:00 -07:00
odenix
0835c6da82 Update JUnit to 6.x (#1496) 2026-04-06 11:15:55 -07:00
odenix
a8c66938e6 Update dependencies (#1492)
Update dependencies by running `./gradlew updateDependencyLocks`. Most
of the updated dependencies are test dependencies.
2026-04-06 08:22:06 -07:00
Luke Daley
8e7eb2bd96 Fix data race in MessagePack encoder for concurrent server sends (#1486) 2026-04-04 14:26:16 -07:00
odenix
58033598c7 Fix Javadoc and kotlinc warnings (#1490) 2026-04-03 14:32:34 -07:00
Islon Scherer
bc503d4d60 Make the build work on jdk 25 (#1483)
The old version of googleJavaFormat we were using called some deprecated
function.
2026-03-31 09:38:36 +02:00
Jen Basch
82afa8b90b Port 0.31.1 changelog to main (#1476)
Co-authored-by: Islon Scherer <i_desouzascherer@apple.com>
2026-03-26 09:41:01 -07:00
Islon Scherer
dc5504749a Disable gradle cache for release builds (#1474) 2026-03-26 16:54:10 +01:00
Jen Basch
a9c890e2f9 Do not activate power assertions when a single union member containing a type constraint fails (#1462)
Prior to this change, this code would activate powers assertions /
instrumentation permanently:
```pkl
foo: String(contains("a")) | String(contains("b")) = "boo"
```

This is because the `contains("a")` constraint would fail, triggering
power assertions, but the subsequent check of the union's
`contains("b")` branch would succeed.
As observed in #1419, once instrumentation is enabled, all subsequent
evaluation slows significantly.
As with #1419, the fix here is to disable power assertions via
`VmLocalContext` until we know that all union members failed type
checking; then, each member is re-executed with power assertions allowed
to provide the improved user-facing error.
2026-03-25 11:52:37 -07:00
Jen Basch
f23c37a993 Prevent --multiple-file-output-path writes from following symlinks outside the target directory (#1467) 2026-03-25 11:50:20 -07:00
Jen Basch
cdc6fa8aec Prevent I/O when checking UNC paths against --root-dir (#1466)
Test on [windows] please
2026-03-25 11:40:51 -07:00
Jen Basch
1104f12362 Allow custom/external resources to be "not found" (#1471)
This allows custom/external resources to produce `null` values for
nullable reads (`read?`)

Ref: https://github.com/apple/pkl-go/issues/157
2026-03-24 12:43:44 -07:00