From d86f78895845515d2a9b0a49dbedddb060643814 Mon Sep 17 00:00:00 2001
From: ehennestad <ehennestad@gmail.com>
Date: Thu, 15 Oct 2026 22:34:33 +0200
Subject: [PATCH 1/2] feat: warn about namespace references that vendorPackage
 cannot rename

vendorPackage renames the source namespace only in .m files, and only
where "." and a letter or "*" follow the name. A namespace name built at
run time, such as "webprogress." + name or
meta.package.fromName("webprogress"), and every reference in another
file, such as an .mlx file or functionSignatures.json, was left
unchanged without notice. In the copy, such a reference resolves to the
original namespace: it fails when that namespace is not installed, and
runs another version of the code when it is.

After renaming, the copied files are now searched for the source
namespace name as a whole word, and the warning
MatBox:VendorPackage:UnrenamedReferences lists each place found: file
and line for text files, the file alone for binary files. .mlx and
.mlapp files are searched in the files their zip archive holds. Error
identifiers and comment lines of .m files are not reported, and the
license file and vendorinfo.json are added after the search.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../+internal/findNamespaceReferences.m       | 119 ++++++++++++++
 .../+internal/vendorPackageFromFolder.m       |  17 ++
 code/+matbox/+tasks/vendorPackage.m           |   8 +
 .../+unittest/VendorPackageTest.m             | 152 ++++++++++++++++++
 4 files changed, 296 insertions(+)
 create mode 100644 code/+matbox/+tasks/+internal/findNamespaceReferences.m

diff --git a/code/+matbox/+tasks/+internal/findNamespaceReferences.m b/code/+matbox/+tasks/+internal/findNamespaceReferences.m
new file mode 100644
index 0000000..f416d7c
--- /dev/null
+++ b/code/+matbox/+tasks/+internal/findNamespaceReferences.m
@@ -0,0 +1,119 @@
+function locations = findNamespaceReferences(folderPath, namespaceName)
+%findNamespaceReferences - Find the places where the files below a folder name a namespace
+%   locations = matbox.tasks.internal.findNamespaceReferences(folderPath,namespaceName)
+%   searches the files below folderPath for namespaceName as a whole word
+%   and returns a string column vector with one element per place found.
+%   For a text file, an element is the path of the file relative to
+%   folderPath, with "/" as separator, followed by ":" and the line
+%   number, such as "upload.m:12". For a binary file, it is the path
+%   alone, such as "examples/demo.mlx".
+%
+%   The name is not counted when a letter, digit, "_", ".", "/" or "\"
+%   comes before it, as in matbox.tasks.internal.renameNamespaceInText, or
+%   when a letter, digit, "_" or ":" comes after it. This leaves out longer
+%   names, renamed references ("mytoolbox.external.webprogress.upload"),
+%   paths and error identifiers ("webprogress:upload:Failed"). Lines of .m
+%   files that are comments are not searched.
+%
+%   .mlx and .mlapp files are zip archives and are searched in the files
+%   they hold. A file with a NUL byte is binary and is searched as it is
+%   stored, so a name in compressed data, such as a MAT-file saved in the
+%   default format, is not found.
+%
+%   See also matbox.tasks.vendorPackage, matbox.tasks.internal.renameNamespaceInText
+
+    arguments
+        folderPath (1,1) string {mustBeFolder}
+        namespaceName (1,1) string {mustBeNonzeroLengthText}
+    end
+
+    ARCHIVE_EXTENSIONS = [".mlx", ".mlapp"];
+    CODE_EXTENSION = ".m";
+
+    % The character classes are spelled out because \w may also match
+    % non-ASCII letters, and the text is the raw bytes of a file.
+    notInsideLongerName = "(?<![A-Za-z0-9_.\\/])";
+    notFollowedByNameOrColon = "(?![A-Za-z0-9_:])";
+    pattern = notInsideLongerName ...
+        + regexptranslate("escape", namespaceName) + notFollowedByNameOrColon;
+
+    fileListing = dir(fullfile(folderPath, "**", "*"));
+    fileListing([fileListing.isdir]) = [];
+    filePaths = sort(string(fullfile({fileListing.folder}, {fileListing.name})));
+
+    % dir gives full paths with symbolic links resolved, so the root folder
+    % is taken from dir as well for the file paths to start with it.
+    rootListing = dir(folderPath);
+    rootFolder = string(rootListing(1).folder);
+    relativePaths = replace(extractAfter(filePaths, strlength(rootFolder) + 1), "\", "/");
+
+    locationsPerFile = cell(numel(filePaths), 1);
+    for i = 1:numel(filePaths)
+        relativePath = relativePaths(i);
+        [~, ~, fileExtension] = fileparts(filePaths(i));
+
+        if any(strcmpi(fileExtension, ARCHIVE_EXTENSIONS))
+            isNamed = isNameInArchive(filePaths(i), pattern);
+            locationsPerFile{i} = relativePath(isNamed);
+        else
+            % The file is handled as bytes, one character per byte, because
+            % its encoding is unknown. The namespace name is ASCII, which
+            % every common encoding stores as single bytes.
+            bytes = readBytes(filePaths(i));
+            if any(bytes == 0)
+                isNamed = ~isempty(regexp(char(bytes), pattern, "once"));
+                locationsPerFile{i} = relativePath(isNamed);
+            else
+                isCodeFile = strcmpi(fileExtension, CODE_EXTENSION);
+                lineNumbers = findLinesWithName(char(bytes), pattern, isCodeFile);
+                locationsPerFile{i} = relativePath + ":" + lineNumbers;
+            end
+        end
+    end
+
+    locations = vertcat(strings(0, 1), locationsPerFile{:});
+end
+
+function lineNumbers = findLinesWithName(text, pattern, isCodeFile)
+%findLinesWithName - Get the numbers of the lines of a text that match a pattern
+    % Splitting at the line feed alone also handles Windows line endings,
+    % because the carriage return left at the end of a line cannot be part
+    % of a match.
+    textLines = split(string(text), newline);
+    isNamed = contains(textLines, regexpPattern(pattern));
+
+    % A comment line cannot refer to a namespace at run time, and help text
+    % often names the package it belongs to.
+    if isCodeFile
+        isCommentLine = startsWith(strip(textLines, "left"), "%");
+        isNamed = isNamed & ~isCommentLine;
+    end
+
+    lineNumbers = find(isNamed);
+end
+
+function isNamed = isNameInArchive(filePath, pattern)
+%isNameInArchive - Check whether a file in a zip archive matches a pattern
+    extractionFolder = string(tempname());
+    mkdir(extractionFolder)
+    extractionFolderCleanup = onCleanup(@() rmdir(extractionFolder, "s"));
+
+    extractedPaths = string(unzip(filePath, extractionFolder));
+    extractedPaths = extractedPaths(isfile(extractedPaths));
+
+    isNamed = false;
+    for i = 1:numel(extractedPaths)
+        bytes = readBytes(extractedPaths(i));
+        if ~isempty(regexp(char(bytes), pattern, "once"))
+            isNamed = true;
+            break
+        end
+    end
+end
+
+function bytes = readBytes(filePath)
+%readBytes - Read a file as a row vector of bytes
+    fileId = fopen(filePath, "r");
+    fileCleanup = onCleanup(@() fclose(fileId));
+    bytes = fread(fileId, [1, Inf], "*uint8");
+end
diff --git a/code/+matbox/+tasks/+internal/vendorPackageFromFolder.m b/code/+matbox/+tasks/+internal/vendorPackageFromFolder.m
index a9d09e0..09fef50 100644
--- a/code/+matbox/+tasks/+internal/vendorPackageFromFolder.m
+++ b/code/+matbox/+tasks/+internal/vendorPackageFromFolder.m
@@ -88,8 +88,14 @@
 
     removeExcludedFiles(stagingFolder, options.ExcludeFiles)
 
+    % The search runs before the license file and vendorinfo.json are added,
+    % because both can name the source namespace without referring to it.
     if isRenameNeeded
         renameNamespaceInFolder(stagingFolder, sourceNamespace, targetNamespace)
+        unrenamedLocations = matbox.tasks.internal.findNamespaceReferences( ...
+            stagingFolder, sourceNamespace);
+    else
+        unrenamedLocations = strings(0, 1);
     end
 
     [~, licenseName, licenseExtension] = fileparts(options.LicenseFile);
@@ -109,6 +115,17 @@
     % longer has, which copying over the existing folder would leave behind.
     replaceFolder(targetFolder, stagingFolder)
 
+    % The warning comes after the replacement, so that it is only given for
+    % a copy that is in place.
+    if ~isempty(unrenamedLocations)
+        warning("MatBox:VendorPackage:UnrenamedReferences", ...
+            "References to the namespace ""%s"" in ""%s"" were not renamed " + ...
+            "to ""%s"", so they still resolve to ""%s"". Change them in the " + ...
+            "source repository, or check that they are not namespace " + ...
+            "references:\n%s", sourceNamespace, targetFolder, targetNamespace, ...
+            sourceNamespace, strjoin("    " + unrenamedLocations, newline))
+    end
+
     if nargout < 1
         clear vendorInfo
     end
diff --git a/code/+matbox/+tasks/vendorPackage.m b/code/+matbox/+tasks/vendorPackage.m
index 38d161f..03f48ef 100644
--- a/code/+matbox/+tasks/vendorPackage.m
+++ b/code/+matbox/+tasks/vendorPackage.m
@@ -16,6 +16,14 @@
 %   "webprogress.upload" into "mytoolbox.external.webprogress.upload" in
 %   code, strings and comments. Error identifiers keep the source name.
 %
+%   A namespace name that code builds at run time, such as
+%   "webprogress." + name, is not renamed, and neither is a reference in a
+%   file other than a .m file, such as an .mlx file or
+%   functionSignatures.json. These references still resolve to the source
+%   namespace. The warning MatBox:VendorPackage:UnrenamedReferences lists
+%   the places in the copied files that still name the source namespace,
+%   leaving out comment lines of .m files.
+%
 %   The license file of the repository is copied into targetFolder, and
 %   the file vendorinfo.json there records the repository, the reference,
 %   the commit that was copied, the two namespace names and the excluded
diff --git a/tools/tests/+matboxtools/+unittest/VendorPackageTest.m b/tools/tests/+matboxtools/+unittest/VendorPackageTest.m
index 607825f..b242644 100644
--- a/tools/tests/+matboxtools/+unittest/VendorPackageTest.m
+++ b/tools/tests/+matboxtools/+unittest/VendorPackageTest.m
@@ -46,6 +46,23 @@
             "endOfSentence", "% is in the namespace webprogress. It has", ...
             "alreadyRenamed", "mytoolbox.external.webprogress.upload(a)")
 
+        % A line of code that refers to SourceNamespace in a way that
+        % renameNamespaceInText cannot rename
+        unrenamedReferenceCase = struct( ...
+            "stringConcatenation", "className = ""webprogress."" + name;", ...
+            "fevalCall", "feval(""webprogress."" + functionName, a)", ...
+            "namespaceQuery", "namespaceInfo = meta.package.fromName(""webprogress"");", ...
+            "classNameCheck", "tf = startsWith(class(obj), ""webprogress."");")
+
+        % A line of code that names SourceNamespace in a place that is not
+        % an unrenamed reference
+        ignoredLineCase = struct( ...
+            "renamedReference", "x = mytoolbox.external.webprogress.upload(a);", ...
+            "errorIdentifier", "error(""webprogress:upload:Failed"", ""Failed."")", ...
+            "commentLine", "    % Part of the webprogress toolbox", ...
+            "longerNamespaceName", "webprogresstools.projectdir()", ...
+            "folderPath", "folderPath = fullfile(root, ""src/webprogress"");")
+
         % A folder path followed by the name of the namespace it defines
         namespaceCase = struct( ...
             "singleFolder", ["src/webprogress/+webprogress", "webprogress"], ...
@@ -110,6 +127,82 @@ function testNamespaceNameOfFolder(testCase, namespaceCase)
         end
     end
 
+    methods (Test) % findNamespaceReferences
+        function testUnrenamedReferenceIsFound(testCase, unrenamedReferenceCase)
+            folderPath = fullfile(pwd, "package");
+            writeText(fullfile(folderPath, "code.m"), ...
+                join(["function code(name)", unrenamedReferenceCase, "end"], newline))
+
+            locations = matbox.tasks.internal.findNamespaceReferences( ...
+                folderPath, testCase.SourceNamespace);
+
+            testCase.verifyEqual(locations, "code.m:2")
+        end
+
+        function testIgnoredLineIsNotFound(testCase, ignoredLineCase)
+            folderPath = fullfile(pwd, "package");
+            writeText(fullfile(folderPath, "code.m"), ...
+                join(["function code(name)", ignoredLineCase, "end"], newline))
+
+            locations = matbox.tasks.internal.findNamespaceReferences( ...
+                folderPath, testCase.SourceNamespace);
+
+            testCase.verifyEqual(locations, strings(0, 1))
+        end
+
+        function testNameInJsonFileIsFoundByLine(testCase)
+            folderPath = fullfile(pwd, "package");
+            writeText(fullfile(folderPath, "resources", "functionSignatures.json"), ...
+                testCase.createFunctionSignatures())
+
+            locations = matbox.tasks.internal.findNamespaceReferences( ...
+                folderPath, testCase.SourceNamespace);
+
+            testCase.verifyEqual(locations, "resources/functionSignatures.json:3")
+        end
+
+        function testPlacesInSeveralFilesAreListedInOrder(testCase)
+            folderPath = fullfile(pwd, "package");
+            writeText(fullfile(folderPath, "b.m"), ...
+                join(["x = 1;", "f = ""webprogress."" + a;", "g = ""webprogress."" + b;"], newline))
+            writeText(fullfile(folderPath, "a.m"), "x = 1;")
+            writeText(fullfile(folderPath, "sub", "c.json"), """webprogress.upload""")
+
+            locations = matbox.tasks.internal.findNamespaceReferences( ...
+                folderPath, testCase.SourceNamespace);
+
+            testCase.verifyEqual(locations, ["b.m:2"; "b.m:3"; "sub/c.json:1"])
+        end
+
+        function testNameInLiveScriptIsFoundByFileName(testCase)
+            % A live script is a zip archive that holds its code in the file
+            % matlab/document.xml.
+            contentFolder = fullfile(pwd, "liveScriptContent");
+            writeText(fullfile(contentFolder, "matlab", "document.xml"), ...
+                "<w:t>x = webprogress.upload(a);</w:t>")
+            zip(fullfile(pwd, "demo.zip"), "matlab", contentFolder)
+            folderPath = fullfile(pwd, "package");
+            mkdir(fullfile(folderPath, "examples"))
+            movefile(fullfile(pwd, "demo.zip"), fullfile(folderPath, "examples", "demo.mlx"))
+
+            locations = matbox.tasks.internal.findNamespaceReferences( ...
+                folderPath, testCase.SourceNamespace);
+
+            testCase.verifyEqual(locations, "examples/demo.mlx")
+        end
+
+        function testNameInBinaryFileIsFoundByFileName(testCase)
+            folderPath = fullfile(pwd, "package");
+            writeText(fullfile(folderPath, "data.bin"), ...
+                char(0) + "webprogress.upload" + char(0))
+
+            locations = matbox.tasks.internal.findNamespaceReferences( ...
+                folderPath, testCase.SourceNamespace);
+
+            testCase.verifyEqual(locations, "data.bin")
+        end
+    end
+
     methods (Test) % vendorPackageFromFolder
         function testFilesAreCopiedAndRenamed(testCase)
             repositoryFolder = testCase.createRepository();
@@ -400,6 +493,52 @@ function testBytesOutsideReferencesArePreserved(testCase)
             testCase.verifyEqual(readBytes(fullfile(targetFolder, "scale.m")), ...
                 unicode2native(expectedText, "UTF-8"))
         end
+
+        function testStringBuiltReferenceWarns(testCase)
+            repositoryFolder = testCase.createRepository();
+            writeText(fullfile(repositoryFolder, testCase.SourceFolder, "createMonitor.m"), ...
+                join([
+                    "function monitor = createMonitor(name)"
+                    "    monitor = feval(""webprogress."" + name);"
+                    "end"
+                    ], newline))
+            targetFolder = testCase.getTargetFolder();
+
+            testCase.verifyWarning( ...
+                @() matbox.tasks.internal.vendorPackageFromFolder( ...
+                    repositoryFolder, testCase.SourceFolder, targetFolder), ...
+                "MatBox:VendorPackage:UnrenamedReferences")
+
+            testCase.verifySubstring(lastwarn(), "createMonitor.m:2")
+            testCase.verifyTrue(isfile(fullfile(targetFolder, "createMonitor.m")))
+        end
+
+        function testFunctionSignaturesReferenceWarns(testCase)
+            repositoryFolder = testCase.createRepository();
+            writeText(fullfile(repositoryFolder, testCase.SourceFolder, ...
+                "resources", "functionSignatures.json"), testCase.createFunctionSignatures())
+            targetFolder = testCase.getTargetFolder();
+
+            testCase.verifyWarning( ...
+                @() matbox.tasks.internal.vendorPackageFromFolder( ...
+                    repositoryFolder, testCase.SourceFolder, targetFolder), ...
+                "MatBox:VendorPackage:UnrenamedReferences")
+
+            testCase.verifySubstring(lastwarn(), "resources/functionSignatures.json:3")
+        end
+
+        function testCopyWithoutUnrenamedReferencesDoesNotWarn(testCase)
+            % The license file and vendorinfo.json name the source namespace
+            % without referring to it, and are not searched.
+            repositoryFolder = testCase.createRepository();
+            writeText(fullfile(repositoryFolder, "LICENSE"), ...
+                "Copyright (c) the authors of webprogress")
+            targetFolder = testCase.getTargetFolder();
+
+            testCase.verifyWarningFree( ...
+                @() matbox.tasks.internal.vendorPackageFromFolder( ...
+                    repositoryFolder, testCase.SourceFolder, targetFolder))
+        end
     end
 
     methods (Test) % vendorPackage
@@ -453,6 +592,19 @@ function testVendorFromGitHub(testCase)
                 "function mustBeValidUrl(~), end")
         end
 
+        function signaturesText = createFunctionSignatures(~)
+            % Text of a functionSignatures.json file that names a function
+            % of SourceNamespace on line 3
+            signaturesText = join([
+                "{"
+                "  ""_schemaVersion"": ""1.0.0"","
+                "  ""webprogress.upload"": {"
+                "    ""inputs"": []"
+                "  }"
+                "}"
+                ], newline);
+        end
+
         function targetFolder = getTargetFolder(~)
             % Full path of a folder that defines the namespace TargetNamespace
             targetFolder = string(fullfile(pwd, "project", "src", ...

From 32a1c4bcbbae140bacff1027cb2e71d6461cd45f Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 15 Oct 2026 20:40:03 +0000
Subject: [PATCH 2/2] Update GitHub badges [skip ci]

---
 .github/badges/tests.svg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/badges/tests.svg b/.github/badges/tests.svg
index 828f2d7..445b28b 100644
--- a/.github/badges/tests.svg
+++ b/.github/badges/tests.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="104" height="20" role="img" aria-label="tests: 83 passed"><title>tests: 83 passed</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="104" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="37" height="20" fill="#555"/><rect x="37" width="67" height="20" fill="#67ac09"/><rect width="104" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="195" y="150" fill-opacity=".8" filter="url(#blur)" textLength="270">tests</text><text x="195" y="150" fill-opacity=".3" textLength="270">tests</text></g><text x="195" y="140" textLength="270">tests</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="695" y="150" fill-opacity=".8" filter="url(#blur)" textLength="570">83 passed</text><text x="695" y="150" fill-opacity=".3" textLength="570">83 passed</text></g><text x="695" y="140" textLength="570">83 passed</text></g></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="104" height="20" role="img" aria-label="tests: 99 passed"><title>tests: 99 passed</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="104" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="37" height="20" fill="#555"/><rect x="37" width="67" height="20" fill="#67ac09"/><rect width="104" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="195" y="150" fill-opacity=".8" filter="url(#blur)" textLength="270">tests</text><text x="195" y="150" fill-opacity=".3" textLength="270">tests</text></g><text x="195" y="140" textLength="270">tests</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="695" y="150" fill-opacity=".8" filter="url(#blur)" textLength="570">99 passed</text><text x="695" y="150" fill-opacity=".3" textLength="570">99 passed</text></g><text x="695" y="140" textLength="570">99 passed</text></g></g></svg>