dependabot-cargo 0.211.0 → 0.213.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fae6b268169748a07ba7e6146f44449ffe941747347146c9a7fe1cd2ddc012dd
-  data.tar.gz: 603161b2ecf08e9fc2b8f4eae70b741ee82f21898ca9a509d93404961921f55a
+  metadata.gz: 21dc0ea4001940fffbf43b581315b2e20337f869b9e8722d824b8d90fe30e37e
+  data.tar.gz: 9bc652359e629859f89b7f834a31f93371f3a30b243c750d76baff85b1f3c91d
 SHA512:
-  metadata.gz: 4d3fed0c16f9b569858726b550b290462d2b26067d328d5d83f7f36ea816272e7d05b0cc319f8c2c2e8d90fc9766890b2ea2f6118bdfdf294c07980c9286f437
-  data.tar.gz: 702b7589feff7dfc914e7eee6a3fd682a4164c3aff7561e04cdd1645cddbd24f60e0d9a817fbea26879a3a1e918a411cde942043a7e6c449ffd4b85a7c5aa8ad
+  metadata.gz: 1387ae679d92f01f1bf8009319f6ebd82db3e2c5bb2edc720ffcabed443be538e50cdf212853e6a593afe8e64bfdef48870925a268bc1ea4769446124a6bcf80
+  data.tar.gz: ceff9213f82e10d6ccb40435bd955c4f988cbf153b256a837dbdca23c100d82d812b5e623a742bfa41e6fb3f1b6fefb915318b623046cfd1ec0b356b1ab1821c

data/lib/dependabot/cargo/file_fetcher.rb

@@ -144,7 +144,7 @@ module Dependabot
             next unless details.is_a?(Hash)
             next unless details["path"]
 
-            paths << File.join(details["path"], "Cargo.toml")
+            paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
           end
         end
 
@@ -155,7 +155,7 @@ module Dependabot
               next unless details.is_a?(Hash)
               next unless details["path"]
 
-              paths << File.join(details["path"], "Cargo.toml")
+              paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
             end
           end
         end

data/lib/dependabot/cargo/file_parser.rb

@@ -46,16 +46,18 @@ module Dependabot
         workspace_root = parsed_file(cargo_toml).dig("package", "workspace")
         return unless workspace_root
 
-        msg = "This project is part of a Rust workspace but is not the "\
-              "workspace root."\
+        msg = "This project is part of a Rust workspace but is not the " \
+              "workspace root." \
 
         if cargo_toml.directory != "/"
-          msg += "Please update your settings so Dependabot points at the "\
+          msg += "Please update your settings so Dependabot points at the " \
                  "workspace root instead of #{cargo_toml.directory}."
         end
         raise Dependabot::DependencyFileNotEvaluatable, msg
       end
 
+      # rubocop:disable Metrics/AbcSize
+      # rubocop:disable Metrics/CyclomaticComplexity
       # rubocop:disable Metrics/PerceivedComplexity
       def manifest_dependencies
         dependency_set = DependencySet.new
@@ -79,10 +81,21 @@ module Dependabot
               end
             end
           end
+
+          workspace = parsed_file(file).fetch("workspace", {})
+          workspace.fetch("dependencies", {}).each do |name, requirement|
+            next unless name == name_from_declaration(name, requirement)
+            next if lockfile && !version_from_lockfile(name, requirement)
+
+            dependency_set <<
+              build_dependency(name, requirement, "workspace.dependencies", file)
+          end
         end
 
         dependency_set
       end
+      # rubocop:enable Metrics/AbcSize
+      # rubocop:enable Metrics/CyclomaticComplexity
       # rubocop:enable Metrics/PerceivedComplexity
 
       def build_dependency(name, requirement, type, file)

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -14,9 +14,9 @@ module Dependabot
         LOCKFILE_ENTRY_REGEX = /
           \[\[package\]\]\n
           (?:(?!^\[(\[package|metadata)).)+
-        /mx.freeze
+        /mx
 
-        LOCKFILE_CHECKSUM_REGEX = /^"checksum .*$/.freeze
+        LOCKFILE_CHECKSUM_REGEX = /^"checksum .*$/
 
         def initialize(dependencies:, dependency_files:, credentials:)
           @dependencies = dependencies

data/lib/dependabot/cargo/metadata_finder.rb

@@ -33,15 +33,14 @@ module Dependabot
       def find_source_from_crates_listing
         potential_source_urls =
           SOURCE_KEYS.
-          map { |key| crates_listing.dig("crate", key) }.
-          compact
+          filter_map { |key| crates_listing.dig("crate", key) }
 
         source_url = potential_source_urls.find { |url| Source.from_url(url) }
         Source.from_url(source_url)
       end
 
       def find_source_from_git_url
-        info = dependency.requirements.map { |r| r[:source] }.compact.first
+        info = dependency.requirements.filter_map { |r| r[:source] }.first
 
         url = info[:url] || info.fetch("url")
         Source.from_url(url)

data/lib/dependabot/cargo/requirement.rb

@@ -16,7 +16,7 @@ module Dependabot
       version_pattern = Cargo::Version::VERSION_PATTERN
 
       PATTERN_RAW = "\\s*(#{quoted})?\\s*(#{version_pattern})\\s*"
-      PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+      PATTERN = /\A#{PATTERN_RAW}\z/
 
       # Use Cargo::Version rather than Gem::Version to ensure that
       # pre-release versions aren't transformed.
@@ -33,7 +33,7 @@ module Dependabot
         [matches[1] || "=", Cargo::Version.new(matches[2])]
       end
 
-      # For consistency with other langauges, we define a requirements array.
+      # For consistency with other languages, we define a requirements array.
       # Rust doesn't have an `OR` separator for requirements, so it always
       # contains a single element.
       def self.requirements_array(requirement_string)

data/lib/dependabot/cargo/update_checker/file_preparer.rb

@@ -206,8 +206,7 @@ module Dependabot
               dependency.version
             else
               version_from_requirement =
-                dependency.requirements.map { |r| r.fetch(:requirement) }.
-                compact.
+                dependency.requirements.filter_map { |r| r.fetch(:requirement) }.
                 flat_map { |req_str| Cargo::Requirement.new(req_str) }.
                 flat_map(&:requirements).
                 reject { |req_array| req_array.first.start_with?("<") }.

data/lib/dependabot/cargo/update_checker/requirements_updater.rb

@@ -16,7 +16,7 @@ module Dependabot
       class RequirementsUpdater
         class UnfixableRequirement < StandardError; end
 
-        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-*]+)*/.freeze
+        VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-*]+)*/
         ALLOWED_UPDATE_STRATEGIES =
           %i(bump_versions bump_versions_if_necessary).freeze
 

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -11,15 +11,12 @@ module Dependabot
   module Cargo
     class UpdateChecker
       class VersionResolver
-        UNABLE_TO_UPDATE =
-          /Unable to update (?<url>.*?)$/.freeze
-        BRANCH_NOT_FOUND_REGEX =
-          /#{UNABLE_TO_UPDATE}.*to find branch `(?<branch>[^`]+)`/m.freeze
-        REVSPEC_PATTERN = /revspec '.*' not found/.freeze
-        OBJECT_PATTERN = /object not found - no match for id \(.*\)/.freeze
-        REF_NOT_FOUND_REGEX =
-          /#{UNABLE_TO_UPDATE}.*(#{REVSPEC_PATTERN}|#{OBJECT_PATTERN})/m.freeze
-        GIT_REF_NOT_FOUND_REGEX = /Updating git repository `(?<url>[^`]*)`.*fatal: couldn't find remote ref/m.freeze
+        UNABLE_TO_UPDATE = /Unable to update (?<url>.*?)$/
+        BRANCH_NOT_FOUND_REGEX = /#{UNABLE_TO_UPDATE}.*to find branch `(?<branch>[^`]+)`/m
+        REVSPEC_PATTERN = /revspec '.*' not found/
+        OBJECT_PATTERN = /object not found - no match for id \(.*\)/
+        REF_NOT_FOUND_REGEX = /#{UNABLE_TO_UPDATE}.*(#{REVSPEC_PATTERN}|#{OBJECT_PATTERN})/m
+        GIT_REF_NOT_FOUND_REGEX = /Updating git repository `(?<url>[^`]*)`.*fatal: couldn't find remote ref/m
 
         def initialize(dependency:, credentials:,
                        original_dependency_files:, prepared_dependency_files:)
@@ -168,11 +165,11 @@ module Dependabot
                        max_by { |f| f.name.length }
           return unless TomlRB.parse(cargo_toml.content)["workspace"]
 
-          msg = "This project is part of a Rust workspace but is not the "\
-                "workspace root."\
+          msg = "This project is part of a Rust workspace but is not the " \
+                "workspace root." \
 
           if cargo_toml.directory != "/"
-            msg += "Please update your settings so Dependabot points at the "\
+            msg += "Please update your settings so Dependabot points at the " \
                    "workspace root instead of #{cargo_toml.directory}."
           end
           raise Dependabot::DependencyFileNotResolvable, msg
@@ -188,6 +185,7 @@ module Dependabot
           end
 
           if error.message.include?("authenticate when downloading repo") ||
+             # TODO: stop catching this 200 error: https://github.com/dependabot/dependabot-core/pull/5332#discussion_r936888624
              error.message.include?("HTTP 200 response: got 401") ||
              error.message.include?("fatal: Authentication failed for")
             # Check all dependencies for reachability (so that we raise a

data/lib/dependabot/cargo/version.rb

@@ -13,7 +13,7 @@ module Dependabot
       VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' \
                         '(-[0-9A-Za-z-]+(\.[0-9a-zA-Z-]+)*)?' \
                         '(\+[0-9a-zA-Z]+(\.[0-9a-zA-Z]+)*)?'
-      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze
+      ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/
 
       def initialize(version)
         @version_string = version.to_s

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.211.0
+  version: 0.213.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-23 00:00:00.000000000 Z
+date: 2022-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,42 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.0
+        version: 0.213.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.211.0
-- !ruby/object:Gem::Dependency
-  name: debase
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.2.3
-- !ruby/object:Gem::Dependency
-  name: debase-ruby_core_source
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.10.16
+        version: 0.213.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.1
+        version: 3.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.1
+        version: 3.13.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,28 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.35.1
+        version: 1.37.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.35.1
+        version: 1.37.1
 - !ruby/object:Gem::Dependency
-  name: ruby-debug-ide
+  name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
+        version: 1.15.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -267,14 +239,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.1.0
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Rust (Cargo) support for dependabot