dependabot-cargo 0.216.2 → 0.218.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6798a7c2314ff0c4bf5e4e875511cc1d1779eeaaf21dfcc35e9dabc79b7b90d9
-  data.tar.gz: a81064eaadfc1e519500ecd7b2f6fbfbe444c6a31c7d5745d23de13d915d5274
+  metadata.gz: 2c83798b8a90a4313601ee5f327fa0dd66484a043db61ad3c57aa86426271595
+  data.tar.gz: 49a71d28c9286c8e2f24bfd26b18ee56d43c42c3a13acaf03035e2d4d44bf674
 SHA512:
-  metadata.gz: f4afefbd0e342378d74a661d0463134f2c7cebca3a02ca1272b6baf3407af5c8fd83af5d4426fc66a1335d1ad0f60587de9b4d870144c51bacf88e88860ca369
-  data.tar.gz: 39dc999fc8bf9eb051644f0fcce8164fca0d1b21e3c1d46b9652cf3dd69abf367cd27f5f9288cfc2b574346a8f1732db582d4651d837eca7cad19e24996e87e6
+  metadata.gz: b7d18918a78419993518c36bbe58ced8fdc0a63bc770cf4f76861dd481d03019506c26594bd888440a8c0e56d5435abfd6ee012dfc7f3bd15afc7ac3c43c8ef9
+  data.tar.gz: 83cbb618d7d6bbc1c6af007e5f5d90e4a30a257820adad8e9c08eb8cbdaca569321c9bdd0e1e01eb115115e1576b803750b48ed1a9d562a3417dbadd9300c072

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -149,6 +149,15 @@ module Dependabot
             raise Dependabot::DependencyFileNotEvaluatable, "Dependabot only supports toolchain 1.68 and up."
           end
 
+          # package doesn't exist in the index
+          if (match = stdout.match(/no matching package named `([^`]+)` found/))
+            raise Dependabot::DependencyFileNotResolvable, match[1]
+          end
+
+          if (match = /error: no matching package found\nsearched package name: `([^`]+)`/m.match(stdout))
+            raise Dependabot::DependencyFileNotResolvable, match[1]
+          end
+
           raise SharedHelpers::HelperSubprocessFailed.new(
             message: stdout,
             error_context: {

data/lib/dependabot/cargo/update_checker/requirements_updater.rb

@@ -18,7 +18,7 @@ module Dependabot
 
         VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-*]+)*/
         ALLOWED_UPDATE_STRATEGIES =
-          %i(bump_versions bump_versions_if_necessary).freeze
+          %i(lockfile_only bump_versions bump_versions_if_necessary).freeze
 
         def initialize(requirements:, updated_source:, update_strategy:,
                        target_version:)
@@ -34,6 +34,8 @@ module Dependabot
         end
 
         def updated_requirements
+          return requirements if update_strategy == :lockfile_only
+
           # NOTE: Order is important here. The FileUpdater needs the updated
           # requirement at index `i` to correspond to the previous requirement
           # at the same index.

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -237,6 +237,10 @@ module Dependabot
             return nil
           end
 
+          if error.message.include?("usage of sparse registries requires `-Z sparse-registry`")
+            raise Dependabot::DependencyFileNotEvaluatable, "Dependabot only supports toolchain 1.68 and up."
+          end
+
           raise Dependabot::DependencyFileNotResolvable, error.message if resolvability_error?(error.message)
 
           raise error

data/lib/dependabot/cargo/update_checker.rb

@@ -75,7 +75,15 @@ module Dependabot
         ).updated_requirements
       end
 
+      def requirements_unlocked_or_can_be?
+        requirements_update_strategy != :lockfile_only
+      end
+
       def requirements_update_strategy
+        # If passed in as an option (in the base class) honour that option
+        return @requirements_update_strategy.to_sym if @requirements_update_strategy
+
+        # Otherwise, widen ranges for libraries and bump versions for apps
         library? ? :bump_versions_if_necessary : :bump_versions
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.216.2
+  version: 0.218.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-20 00:00:00.000000000 Z
+date: 2023-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.216.2
+        version: 0.218.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.216.2
+        version: 0.218.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -232,8 +232,8 @@ homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - Nonstandard
 metadata:
-  issue_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.218.0
 post_install_message: 
 rdoc_options: []
 require_paths: