dependabot-cargo 0.222.0 → 0.224.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 715507593b7ecb3be2af0847a4b9cc9422b6e78a200148160249cb72df824738
-  data.tar.gz: 19a64fc691e3d6f2f13a0a7574d056243ceab93d96383dd0c354348f554244a1
+  metadata.gz: 40da4ff75944a40a942ec497e3399a0e14358e4097930868053b6b667824f9de
+  data.tar.gz: 25cc4cc1572467a4efc612fda4848d641e6b7b761c75efef1eb43fd3ee9b0131
 SHA512:
-  metadata.gz: c45ffb3a7e946eb0483a1f898b40d0c343208428521d7e389dfe502485308b009b6765eb1133dcb7b60a1ae00622ae30dc6cdb4b7e90c5e64798a32a678fe836
-  data.tar.gz: c16f21fd4d03be5370105bd3669bdd320c5e3ace3aa9521e81dcc66c8c554c4bdc2f522eb1b1be641f4215b657e38100e4038d266a37d2421d3f2a92470fb04b
+  metadata.gz: be0c11ba56cc69fea40d2fdc2cb73170e223ad42c73e792523ad2d9c7553f36234fe157b5e38cb6282369b920b10d2d71501703d26f1cac75905a263095721e9
+  data.tar.gz: fed053f592e5323a06ed35c19f85dd509f5fb43a2353e24ecf309689538a724d1a7251993a49550e9081786628753ab66e19d2e5135985e56d90920d1a0a0e4f

data/lib/dependabot/cargo/file_fetcher.rb

@@ -152,30 +152,32 @@ module Dependabot
               unfetchable_required_path_deps
       end
 
-      # rubocop:enable Metrics/PerceivedComplexity
+      def collect_path_dependencies_paths(dependencies)
+        paths = []
+        dependencies.each do |_, details|
+          next unless details.is_a?(Hash) && details["path"]
 
+          paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
+        end
+        paths
+      end
+
+      # rubocop:enable Metrics/PerceivedComplexity
       def path_dependency_paths_from_file(file)
         paths = []
 
-        # Paths specified in dependency declaration
+        workspace = parsed_file(file).fetch("workspace", {})
         Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-          parsed_file(file).fetch(type, {}).each do |_, details|
-            next unless details.is_a?(Hash)
-            next unless details["path"]
-
-            paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
-          end
+          # Paths specified in dependency declaration
+          paths += collect_path_dependencies_paths(parsed_file(file).fetch(type, {}))
+          # Paths specified as workspace dependencies in workspace root
+          paths += collect_path_dependencies_paths(workspace.fetch(type, {}))
         end
 
         # Paths specified for target-specific dependencies
         parsed_file(file).fetch("target", {}).each do |_, t_details|
           Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-            t_details.fetch(type, {}).each do |_, details|
-              next unless details.is_a?(Hash)
-              next unless details["path"]
-
-              paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
-            end
+            paths += collect_path_dependencies_paths(t_details.fetch(type, {}))
           end
         end
 
@@ -263,6 +265,16 @@ module Dependabot
           end
         end
 
+        # Paths specified for workspace-wide dependencies
+        workspace = parsed_file(file).fetch("workspace", {})
+        workspace.fetch("dependencies", {}).each do |_, details|
+          next unless details.is_a?(Hash)
+          next unless details["path"]
+          next unless path == File.join(details["path"], "Cargo.toml")
+
+          return true if details["git"].nil?
+        end
+
         # Paths specified as replacements
         parsed_file(file).fetch("replace", {}).each do |_, details|
           next unless details.is_a?(Hash)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.222.0
+  version: 0.224.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.222.0
+        version: 0.224.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.222.0
+        version: 0.224.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -205,7 +205,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.222.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.224.0
 post_install_message: 
 rdoc_options: []
 require_paths: