dependabot-cargo 0.223.0 → 0.225.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16eda558215c4e6e559914d48c4942996b3222f089c1ad94826dab4e9745d317
-  data.tar.gz: cc4e207ff45f80160c71279b553d7ce55cb25c06cdf2c98a4bdf00e767f31b78
+  metadata.gz: 118b412bc0753ac23bbb3262a1282bd61ab92c3875be0d40a53ad54c017f7574
+  data.tar.gz: 1869aa7718d3a1991aa0165dc301164d6f524508f53e1e9169278d6226b6a4c2
 SHA512:
-  metadata.gz: af328574f254c93809acc12be8a302cee939ff6044721c564ec06ba2a67f219b8a127826692be94667ef2a6f14dc9aae0d6fd6fbf6356062c8f755ef0f40a5d7
-  data.tar.gz: 8ba928f93d0d833dfbdb06f1a8da4807f7278dd88c5eb8fab07a657911144e8d25de8b9b9dbd21d182c2035d6ee23ed34b39b4f38d72f83fb28b2a1733bd5ef8
+  metadata.gz: c2eaaa528770e528d59251615135395c673bba55246f2ea55469ad3066c731d097d8fd0aaa77a782825fcbc2383f31abcb0a979e711ac474eee4aa06addfd122
+  data.tar.gz: 72ad59fe37cd1d7e39ddf1e13d5e64518a55839e2d24dca3655996de0ba8ba123b4490f1c5342fa76a7285f32758e59ef06b18d59756ff488236faf8a04ce206

data/lib/dependabot/cargo/file_fetcher.rb

@@ -152,30 +152,32 @@ module Dependabot
               unfetchable_required_path_deps
       end
 
-      # rubocop:enable Metrics/PerceivedComplexity
+      def collect_path_dependencies_paths(dependencies)
+        paths = []
+        dependencies.each do |_, details|
+          next unless details.is_a?(Hash) && details["path"]
 
+          paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
+        end
+        paths
+      end
+
+      # rubocop:enable Metrics/PerceivedComplexity
       def path_dependency_paths_from_file(file)
         paths = []
 
-        # Paths specified in dependency declaration
+        workspace = parsed_file(file).fetch("workspace", {})
         Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-          parsed_file(file).fetch(type, {}).each do |_, details|
-            next unless details.is_a?(Hash)
-            next unless details["path"]
-
-            paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
-          end
+          # Paths specified in dependency declaration
+          paths += collect_path_dependencies_paths(parsed_file(file).fetch(type, {}))
+          # Paths specified as workspace dependencies in workspace root
+          paths += collect_path_dependencies_paths(workspace.fetch(type, {}))
         end
 
         # Paths specified for target-specific dependencies
         parsed_file(file).fetch("target", {}).each do |_, t_details|
           Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-            t_details.fetch(type, {}).each do |_, details|
-              next unless details.is_a?(Hash)
-              next unless details["path"]
-
-              paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
-            end
+            paths += collect_path_dependencies_paths(t_details.fetch(type, {}))
           end
         end
 
@@ -263,6 +265,16 @@ module Dependabot
           end
         end
 
+        # Paths specified for workspace-wide dependencies
+        workspace = parsed_file(file).fetch("workspace", {})
+        workspace.fetch("dependencies", {}).each do |_, details|
+          next unless details.is_a?(Hash)
+          next unless details["path"]
+          next unless path == File.join(details["path"], "Cargo.toml")
+
+          return true if details["git"].nil?
+        end
+
         # Paths specified as replacements
         parsed_file(file).fetch("replace", {}).each do |_, details|
           next unless details.is_a?(Hash)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.223.0
+  version: 0.225.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -205,7 +205,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.223.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.225.0
 post_install_message: 
 rdoc_options: []
 require_paths: