dependabot-cargo 0.294.0 → 0.295.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b6ed976e24a85e9cd933a8c538094b113ae04d563da43791e1ddee48953b9b6
-  data.tar.gz: 21378086bb4d76a1f29813a92f49e62454553b38083ca844d6dca9b49c38cfa7
+  metadata.gz: 8d8d60326aaa07cd4c2277ed890b428455c431d6e6b9b9b2a962e37b459ae760
+  data.tar.gz: 3f9c01be834ca6283783b1fa58aac8c45f5024af5e50f31f131d9bfc0efbdff9
 SHA512:
-  metadata.gz: e04dc2211725c9cfcad7574baf16e09a2e1014be6f8514c61f15e5afb63ba45c93ac2b65111bba1e18c5090db28d9e5a290f20ba6ebe584e9f6106503e288114
-  data.tar.gz: 5d32a88b85767e345f9df5d0fe01266347b9c94b869f96e0143a8bf2e69e78e5748e7690467dd2d9b0bda9e3099ee0b57d3388ec1342ce6d567f382717a33981
+  metadata.gz: b89e3144b1d19fd585d4124489084ac9eaf568644aa57667ed078344577fe29fe25263d4417213c0651276b3838e758f5ecb7a4b02a3ab2d9d14da6fbdbb5bbf
+  data.tar.gz: f83a7fc9b3ec23b551d266ea90899dbed41257e1bc6e8aa4dce5d0b73f0e0d54412be9cbe3f874d11da690a90bda91366c5aa44d555d0f2f73143842a54bec4a

data/lib/dependabot/cargo/file_fetcher.rb

@@ -146,7 +146,13 @@ module Dependabot
                 file: fetched_file,
                 previously_fetched_files: previously_fetched_files
               )
-            [fetched_file, *grandchild_requirement_files]
+
+            # If this path dependency file is a workspace member that inherits from
+            # its root workspace, we search for the root to include it so Cargo can
+            # resolve the path dependency file manifest properly.
+            root = find_workspace_root(fetched_file) if workspace_member?(parsed_file(fetched_file))
+
+            [fetched_file, *grandchild_requirement_files, root]
           rescue Dependabot::DependencyFileNotFound
             next unless required_path?(file, path)
 
@@ -218,6 +224,59 @@ module Dependabot
         paths
       end
 
+      # See if this Cargo manifest inherits any property from a workspace
+      # (e.g. edition = { workspace = true }).
+      def workspace_member?(hash)
+        hash.each do |key, value|
+          if key == "workspace" && value == true
+            return true
+          elsif value.is_a?(Hash)
+            return workspace_member?(value)
+          end
+        end
+        false
+      end
+
+      # Find workspace root of this workspace member, first via package.workspace
+      # manifest key if present, otherwise resort to searching parent directories
+      # up till the repository root.
+      sig do
+        params(workspace_member: Dependabot::DependencyFile).returns(T.nilable(Dependabot::DependencyFile))
+      end
+      def find_workspace_root(workspace_member)
+        current_dir = workspace_member.name.rpartition("/").first
+
+        workspace_root_dir = parsed_file(workspace_member).dig("package", "workspace")
+        unless workspace_root_dir.nil?
+          workspace_root = fetch_file_from_host(
+            File.join(current_dir, workspace_root_dir, "Cargo.toml"),
+            fetch_submodules: true
+          )
+          return workspace_root if parsed_file(workspace_root)["workspace"]
+
+          # To avoid accidentally breaking backward compatibility, we don't throw errors
+          return nil
+        end
+
+        parent_dirs = current_dir.scan("/").length
+        while parent_dirs >= 0
+          current_dir = File.join(current_dir, "..")
+          begin
+            parent_manifest = fetch_file_from_host(
+              File.join(current_dir, "Cargo.toml"),
+              fetch_submodules: true
+            )
+            return parent_manifest if parsed_file(parent_manifest)["workspace"]
+          rescue Dependabot::DependencyFileNotFound
+            # Cargo.toml not found in this parent, keep searching up
+          end
+          parent_dirs -= 1
+        end
+
+        # To avoid accidentally breaking backward compatibility, we don't throw errors
+        nil
+      end
+
       def workspace_dependency_paths_from_file(file)
         if parsed_file(file)["workspace"] &&
            !parsed_file(file)["workspace"].key?("members")

data/lib/dependabot/cargo/helpers.rb

@@ -21,10 +21,12 @@ module Dependabot
 
           token = "placeholder_token"
           if cred["token"].nil?
-            puts "Setting #{token_env_var} to 'placeholder_token' because dependabot-cli proxy will override it anyway"
+            Dependabot.logger.info("No token found for #{cred['registry']}, dependabot-cli proxy will inject it")
           else
             token = cred["token"]
-            puts "Setting #{token_env_var} to provided token value"
+            Dependabot.logger.info(
+              "Token found for #{cred['registry']}, setting #{token_env_var} to provided token value"
+            )
           end
 
           ENV[token_env_var] ||= token

data/lib/dependabot/cargo/update_checker/latest_version_finder.rb

@@ -118,7 +118,7 @@ module Dependabot
           url = metadata_fetch_url(dependency, index)
 
           # B4PR
-          puts "Calling #{url} to fetch metadata for #{dependency.name} from #{index}"
+          Dependabot.logger.info("Calling #{url} to fetch metadata for #{dependency.name} from #{index}")
 
           response = fetch_response(url, hdrs)
           return {} if response.status == 404
@@ -126,8 +126,7 @@ module Dependabot
           @crates_listing = parse_response(response, index)
 
           # B4PR
-          puts "Fetched metadata for #{dependency.name} from #{index} successfully"
-          puts response.body
+          Dependabot.logger.info("Fetched metadata for #{dependency.name} from #{index} successfully")
 
           @crates_listing
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.294.0
+  version: 0.295.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-23 00:00:00.000000000 Z
+date: 2025-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.294.0
+        version: 0.295.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.294.0
+        version: 0.295.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -265,7 +265,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.294.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.295.0
 post_install_message:
 rdoc_options: []
 require_paths: