dependabot-cargo 0.326.0 → 0.327.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 65f2f1c55ac562ad6abef01b525db3cbb33619731e81c0a076e3b568534fc113
-  data.tar.gz: b4b855731c6b90017d6a5a8edc77adaded62251983b94ccd0c772733bd5e57dd
+  metadata.gz: 9a1890e4baf2343cc76f92062668b9c4e20e4e3be716ba69fcccbf79158c827d
+  data.tar.gz: 2d99e07be08c7d16413c23a93fa05475aa8958fb32690e8685a9ffa5cd2fc3a0
 SHA512:
-  metadata.gz: 98f0de7da1e05b555a23953c5e3e23253fe62c0a6e9f17e0cc87a0a9c8028cf5d787189bf1436e908922fddb4cf04383fb113c0fae95f487ed40995c6f79a31e
-  data.tar.gz: bf20aa8c3ce3317ebb2588f320400abb6857db6b40dbb61a8e7897722bda77f11a44adb76bdd6319ffb1fcca7b8405c0584111bb7c03d7caa9e52d95c45912b2
+  metadata.gz: 680e6ae440dd0c9e542677b3a362afaddc7ad0a9cec9747f342b0c9f752934ac87784aeb11a1797fa2a19f0620611f4c0cf744a3adbb1d52dbfd2e36698c9385
+  data.tar.gz: 871c65564b60b9d5a3a29a61ec56b86a5b8ddb302b6ac5db11e965fc6eb75272793bb67898ed8fe823ffbf10ff7c9f3fb3dbe361c340cb372145af65becf6f1f

data/lib/dependabot/cargo/file_parser.rb

@@ -121,6 +121,10 @@ module Dependabot
 
           DEPENDENCY_TYPES.each do |type|
             parsed_content.fetch(type, {}).each do |name, requirement|
+              # Skip workspace-inherited dependencies (similar to pnpm catalog)
+              # Only skip if workspace is exactly boolean true
+              next if requirement.is_a?(Hash) && requirement["workspace"] == true
+
               next unless name == name_from_declaration(name, requirement)
               next if lockfile && !version_from_lockfile(name, requirement)
 
@@ -129,6 +133,10 @@ module Dependabot
 
             parsed_content.fetch("target", {}).each do |_, t_details|
               t_details.fetch(type, {}).each do |name, requirement|
+                # Skip workspace-inherited dependencies
+                # Only skip if workspace is exactly boolean true
+                next if requirement.is_a?(Hash) && requirement["workspace"] == true
+
                 next unless name == name_from_declaration(name, requirement)
                 next if lockfile && !version_from_lockfile(name, requirement)
 

data/lib/dependabot/cargo/file_updater/workspace_manifest_updater.rb

@@ -0,0 +1,142 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/cargo/file_updater"
+
+module Dependabot
+  module Cargo
+    class FileUpdater
+      class WorkspaceManifestUpdater
+        extend T::Sig
+
+        sig { params(dependencies: T::Array[Dependabot::Dependency], manifest: Dependabot::DependencyFile).void }
+        def initialize(dependencies:, manifest:)
+          @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
+          @manifest = T.let(manifest, Dependabot::DependencyFile)
+        end
+
+        sig { returns(String) }
+        def updated_manifest_content
+          workspace_deps = dependencies.select { |dep| workspace_dependency?(dep) }
+
+          return T.must(manifest.content) if workspace_deps.empty?
+
+          T.must(workspace_deps.reduce(manifest.content.dup) do |content, dep|
+            update_workspace_dependency(T.must(content), dep)
+          end)
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :manifest
+
+        sig { params(dep: Dependabot::Dependency).returns(T::Boolean) }
+        def workspace_dependency?(dep)
+          dep.requirements.any? { |r| r[:groups]&.include?("workspace.dependencies") }
+        end
+
+        sig { params(content: String, dep: Dependabot::Dependency).returns(String) }
+        def update_workspace_dependency(content, dep)
+          old_req = find_workspace_requirement(dep.previous_requirements)
+          new_req = find_workspace_requirement(dep.requirements)
+
+          return content if old_req == new_req || !old_req || !new_req
+
+          # First try to update in the inline [workspace.dependencies] section
+          workspace_section_regex = /\[workspace\.dependencies\](.*?)(?=\n\[|\n*\z)/m
+
+          updated_content = content.gsub(workspace_section_regex) do |section|
+            update_version_in_section(section, dep.name, old_req, new_req)
+          end
+
+          # If content didn't change, try table header notation [workspace.dependencies.name]
+          if updated_content == content
+            updated_content = update_table_header_notation(content, dep.name, old_req, new_req)
+          end
+
+          updated_content
+        end
+
+        sig { params(requirements: T.nilable(T::Array[T::Hash[Symbol, T.untyped]])).returns(T.nilable(String)) }
+        def find_workspace_requirement(requirements)
+          requirements&.find { |r| r[:groups]&.include?("workspace.dependencies") }
+                      &.fetch(:requirement)
+        end
+
+        sig { params(section: String, dep_name: String, old_req: String, new_req: String).returns(String) }
+        def update_version_in_section(section, dep_name, old_req, new_req)
+          # Try double-quoted version first
+          updated = section.gsub(
+            /^(\s*#{Regexp.escape(dep_name)}\s*=\s*)"#{Regexp.escape(old_req)}"/m,
+            "\\1\"#{new_req}\""
+          )
+          return updated if updated != section
+
+          # Try single-quoted version
+          updated = section.gsub(
+            /^(\s*#{Regexp.escape(dep_name)}\s*=\s*)'#{Regexp.escape(old_req)}'/m,
+            "\\1'#{new_req}'"
+          )
+          return updated if updated != section
+
+          # Try unquoted version
+          updated = section.gsub(
+            /^(\s*#{Regexp.escape(dep_name)}\s*=\s*)#{Regexp.escape(old_req)}(\s|$)/m,
+            "\\1#{new_req}\\2"
+          )
+          return updated if updated != section
+
+          # Try inline table format with double quotes
+          updated = section.gsub(
+            /^(\s*#{Regexp.escape(dep_name)}\s*=\s*\{[^}]*version\s*=\s*)"#{Regexp.escape(old_req)}"/m,
+            "\\1\"#{new_req}\""
+          )
+          return updated if updated != section
+
+          # Try inline table format with single quotes
+          section.gsub(
+            /^(\s*#{Regexp.escape(dep_name)}\s*=\s*\{[^}]*version\s*=\s*)'#{Regexp.escape(old_req)}'/m,
+            "\\1'#{new_req}'"
+          )
+        end
+
+        sig { params(content: String, dep_name: String, old_req: String, new_req: String).returns(String) }
+        def update_table_header_notation(content, dep_name, old_req, new_req)
+          # Match [workspace.dependencies.name] section and its content until next section
+          table_header_regex = /\[workspace\.dependencies\.#{Regexp.escape(dep_name)}\](.*?)(?=\n\[|\n*\z)/m
+
+          content.gsub(table_header_regex) do |section|
+            # Update version = "..." line within this section (double quotes)
+            updated = section.gsub(
+              /^(\s*version\s*=\s*)"#{Regexp.escape(old_req)}"/m,
+              "\\1\"#{new_req}\""
+            )
+
+            # Try single quotes if double quotes didn't match
+            if updated == section
+              updated = section.gsub(
+                /^(\s*version\s*=\s*)'#{Regexp.escape(old_req)}'/m,
+                "\\1'#{new_req}'"
+              )
+            end
+
+            # Also try unquoted version
+            if updated == section
+              updated = section.gsub(
+                /^(\s*version\s*=\s*)#{Regexp.escape(old_req)}(\s|$)/m,
+                "\\1#{new_req}\\2"
+              )
+            end
+
+            updated
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/cargo/file_updater.rb

@@ -16,6 +16,7 @@ module Dependabot
 
       require_relative "file_updater/manifest_updater"
       require_relative "file_updater/lockfile_updater"
+      require_relative "file_updater/workspace_manifest_updater"
 
       sig { override.returns(T::Array[Regexp]) }
       def self.updated_files_regex
@@ -60,10 +61,18 @@ module Dependabot
 
       sig { params(file: Dependabot::DependencyFile).returns(String) }
       def updated_manifest_content(file)
-        ManifestUpdater.new(
-          dependencies: dependencies,
-          manifest: file
-        ).updated_manifest_content
+        # Use workspace updater for root workspace manifests
+        if workspace_root_manifest?(file)
+          WorkspaceManifestUpdater.new(
+            dependencies: dependencies,
+            manifest: file
+          ).updated_manifest_content
+        else
+          ManifestUpdater.new(
+            dependencies: dependencies,
+            manifest: file
+          ).updated_manifest_content
+        end
       end
 
       sig { returns(String) }
@@ -92,6 +101,16 @@ module Dependabot
       def lockfile
         @lockfile ||= T.let(get_original_file("Cargo.lock"), T.nilable(Dependabot::DependencyFile))
       end
+
+      sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
+      def workspace_root_manifest?(file)
+        return false unless file.name == "Cargo.toml"
+
+        parsed_file = TomlRB.parse(file.content)
+        parsed_file.key?("workspace") && parsed_file["workspace"].key?("dependencies")
+      rescue TomlRB::ParseError
+        false
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.326.0
+  version: 0.327.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.326.0
+        version: 0.327.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.326.0
+        version: 0.327.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -247,6 +247,7 @@ files:
 - lib/dependabot/cargo/file_updater.rb
 - lib/dependabot/cargo/file_updater/lockfile_updater.rb
 - lib/dependabot/cargo/file_updater/manifest_updater.rb
+- lib/dependabot/cargo/file_updater/workspace_manifest_updater.rb
 - lib/dependabot/cargo/helpers.rb
 - lib/dependabot/cargo/language.rb
 - lib/dependabot/cargo/metadata_finder.rb
@@ -265,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.326.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.327.0
 rdoc_options: []
 require_paths:
 - lib