dependabot-cargo 0.380.0 → 0.382.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1068e529e2ddde008e2c74f9d306c7d8ba9864d170d8922160b8da0ce293d940
-  data.tar.gz: 0bd0d7ef4223ffc7066a27325079a32b3bb4303b9e2eb4d45a8ac3fbb17e4a0a
+  metadata.gz: 51d4f61feae4b16e9007ba3a114ca34893d7232eb3786c88b9333917f064db35
+  data.tar.gz: 3ce4da7afe9eb34a9adf4db1a1a6e4f8d9cfe7f77e2ea116eae2c05aedca4341
 SHA512:
-  metadata.gz: d2cddaa59abb1b20ae112a8c60c202d0623b2baf718aef5a3cceeb0f070abb9f39177257b882650909da8ab25aa2f62407167f2e805660c00342b510dbfc08f8
-  data.tar.gz: 1cd491c8ed61d07b5837821911a4acc5d817e29b42974660aec0e5b8b5f9f05a4cbeeccc43d2a5411b560f82c9e35f36e2414836416609c8f4110937aa0ed5ee
+  metadata.gz: 9c2eec9ce3b6ccea662a43c7576ba823ebde9156e36bcb0a5dc36e06b3da125e2caa7961b329e6bed364675249f8b084127c4b1c53b2a1e00a1b6a163cb9c604
+  data.tar.gz: 642f355d2a781ef02157dc33fabde13f5fbedca6ff7ec198a6d7b7575d320796b41c837b245f1d448bc0ea9117b1088fb5a4a38f1b7bde42e31d08e3f25da2f1

data/lib/dependabot/cargo/file_parser.rb

@@ -401,7 +401,7 @@ module Dependabot
 
       sig { params(file: DependencyFile).returns(T.untyped) }
       def parsed_file(file)
-        @parsed_file ||= T.let({}, T.untyped)
+        @parsed_file ||= T.let({}, T.nilable(T::Hash[String, T.untyped]))
         @parsed_file[file.name] ||= TomlRB.parse(file.content)
       rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
         raise Dependabot::DependencyFileNotParseable, file.path

data/lib/dependabot/cargo/file_updater/workspace_manifest_updater.rb

@@ -64,7 +64,7 @@ module Dependabot
           updated_content
         end
 
-        sig { params(requirements: T.nilable(T::Array[T::Hash[Symbol, T.untyped]])).returns(T.nilable(String)) }
+        sig { params(requirements: T.nilable(T::Array[Dependabot::DependencyRequirement])).returns(T.nilable(String)) }
         def find_workspace_requirement(requirements)
           requirements&.find { |r| r[:groups]&.include?("workspace.dependencies") }
                       &.fetch(:requirement)

data/lib/dependabot/cargo/requirement.rb

@@ -50,7 +50,7 @@ module Dependabot
 
       # Parses a pre-commit Rust additional_dependency string.
       # Formats: "package_name:version", "cli:package_name:version"
-      sig { params(dep_string: String).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { params(dep_string: String).returns(T.nilable(T::Hash[Symbol, T.nilable(String)])) }
       def self.parse_dep_string(dep_string)
         stripped = dep_string.strip
         return nil if stripped.empty?

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -15,11 +15,12 @@ module Dependabot
       class VersionResolver # rubocop:disable Metrics/ClassLength
         extend T::Sig
 
-        UNABLE_TO_UPDATE = /Unable to update (?<url>.*?)$/
+        UNABLE_TO_UPDATE = /unable to update (?<url>.*?)$/i
         BRANCH_NOT_FOUND_REGEX = /#{UNABLE_TO_UPDATE}.*to find branch `(?<branch>[^`]+)`/m
         REVSPEC_PATTERN = /revspec '.*' not found/
         OBJECT_PATTERN = /object not found - no match for id \(.*\)/
-        REF_NOT_FOUND_REGEX = /#{UNABLE_TO_UPDATE}.*(#{REVSPEC_PATTERN}|#{OBJECT_PATTERN})/m
+        REVISION_PATTERN = /revision .* not found/
+        REF_NOT_FOUND_REGEX = /#{UNABLE_TO_UPDATE}.*(#{REVSPEC_PATTERN}|#{OBJECT_PATTERN}|#{REVISION_PATTERN})/m
         GIT_REF_NOT_FOUND_REGEX = /Updating git repository `(?<url>[^`]*)`.*fatal: couldn't find remote ref/m
 
         # Note that as of Rust 1.80, git error message handling in the `cargo update` command changed.

data/lib/dependabot/cargo/update_checker.rb

@@ -88,14 +88,16 @@ module Dependabot
         )
       end
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        RequirementsUpdater.new(
-          requirements: dependency.requirements,
-          updated_source: updated_source,
-          target_version: target_version,
-          update_strategy: requirements_update_strategy
-        ).updated_requirements
+        wrap_requirements(
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            updated_source: updated_source,
+            target_version: target_version,
+            update_strategy: requirements_update_strategy
+          ).updated_requirements
+        )
       end
 
       sig { override.returns(T::Boolean) }
@@ -108,8 +110,12 @@ module Dependabot
         # If passed in as an option (in the base class) honour that option
         return @requirements_update_strategy if @requirements_update_strategy
 
-        # Otherwise, widen ranges for libraries and bump versions for apps
-        library? ? RequirementsUpdateStrategy::BumpVersionsIfNecessary : RequirementsUpdateStrategy::BumpVersions
+        # Cargo resolves to the newest compatible version and a bare version is a
+        # caret-equivalent (compatible) requirement, so only raise the requirement
+        # when it doesn't already allow the new version. Avoids needless churn and
+        # MSRV bumps.
+        # https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#caret-requirements
+        RequirementsUpdateStrategy::BumpVersionsIfNecessary
       end
 
       private
@@ -132,13 +138,12 @@ module Dependabot
         # present in other areas
         return unless preferred_resolvable_version
 
-        library? ? latest_version&.to_s : preferred_resolvable_version.to_s
+        # No lockfile: target the latest version. With one: the resolvable version.
+        no_lockfile? ? latest_version&.to_s : preferred_resolvable_version.to_s
       end
 
       sig { returns(T::Boolean) }
-      def library?
-        # If it has a lockfile, treat it as an application. Otherwise treat it
-        # as a library.
+      def no_lockfile?
         dependency_files.none? { |f| f.name == "Cargo.lock" }
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.380.0
+  version: 0.382.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.380.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
 rdoc_options: []
 require_paths:
 - lib