dependabot-cargo 0.384.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce6cbf95fb2a0787ae301e7c335ee65cc944996b5219eaba62874cdff315ffe4
-  data.tar.gz: 7b359e82973b40e2fc92e2c53e8c7eb9928ba1bded71a1e283849b4d91f7ffc5
+  metadata.gz: 342398b3a35a615f1b23ae103f2a61e3c11ab24fb92b2eb3f6227b68cdae6600
+  data.tar.gz: a087cc721a765e9b8fd424a6972e1f110895947e36048906832a6f7acc59baed
 SHA512:
-  metadata.gz: cee18fdefcd2ec3d06a882b08ab5f19da946e83eb38133e3a94273078baf2a460514a8e7e65281ae4d193a3643920e44f23eca9b3b4cddfef6a66ca174b730d1
-  data.tar.gz: 1dbadf2bbad402e5862d30e81e89e4add62dce33e7e59661d9330d55b49a8b390db34a96b26c205a346e7a56e3ff643c1ed2095714033904c5dde157a176ab54
+  metadata.gz: 236e947dcc2a2a2674432ac934826740dd42591dd0568211059e11bc79d5f3875c70f63aedab2f03f5351170e3d2a9dd7537385e2c3fd240f5c02621a4624973
+  data.tar.gz: affa0255ca4605212a1a233cc636893532aa5b5743d94fd4a1fb1d75e70bc52ce36fb245c92cd19e5c13787906702137be32492cbc5b08327bb19875ff7ecfe0

data/lib/dependabot/cargo/file_fetcher.rb

@@ -28,7 +28,7 @@ module Dependabot
         "Repo must contain a Cargo.toml."
       end
 
-      sig { override.returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { override.returns(T.nilable(T::Hash[Symbol, T.anything])) }
       def ecosystem_versions
         channel = if rust_toolchain
                     TomlRB.parse(T.must(rust_toolchain).content).dig("toolchain", "channel")
@@ -47,7 +47,7 @@ module Dependabot
       def fetch_files
         fetched_files = T.let([cargo_toml], T::Array[DependencyFile])
         fetched_files << T.must(cargo_lock) if cargo_lock
-        fetched_files << T.must(cargo_config) if cargo_config
+        fetched_files.concat(cargo_configs)
         fetched_files << T.must(rust_toolchain) if rust_toolchain
         fetched_files += fetch_path_dependency_and_workspace_files
         parsed_manifest = parsed_file(cargo_toml)
@@ -180,12 +180,14 @@ module Dependabot
         find_workspace_root(file)
       end
 
-      sig { params(dependencies: T::Hash[T.untyped, T.untyped]).returns(T::Array[String]) }
+      sig { params(dependencies: T::Hash[String, T.anything]).returns(T::Array[String]) }
       def collect_path_dependencies_paths(dependencies)
         dependencies.filter_map do |_, details|
-          next unless details.is_a?(Hash) && details["path"]
+          details = toml_table(details)
+          path = T.cast(details&.fetch("path", nil), T.nilable(String))
+          next unless path
 
-          File.join(details["path"], "Cargo.toml").delete_prefix("/")
+          File.join(path, "Cargo.toml").delete_prefix("/")
         end
       end
 
@@ -194,18 +196,19 @@ module Dependabot
       def path_dependency_paths_from_file(file)
         paths = T.let([], T::Array[String])
 
-        workspace = parsed_file(file).fetch("workspace", {})
+        workspace = toml_table_or_empty(parsed_file(file).fetch("workspace", {}))
         Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
           # Paths specified in dependency declaration
-          paths += collect_path_dependencies_paths(parsed_file(file).fetch(type, {}))
+          paths += collect_path_dependencies_paths(toml_table_or_empty(parsed_file(file).fetch(type, {})))
           # Paths specified as workspace dependencies in workspace root
-          paths += collect_path_dependencies_paths(workspace.fetch(type, {}))
+          paths += collect_path_dependencies_paths(toml_table_or_empty(workspace.fetch(type, {})))
         end
 
         # Paths specified for target-specific dependencies
-        parsed_file(file).fetch("target", {}).each do |_, t_details|
+        toml_table_or_empty(parsed_file(file).fetch("target", {})).each do |_, t_details|
+          t_details = toml_table_or_empty(t_details)
           Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-            paths += collect_path_dependencies_paths(t_details.fetch(type, {}))
+            paths += collect_path_dependencies_paths(toml_table_or_empty(t_details.fetch(type, {})))
           end
         end
 
@@ -217,20 +220,25 @@ module Dependabot
         paths = []
 
         # Paths specified as replacements
-        parsed_file(file).fetch("replace", {}).each do |_, details|
-          next unless details.is_a?(Hash) && details["path"]
+        toml_table_or_empty(parsed_file(file).fetch("replace", {})).each do |_, details|
+          details = toml_table(details)
+          path = T.cast(details&.fetch("path", nil), T.nilable(String))
+          next unless path
 
-          paths << File.join(details["path"], "Cargo.toml")
+          paths << File.join(path, "Cargo.toml")
         end
 
         # Paths specified as patches
-        parsed_file(file).fetch("patch", {}).each do |_, details|
-          next unless details.is_a?(Hash)
+        toml_table_or_empty(parsed_file(file).fetch("patch", {})).each do |_, details|
+          details = toml_table(details)
+          next unless details
 
           details.each do |_, dep_details|
-            next unless dep_details.is_a?(Hash) && dep_details["path"]
+            dep_details = toml_table(dep_details)
+            path = T.cast(dep_details&.fetch("path", nil), T.nilable(String))
+            next unless path
 
-            paths << File.join(dep_details["path"], "Cargo.toml")
+            paths << File.join(path, "Cargo.toml")
           end
         end
 
@@ -239,28 +247,31 @@ module Dependabot
 
       # Check if this Cargo manifest uses workspace dependencies
       # (e.g. dependency = { workspace = true }).
-      sig { params(parsed_manifest: T::Hash[T.untyped, T.untyped]).returns(T::Boolean) }
+      sig { params(parsed_manifest: T::Hash[String, T.anything]).returns(T::Boolean) }
       def uses_workspace_dependencies?(parsed_manifest)
         # Check regular dependencies
         workspace_deps = Cargo::FileParser::DEPENDENCY_TYPES.any? do |type|
-          deps = parsed_manifest.fetch(type, {})
+          deps = toml_table_or_empty(parsed_manifest.fetch(type, {}))
           deps.any? do |_, details|
-            next false unless details.is_a?(Hash)
+            details = toml_table(details)
+            next false unless details
 
-            details["workspace"] == true
+            T.cast(details["workspace"], T.nilable(Object)) == true
           end
         end
 
         return true if workspace_deps
 
         # Check target-specific dependencies
-        parsed_manifest.fetch("target", {}).any? do |_, target_details|
+        toml_table_or_empty(parsed_manifest.fetch("target", {})).any? do |_, target_details|
+          target_details = toml_table_or_empty(target_details)
           Cargo::FileParser::DEPENDENCY_TYPES.any? do |type|
-            deps = target_details.fetch(type, {})
+            deps = toml_table_or_empty(target_details.fetch(type, {}))
             deps.any? do |_, details|
-              next false unless details.is_a?(Hash)
+              details = toml_table(details)
+              next false unless details
 
-              details["workspace"] == true
+              T.cast(details["workspace"], T.nilable(Object)) == true
             end
           end
         end
@@ -268,13 +279,14 @@ module Dependabot
 
       # See if this Cargo manifest inherits any property from a workspace
       # (e.g. edition = { workspace = true }).
-      sig { params(hash: T::Hash[T.untyped, T.untyped]).returns(T::Boolean) }
+      sig { params(hash: T::Hash[String, T.anything]).returns(T::Boolean) }
       def workspace_member?(hash)
         hash.each do |key, value|
+          value = T.cast(value, T.nilable(Object))
           if key == "workspace" && value == true
             return true
           elsif value.is_a?(Hash)
-            return workspace_member?(value)
+            return workspace_member?(toml_table_or_empty(value))
           end
         end
         false
@@ -289,7 +301,8 @@ module Dependabot
       def find_workspace_root(workspace_member)
         current_dir = workspace_member.name.rpartition("/").first
 
-        workspace_root_dir = parsed_file(workspace_member).dig("package", "workspace")
+        package = toml_table_or_empty(parsed_file(workspace_member)["package"])
+        workspace_root_dir = T.cast(package["workspace"], T.nilable(String))
         unless workspace_root_dir.nil?
           workspace_root = fetch_file_from_host(
             File.join(current_dir, workspace_root_dir, "Cargo.toml"),
@@ -322,11 +335,10 @@ module Dependabot
 
       sig { params(file: Dependabot::DependencyFile).returns(T::Array[String]) }
       def workspace_dependency_paths_from_file(file)
-        if parsed_file(file)["workspace"] && !parsed_file(file)["workspace"].key?("members")
-          return path_dependency_paths_from_file(file)
-        end
+        workspace = toml_table(parsed_file(file)["workspace"])
+        return path_dependency_paths_from_file(file) if workspace && !workspace.key?("members")
 
-        workspace_paths = parsed_file(file).dig("workspace", "members")
+        workspace_paths = T.cast(workspace&.fetch("members", nil), T.nilable(T::Array[String]))
         return [] unless workspace_paths&.any?
 
         # Expand any workspace paths that specify a `*`
@@ -335,9 +347,7 @@ module Dependabot
         end
 
         # Excluded paths, to be subtracted for the workspaces array
-        excluded_paths =
-          (parsed_file(file).dig("workspace", "excluded_paths") || []) +
-          (parsed_file(file).dig("workspace", "exclude") || [])
+        excluded_paths = workspace_excluded_paths(workspace)
 
         (workspace_paths - excluded_paths).map do |path|
           File.join(path, "Cargo.toml")
@@ -346,59 +356,40 @@ module Dependabot
 
       # Check whether a path is required or not. It will not be required if
       # an alternative source (i.e., a git source) is also specified
-      # rubocop:disable Metrics/CyclomaticComplexity
       # rubocop:disable Metrics/PerceivedComplexity
-      # rubocop:disable Metrics/AbcSize
       sig { params(file: Dependabot::DependencyFile, path: String).returns(T::Boolean) }
       def required_path?(file, path)
         # Paths specified in dependency declaration
         Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-          parsed_file(file).fetch(type, {}).each do |_, details|
-            next unless details.is_a?(Hash)
-            next unless details["path"]
-            next unless path == File.join(details["path"], "Cargo.toml")
-
-            return true if details["git"].nil?
+          toml_table_or_empty(parsed_file(file).fetch(type, {})).each do |_, details|
+            return true if required_dependency_details?(details, path)
           end
         end
 
         # Paths specified for target-specific dependencies
-        parsed_file(file).fetch("target", {}).each do |_, t_details|
+        toml_table_or_empty(parsed_file(file).fetch("target", {})).each do |_, t_details|
+          t_details = toml_table_or_empty(t_details)
           Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-            t_details.fetch(type, {}).each do |_, details|
-              next unless details.is_a?(Hash)
-              next unless details["path"]
-              next unless path == File.join(details["path"], "Cargo.toml")
-
-              return true if details["git"].nil?
+            toml_table_or_empty(t_details.fetch(type, {})).each do |_, details|
+              return true if required_dependency_details?(details, path)
             end
           end
         end
 
         # Paths specified for workspace-wide dependencies
-        workspace = parsed_file(file).fetch("workspace", {})
-        workspace.fetch("dependencies", {}).each do |_, details|
-          next unless details.is_a?(Hash)
-          next unless details["path"]
-          next unless path == File.join(details["path"], "Cargo.toml")
-
-          return true if details["git"].nil?
+        workspace = toml_table_or_empty(parsed_file(file).fetch("workspace", {}))
+        toml_table_or_empty(workspace.fetch("dependencies", {})).each do |_, details|
+          return true if required_dependency_details?(details, path)
         end
 
         # Paths specified as replacements
-        parsed_file(file).fetch("replace", {}).each do |_, details|
-          next unless details.is_a?(Hash)
-          next unless details["path"]
-          next unless path == File.join(details["path"], "Cargo.toml")
-
-          return true if details["git"].nil?
+        toml_table_or_empty(parsed_file(file).fetch("replace", {})).each do |_, details|
+          return true if required_dependency_details?(details, path)
         end
 
         false
       end
-      # rubocop:enable Metrics/AbcSize
       # rubocop:enable Metrics/PerceivedComplexity
-      # rubocop:enable Metrics/CyclomaticComplexity
 
       sig { params(path: String).returns(T::Array[String]) }
       def expand_workspaces(path)
@@ -411,13 +402,44 @@ module Dependabot
           .select { |filename| File.fnmatch?(path, filename) }
       end
 
-      sig { params(file: Dependabot::DependencyFile).returns(T::Hash[T.untyped, T.untyped]) }
+      sig { params(file: Dependabot::DependencyFile).returns(T::Hash[String, T.anything]) }
       def parsed_file(file)
         TomlRB.parse(file.content)
       rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
         raise Dependabot::DependencyFileNotParseable, file.path
       end
 
+      sig { params(workspace: T.nilable(T::Hash[String, T.anything])).returns(T::Array[String]) }
+      def workspace_excluded_paths(workspace)
+        (T.cast(workspace&.fetch("excluded_paths", nil), T.nilable(T::Array[String])) || []) +
+          (T.cast(workspace&.fetch("exclude", nil), T.nilable(T::Array[String])) || [])
+      end
+
+      sig { params(details: T.anything, path: String).returns(T::Boolean) }
+      def required_dependency_details?(details, path)
+        details = toml_table(details)
+        dependency_path = T.cast(details&.fetch("path", nil), T.nilable(String))
+        return false unless details && dependency_path
+        return false unless path == File.join(dependency_path, "Cargo.toml")
+
+        T.cast(details["git"], T.nilable(Object)).nil?
+      end
+
+      # Returns the value as a TOML table (Hash) when it is one, otherwise nil.
+      # TOML dependency values are polymorphic (e.g. `foo = "1.0"` is a String
+      # while `foo = { version = "1.0" }` is a table), so callers must narrow at
+      # runtime rather than assert a type with T.cast (which would raise).
+      sig { params(value: T.anything).returns(T.nilable(T::Hash[String, T.anything])) }
+      def toml_table(value)
+        obj = T.cast(value, T.nilable(Object))
+        obj.is_a?(Hash) ? obj : nil
+      end
+
+      sig { params(value: T.anything).returns(T::Hash[String, T.anything]) }
+      def toml_table_or_empty(value)
+        toml_table(value) || {}
+      end
+
       sig { returns(Dependabot::DependencyFile) }
       def cargo_toml
         @cargo_toml ||= T.let(fetch_file_from_host("Cargo.toml"), T.nilable(Dependabot::DependencyFile))
@@ -428,19 +450,53 @@ module Dependabot
         @cargo_lock ||= T.let(fetch_file_if_present("Cargo.lock"), T.nilable(Dependabot::DependencyFile))
       end
 
+      # Cargo merges configuration hierarchically: it reads `.cargo/config.toml`
+      # from the package directory *and* every ancestor directory up to the repo
+      # root, combining them. We therefore collect all of them so that registries
+      # (and other settings) defined higher up the tree are not dropped.
+      #
+      # The package-directory config keeps the canonical name `.cargo/config.toml`
+      # (single-config consumers rely on this). Ancestor configs keep their
+      # relative `../` paths so they are written to the correct location and can
+      # be merged by Cargo. When the package directory has no config of its own,
+      # the nearest ancestor is promoted to the canonical name to preserve the
+      # historical behaviour that downstream consumers depend on.
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def cargo_configs
+        return T.must(@cargo_configs) if defined?(@cargo_configs)
+
+        configs = T.let([], T::Array[Dependabot::DependencyFile])
+        local = local_cargo_config
+        parents = parent_dir_cargo_configs
+
+        if local
+          configs << local
+          configs.concat(parents)
+        elsif parents.any?
+          effective = T.must(parents.first)
+          effective.name = ".cargo/config.toml"
+          configs << effective
+          configs.concat(parents.drop(1))
+        end
+
+        @cargo_configs = T.let(configs, T.nilable(T::Array[Dependabot::DependencyFile]))
+        configs
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def cargo_config
-        return @cargo_config if defined?(@cargo_config)
+        cargo_configs.find { |f| f.name == ".cargo/config.toml" }
+      end
 
-        @cargo_config = fetch_support_file(".cargo/config.toml")
-        @cargo_config ||= T.let(
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def local_cargo_config
+        return @local_cargo_config if defined?(@local_cargo_config)
+
+        @local_cargo_config = fetch_support_file(".cargo/config.toml")
+        @local_cargo_config ||= T.let(
           fetch_support_file(".cargo/config")&.tap { |f| f.name = ".cargo/config.toml" },
           T.nilable(Dependabot::DependencyFile)
         )
-        @cargo_config ||= T.let(
-          fetch_cargo_config_from_parent_dirs,
-          T.nilable(Dependabot::DependencyFile)
-        )
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -470,22 +526,26 @@ module Dependabot
         super.tap { |f| f.name = Pathname.new(f.name).cleanpath.to_s.gsub(%r{^/+}, "") }
       end
 
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      def fetch_cargo_config_from_parent_dirs
-        return nil if directory.empty?
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def parent_dir_cargo_configs
+        return T.must(@parent_dir_cargo_configs) if defined?(@parent_dir_cargo_configs)
+
+        configs = T.let([], T::Array[Dependabot::DependencyFile])
+        @parent_dir_cargo_configs = T.let(configs, T.nilable(T::Array[Dependabot::DependencyFile]))
+        return configs if directory.empty?
 
         # Count directory depth to determine how many levels to search up
         depth = directory.split("/").count { |s| !s.empty? }
-        return nil if depth.zero?
+        return configs if depth.zero?
 
-        # Try each parent directory level
+        # Collect a config from every ancestor directory that has one, nearest first
         depth.times do |i|
           parent_path = ([".."] * (i + 1)).join("/")
           config = try_fetch_config_at_path(parent_path)
-          return config if config
+          configs << config if config
         end
 
-        nil
+        configs
       end
 
       sig { params(parent_path: String).returns(T.nilable(Dependabot::DependencyFile)) }
@@ -499,7 +559,9 @@ module Dependabot
           )
           Dependabot.logger.debug("Successfully fetched config from: #{full_path}")
           config.support_file = true
-          config.name = ".cargo/config.toml"
+          # Normalise `.cargo/config` to `.cargo/config.toml` while preserving the
+          # relative `../` path so the file is written to the right location.
+          config.name = Pathname.new(File.join(parent_path, ".cargo/config.toml")).cleanpath.to_s
           return config
         rescue Dependabot::DependencyFileNotFound
           Dependabot.logger.debug("No config found at: #{full_path}")

data/lib/dependabot/cargo/file_parser.rb

@@ -105,9 +105,8 @@ module Dependabot
       def check_rust_workspace_root
         cargo_toml = dependency_files.find { |f| f.name == "Cargo.toml" }
         workspace_root = parsed_file(T.must(cargo_toml))
-        return unless workspace_root.is_a?(Hash)
 
-        workspace_config = workspace_root.dig("package", "workspace")
+        workspace_config = T.cast(toml_table_or_empty(workspace_root["package"])["workspace"], T.nilable(String))
         return unless workspace_config
 
         msg = "This project is part of a Rust workspace but is not the " \
@@ -129,10 +128,10 @@ module Dependabot
 
         manifest_files.each do |file|
           parsed_content = parsed_file(file)
-          next unless parsed_content.is_a?(Hash)
 
           DEPENDENCY_TYPES.each do |type|
-            parsed_content.fetch(type, {}).each do |name, requirement|
+            toml_table_or_empty(parsed_content.fetch(type, {})).each do |name, requirement|
+              requirement = dependency_declaration(requirement)
               # Skip workspace-inherited dependencies (similar to pnpm catalog)
               # Only skip if workspace is exactly boolean true
               next if requirement.is_a?(Hash) && requirement["workspace"] == true
@@ -143,8 +142,10 @@ module Dependabot
               dependency_set << build_dependency(name, requirement, type, file)
             end
 
-            parsed_content.fetch("target", {}).each do |_, t_details|
-              t_details.fetch(type, {}).each do |name, requirement|
+            toml_table_or_empty(parsed_content.fetch("target", {})).each do |_, t_details|
+              t_details = toml_table_or_empty(t_details)
+              toml_table_or_empty(t_details.fetch(type, {})).each do |name, requirement|
+                requirement = dependency_declaration(requirement)
                 # Skip workspace-inherited dependencies
                 # Only skip if workspace is exactly boolean true
                 next if requirement.is_a?(Hash) && requirement["workspace"] == true
@@ -158,8 +159,9 @@ module Dependabot
             end
           end
 
-          workspace = parsed_content.fetch("workspace", {})
-          workspace.fetch("dependencies", {}).each do |name, requirement|
+          workspace = toml_table_or_empty(parsed_content.fetch("workspace", {}))
+          toml_table_or_empty(workspace.fetch("dependencies", {})).each do |name, requirement|
+            requirement = dependency_declaration(requirement)
             next unless name == name_from_declaration(name, requirement)
             next if lockfile && !version_from_lockfile(name, requirement)
 
@@ -202,15 +204,14 @@ module Dependabot
         return dependency_set unless lockfile
 
         lockfile_content = parsed_file(T.must(lockfile))
-        return dependency_set unless lockfile_content.is_a?(Hash)
 
-        lockfile_content.fetch("package", []).each do |package_details|
-          next unless package_details["source"]
+        T.cast(lockfile_content.fetch("package", []), T::Array[T::Hash[String, T.anything]]).each do |package_details|
+          next unless T.cast(package_details["source"], T.nilable(String))
 
           # TODO: This isn't quite right, as it will only give us one
           # version of each dependency (when in fact there are many)
           dependency_set << Dependency.new(
-            name: package_details["name"],
+            name: T.cast(package_details["name"], String),
             version: version_from_lockfile_details(package_details),
             package_manager: "cargo",
             requirements: []
@@ -224,10 +225,9 @@ module Dependabot
       def patched_dependencies
         root_manifest = manifest_files.find { |f| f.name == "Cargo.toml" }
         parsed_content = parsed_file(T.must(root_manifest))
-        return [] unless parsed_content.is_a?(Hash)
         return [] unless parsed_content["patch"]
 
-        parsed_content["patch"].values.flat_map(&:keys)
+        toml_table_or_empty(parsed_content["patch"]).values.flat_map { |patch| toml_table_or_empty(patch).keys }
       end
 
       sig { params(declaration: T.any(String, T::Hash[String, String])).returns(T.nilable(String)) }
@@ -332,10 +332,18 @@ module Dependabot
 
       sig { params(key_name: String).returns(T.nilable(String)) }
       def cargo_config_from_file(key_name)
-        config_file = cargo_config
-        return nil unless config_file
+        # Cargo merges `.cargo/config.toml` hierarchically, with nearer configs
+        # taking precedence over ancestors. Search the package-directory config
+        # first, then each ancestor config, returning the first match.
+        cargo_config_files.each do |config_file|
+          value = key_name.split(".").reduce(parsed_file(config_file)) do |current, key|
+            toml_table_or_empty(current)[key]
+          end
+          value = T.cast(value, T.nilable(String))
+          return value if value
+        end
 
-        parsed_file(config_file).dig(*key_name.split("."))
+        nil
       end
 
       sig { params(name: String, declaration: T.any(String, T::Hash[String, String])).returns(T.nilable(String)) }
@@ -343,29 +351,28 @@ module Dependabot
         return unless lockfile
 
         lockfile_content = parsed_file(T.must(lockfile))
-        return unless lockfile_content.is_a?(Hash)
 
         candidate_packages =
-          lockfile_content.fetch("package", [])
-                          .select { |p| p["name"] == name }
+          lockfile_packages(lockfile_content)
+          .select { |p| package_field(p, "name") == name }
 
         if (req = requirement_from_declaration(declaration))
           req = Cargo::Requirement.new(req)
 
           candidate_packages =
             candidate_packages
-            .select { |p| req.satisfied_by?(version_class.new(p["version"])) }
+            .select { |p| req.satisfied_by?(version_class.new(T.must(package_field(p, "version")))) }
         end
 
         candidate_packages =
           candidate_packages
           .select do |p|
-            git_req?(declaration) ^ !p["source"]&.start_with?("git+")
+            git_req?(declaration) ^ !package_field(p, "source")&.start_with?("git+")
           end
 
         package =
           candidate_packages
-          .max_by { |p| version_class.new(p["version"]) }
+          .max_by { |p| version_class.new(T.must(package_field(p, "version"))) }
 
         return unless package
 
@@ -387,11 +394,13 @@ module Dependabot
         }
       end
 
-      sig { params(package_details: T::Hash[String, String]).returns(String) }
+      sig { params(package_details: T::Hash[String, T.anything]).returns(String) }
       def version_from_lockfile_details(package_details)
-        return T.must(package_details["version"]) unless package_details["source"]&.start_with?("git+")
+        source = T.cast(package_details["source"], T.nilable(String))
+        version = T.cast(package_details["version"], String)
+        return version unless source&.start_with?("git+")
 
-        T.must(T.must(package_details["source"]).split("#").last)
+        T.must(source.split("#").last)
       end
 
       sig { override.void }
@@ -399,14 +408,36 @@ module Dependabot
         raise "No Cargo.toml!" unless get_original_file("Cargo.toml")
       end
 
-      sig { params(file: DependencyFile).returns(T.untyped) }
+      sig { params(file: DependencyFile).returns(T::Hash[String, T.anything]) }
       def parsed_file(file)
-        @parsed_file ||= T.let({}, T.nilable(T::Hash[String, T.untyped]))
+        @parsed_file ||= T.let({}, T.nilable(T::Hash[String, T::Hash[String, T.anything]]))
         @parsed_file[file.name] ||= TomlRB.parse(file.content)
       rescue TomlRB::ParseError, TomlRB::ValueOverwriteError
         raise Dependabot::DependencyFileNotParseable, file.path
       end
 
+      sig { params(lockfile_content: T::Hash[String, T.anything]).returns(T::Array[T::Hash[String, T.anything]]) }
+      def lockfile_packages(lockfile_content)
+        T.cast(lockfile_content.fetch("package", []), T::Array[T::Hash[String, T.anything]])
+      end
+
+      sig { params(package_details: T::Hash[String, T.anything], field: String).returns(T.nilable(String)) }
+      def package_field(package_details, field)
+        T.cast(package_details[field], T.nilable(String))
+      end
+
+      sig { params(value: T.anything).returns(T::Hash[String, T.anything]) }
+      def toml_table_or_empty(value)
+        (obj = T.cast(value, T.nilable(Object))).is_a?(Hash) ? obj : {}
+      end
+
+      sig { params(value: T.anything).returns(T.any(String, T::Hash[String, String])) }
+      def dependency_declaration(value)
+        return T.cast(value, String) if T.cast(value, T.nilable(Object)).is_a?(String)
+
+        T.cast(value, T::Hash[String, String])
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def manifest_files
         @manifest_files ||= T.let(
@@ -422,9 +453,18 @@ module Dependabot
         @lockfile ||= T.let(get_original_file("Cargo.lock"), T.nilable(Dependabot::DependencyFile))
       end
 
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      def cargo_config
-        @cargo_config ||= T.let(get_original_file(".cargo/config.toml"), T.nilable(Dependabot::DependencyFile))
+      # All `.cargo/config.toml` files in the fetched set, ordered nearest-first
+      # (package directory config, then successive ancestors). Ancestor configs
+      # carry relative `../` names, so we order by `../` depth to reflect Cargo's
+      # nearest-wins precedence.
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def cargo_config_files
+        @cargo_config_files ||= T.let(
+          dependency_files
+            .select { |f| f.name.end_with?(".cargo/config.toml") }
+            .sort_by { |f| f.name.scan("../").count },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
       sig { returns(T.class_of(Dependabot::Version)) }