dependabot-cargo 0.384.0 → 0.386.0

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -41,7 +41,7 @@ module Dependabot
           @path_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
           @lockfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
           @toolchain = T.let(nil, T.nilable(Dependabot::DependencyFile))
-          @config = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @config_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
         end
 
         sig { returns(T.any(String, T.noreturn)) }
@@ -305,11 +305,13 @@ module Dependabot
 
           File.write(lockfile.name, replace_ssh_urls(T.must(lockfile.content)))
           File.write(T.must(toolchain).name, T.must(toolchain).content) if toolchain
-          config_file = config
-          return unless config_file
-
-          FileUtils.mkdir_p(File.dirname(config_file.name))
-          File.write(config_file.name, Helpers.sanitize_cargo_config(T.must(config_file.content)))
+          config_files.each do |config_file|
+            FileUtils.mkdir_p(File.dirname(config_file.name))
+            File.write(
+              config_file.name,
+              Helpers.sanitize_cargo_config(T.must(config_file.content), file_name: config_file.name)
+            )
+          end
         end
 
         sig { void }
@@ -390,20 +392,31 @@ module Dependabot
           TomlRB.dump(parsed_manifest)
         end
 
-        sig { params(parsed_manifest: T::Hash[String, T.untyped]).void }
+        sig { params(parsed_manifest: T::Hash[String, T.anything]).void }
         def pin_target_specific_dependencies!(parsed_manifest)
-          parsed_manifest.fetch("target", {}).each do |target, t_details|
+          toml_table_or_empty(parsed_manifest.fetch("target", {})).each do |target, t_details|
+            t_details = toml_table_or_empty(t_details)
             Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-              t_details.fetch(type, {}).each do |name, requirement|
+              toml_table_or_empty(t_details.fetch(type, {})).each do |name, requirement|
                 next unless name == dependency.name
 
                 updated_req = "=#{dependency.version}"
 
-                if requirement.is_a?(Hash)
-                  parsed_manifest["target"][target][type][name]["version"] =
+                if T.cast(requirement, T.nilable(Object)).is_a?(Hash)
+                  toml_table_or_empty(
+                    toml_table_or_empty(
+                      toml_table_or_empty(
+                        toml_table_or_empty(parsed_manifest["target"])[target]
+                      )[type]
+                    )[name]
+                  )["version"] =
                     updated_req
                 else
-                  parsed_manifest["target"][target][type][name] = updated_req
+                  toml_table_or_empty(
+                    toml_table_or_empty(
+                      toml_table_or_empty(parsed_manifest["target"])[target]
+                    )[type]
+                  )[name] = updated_req
                 end
               end
             end
@@ -496,6 +509,12 @@ module Dependabot
           lockfile_content
         end
 
+        sig { params(value: T.anything).returns(T::Hash[String, T.anything]) }
+        def toml_table_or_empty(value)
+          obj = T.cast(value, T.nilable(Object))
+          obj.is_a?(Hash) ? obj : {}
+        end
+
         sig { returns(String) }
         def dummy_app_content
           %{fn main() {\nprintln!("Hello, world!");\n}}
@@ -537,9 +556,12 @@ module Dependabot
             dependency_files.find { |f| f.name == "rust-toolchain" }
         end
 
-        sig { returns(T.nilable(Dependabot::DependencyFile)) }
-        def config
-          @config ||= dependency_files.find { |f| f.name == ".cargo/config.toml" }
+        # Cargo merges `.cargo/config.toml` hierarchically (package directory plus
+        # every ancestor up to the repo root), so we materialise all of them and
+        # let Cargo perform the merge with its own precedence rules.
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def config_files
+          @config_files ||= dependency_files.select { |f| f.name.end_with?(".cargo/config.toml") }
         end
 
         sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }

data/lib/dependabot/cargo/helpers.rb

@@ -19,8 +19,8 @@ module Dependabot
       # These per-registry settings override the global CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS env var,
       # causing Cargo to look up tokens locally. Since the dependabot proxy handles all registry authentication
       # transparently, we remove these so Cargo makes plain unauthenticated requests that the proxy can intercept.
-      sig { params(config_content: String).returns(String) }
-      def self.sanitize_cargo_config(config_content)
+      sig { params(config_content: String, file_name: String).returns(String) }
+      def self.sanitize_cargo_config(config_content, file_name: ".cargo/config.toml")
         parsed = TomlRB.parse(config_content)
         return config_content unless parsed.is_a?(Hash)
 
@@ -40,7 +40,7 @@ module Dependabot
         TomlRB.dump(parsed)
       rescue TomlRB::Error => e
         raise Dependabot::DependencyFileNotParseable.new(
-          ".cargo/config.toml",
+          file_name,
           "Failed to parse Cargo config file: #{e.message}"
         )
       end
@@ -109,10 +109,17 @@ module Dependabot
         ).returns(T::Hash[String, String])
       end
       def self.registry_token_env_from_files(dependency_files, credentials)
-        config_file = dependency_files.find { |f| f.name == ".cargo/config.toml" }
-        return {} unless config_file
-
-        registry_token_env(T.must(config_file.content), credentials)
+        config_files = dependency_files.select { |f| f.name.end_with?(".cargo/config.toml") }
+        return {} if config_files.empty?
+
+        # Cargo gives nearer configs precedence over ancestors on key collisions.
+        # A config's `../` depth (how many parent hops appear in its name)
+        # indicates how far up the tree it lives, so merge farthest-first and let
+        # the nearest config (fewest `../`) win.
+        ordered = config_files.sort_by { |f| -f.name.scan("../").count }
+        ordered.each_with_object({}) do |config_file, env|
+          env.merge!(registry_token_env(T.must(config_file.content), credentials))
+        end
       end
 
       # Builds the complete environment variable hash for running cargo commands:

data/lib/dependabot/cargo/metadata_finder.rb

@@ -19,7 +19,7 @@ module Dependabot
       sig { params(dependency: Dependabot::Dependency, credentials: T::Array[Dependabot::Credential]).void }
       def initialize(dependency:, credentials:)
         super
-        @crates_listing = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
+        @crates_listing = T.let(nil, T.nilable(T::Hash[String, T.anything]))
       end
 
       private
@@ -43,7 +43,10 @@ module Dependabot
       def find_source_from_crates_listing
         potential_source_urls =
           SOURCE_KEYS
-          .filter_map { |key| T.must(crates_listing).dig("crate", key) }
+          .filter_map do |key|
+            crate = T.cast(T.must(crates_listing)["crate"], T.nilable(T::Hash[String, T.anything]))
+            T.cast(crate&.fetch(key, nil), T.nilable(String))
+          end
 
         source_url = potential_source_urls.find { |url| Source.from_url(url) }
         Source.from_url(source_url)
@@ -51,18 +54,25 @@ module Dependabot
 
       sig { returns(T.nilable(Dependabot::Source)) }
       def find_source_from_git_url
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
+        info = T.cast(
+          dependency.requirements.filter_map { |r| r[:source] }.first,
+          T.nilable(T::Hash[T.any(String, Symbol), T.anything])
+        )
+        return unless info
 
-        url = info[:url] || info.fetch("url")
-        Source.from_url(url)
+        url = info[:url] || info["url"]
+        Source.from_url(T.cast(url, T.nilable(String)))
       end
 
-      sig { returns(T.nilable(T::Hash[String, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[String, T.anything])) }
       def crates_listing
         return @crates_listing unless @crates_listing.nil?
 
-        info = dependency.requirements.filter_map { |r| r[:source] }.first
-        index = (info && info[:index]) || CRATES_IO_API
+        info = T.cast(
+          dependency.requirements.filter_map { |r| r[:source] }.first,
+          T.nilable(T::Hash[T.any(String, Symbol), T.anything])
+        )
+        index = T.cast((info && (info[:index] || info["index"])) || CRATES_IO_API, String)
         hdrs = build_headers(index, info)
 
         url = metadata_fetch_url(dependency, index)
@@ -71,14 +81,18 @@ module Dependabot
         @crates_listing = parse_response(response, index)
       end
 
-      sig { params(index: String, info: T.nilable(T::Hash[String, T.untyped])).returns(T::Hash[String, String]) }
+      sig do
+        params(index: String, info: T.nilable(T::Hash[T.any(String, Symbol), T.anything]))
+          .returns(T::Hash[String, String])
+      end
       def build_headers(index, info)
         hdrs = { "User-Agent" => "Dependabot (dependabot.com)" }
         return hdrs if index == CRATES_IO_API
 
         return hdrs if info.nil?
 
-        credentials.find { |cred| cred["type"] == "cargo_registry" && cred["registry"] == info["name"] }&.tap do |cred|
+        registry_name = T.cast(info["name"] || info[:name], T.nilable(String))
+        credentials.find { |cred| cred["type"] == "cargo_registry" && cred["registry"] == registry_name }&.tap do |cred|
           hdrs["Authorization"] = "Token #{cred['token']}"
         end
 
@@ -94,7 +108,7 @@ module Dependabot
         )
       end
 
-      sig { params(response: Excon::Response, index: String).returns(T::Hash[String, T.untyped]) }
+      sig { params(response: Excon::Response, index: String).returns(T::Hash[String, T.anything]) }
       def parse_response(response, index)
         if index.start_with?("sparse+")
           parsed_response = response.body.lines.map { |line| JSON.parse(line) }

data/lib/dependabot/cargo/package/package_details_fetcher.rb

@@ -42,23 +42,25 @@ module Dependabot
         sig { returns(Dependabot::Dependency) }
         attr_reader :dependency
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 
-        sig { returns(T::Array[T.untyped]) }
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
         sig do
           returns(T.nilable(Dependabot::Package::PackageDetails))
         end
         def fetch
-          package_releases = crates_listing.fetch("versions", []).reject { |v| v["yanked"] }.map do |release|
+          releases = T.cast(crates_listing.fetch("versions", []), T::Array[T::Hash[String, T.anything]])
+          package_releases = releases.reject { |v| v["yanked"] }.map do |release|
+            created_at = T.cast(release["created_at"], T.nilable(String))
             package_release(
-              version: release["num"] || release["vers"],
-              released_at: release["created_at"] ? Time.parse(release["created_at"]) : nil,
-              downloads: release["downloads"],
-              url: "#{CRATES_IO_API}/#{release['dl_path']}",
-              rust_version: release["rust"]
+              version: T.cast(release["num"], T.nilable(String)) || T.cast(release["vers"], String),
+              released_at: created_at ? Time.parse(created_at) : nil,
+              downloads: T.cast(release["downloads"], T.nilable(Integer)),
+              url: "#{CRATES_IO_API}/#{T.cast(release['dl_path'], T.nilable(String))}",
+              rust_version: T.cast(release["rust"], T.nilable(String))
             )
           end
 
@@ -68,7 +70,7 @@ module Dependabot
         private
 
         sig do
-          returns(T.untyped)
+          returns(T::Hash[String, T.anything])
         end
         def crates_listing
           return @crates_listing unless @crates_listing.nil?
@@ -86,41 +88,45 @@ module Dependabot
           response = fetch_response(url, hdrs)
           return {} if response.status == 404
 
-          @crates_listing = T.let(parse_response(response, index), T.nilable(T::Hash[T.untyped, T.untyped]))
+          @crates_listing = T.let(parse_response(response, index), T.nilable(T::Hash[String, T.anything]))
 
           Dependabot.logger.info("Fetched metadata for #{dependency.name} from #{index} successfully")
 
-          @crates_listing
+          T.must(@crates_listing)
         end
 
-        sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
         def fetch_dependency_info
-          dependency.requirements.filter_map { |r| r[:source] }.first
+          T.cast(
+            dependency.requirements.filter_map { |r| r[:source] }.first,
+            T.nilable(T::Hash[T.any(String, Symbol), T.anything])
+          )
         end
 
-        sig { params(info: T.untyped).returns(String) }
+        sig { params(info: T.nilable(T::Hash[T.any(String, Symbol), T.anything])).returns(String) }
         def fetch_index(info)
-          (info && info[:index]) || CRATES_IO_API
+          T.cast((info && (info[:index] || info["index"])) || CRATES_IO_API, String)
         end
 
-        sig { returns(T::Hash[T.untyped, T.untyped]) }
+        sig { returns(T::Hash[String, String]) }
         def default_headers
           { "User-Agent" => "Dependabot (dependabot.com)" }
         end
 
-        sig { params(info: T.untyped).returns(T::Hash[T.untyped, T.untyped]) }
+        sig { params(info: T.nilable(T::Hash[T.any(String, Symbol), T.anything])).returns(T::Hash[String, String]) }
         def auth_headers(info)
+          registry_name = T.cast(info && (info[:name] || info["name"]), T.nilable(String))
           registry_creds = credentials.find do |cred|
-            cred["type"] == "cargo_registry" && cred["registry"] == info[:name]
+            cred["type"] == "cargo_registry" && cred["registry"] == registry_name
           end
 
-          return {} if registry_creds.nil?
+          return {} unless registry_creds
 
           token = registry_creds["token"] || "placeholder_token"
           { "Authorization" => token }
         end
 
-        sig { params(url: String, headers: T.untyped).returns(Excon::Response) }
+        sig { params(url: String, headers: T::Hash[String, String]).returns(Excon::Response) }
         def fetch_response(url, headers)
           Excon.get(
             url,
@@ -129,7 +135,7 @@ module Dependabot
           )
         end
 
-        sig { params(response: Excon::Response, index: T.untyped).returns(T::Hash[T.untyped, T.untyped]) }
+        sig { params(response: Excon::Response, index: String).returns(T::Hash[String, T.anything]) }
         def parse_response(response, index)
           if index.start_with?("sparse+")
             parsed_response = response.body.lines
@@ -148,7 +154,7 @@ module Dependabot
           end
         end
 
-        sig { params(dependency: T.untyped, index: T.untyped).returns(String) }
+        sig { params(dependency: Dependabot::Dependency, index: String).returns(String) }
         def metadata_fetch_url(dependency, index)
           return "#{index}/#{dependency.name}" if index == CRATES_IO_API
 

data/lib/dependabot/cargo/update_checker/file_preparer.rb

@@ -123,9 +123,9 @@ module Dependabot
           TomlRB.dump(parsed_manifest)
         end
 
-        sig { params(parsed_manifest: T::Hash[String, T.untyped], filename: String).void }
+        sig { params(parsed_manifest: T::Hash[String, T.anything], filename: String).void }
         def replace_req_on_target_specific_deps!(parsed_manifest, filename)
-          parsed_manifest.fetch("target", {}).each do |target, _|
+          toml_table_or_empty(parsed_manifest.fetch("target", {})).each do |target, _|
             Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
               dependency_names = dependency_names_for_type_and_target(
                 parsed_manifest,
@@ -134,35 +134,39 @@ module Dependabot
               )
 
               dependency_names.each do |name|
-                req = parsed_manifest.dig("target", target, type, name)
+                req = target_dependency_declaration(parsed_manifest, target, type, name)
 
                 updated_req = temporary_requirement_for_resolution(filename)
 
                 if req.is_a?(Hash)
-                  parsed_manifest["target"][target][type][name]["version"] =
-                    updated_req
+                  target_dependency_table(parsed_manifest, target, type, name)["version"] = updated_req
                 else
-                  parsed_manifest["target"][target][type][name] = updated_req
+                  target_dependency_type_table(parsed_manifest, target, type)[name] = updated_req
                 end
               end
             end
           end
         end
 
-        sig { params(parsed_manifest: T::Hash[String, T.untyped], filename: String).void }
+        sig { params(parsed_manifest: T::Hash[String, T.anything], filename: String).void }
         def replace_req_on_workspace_deps!(parsed_manifest, filename)
-          workspace = parsed_manifest.fetch("workspace", {})
-          workspace_deps = workspace.fetch("dependencies", {})
+          workspace = toml_table_or_empty(parsed_manifest.fetch("workspace", {}))
+          workspace_deps = toml_table_or_empty(workspace.fetch("dependencies", {}))
 
           workspace_deps.each do |name, req|
+            req = dependency_declaration(req)
             next unless dependency.name == name_from_declaration(name, req)
 
             updated_req = temporary_requirement_for_resolution(filename)
 
             if req.is_a?(Hash)
-              parsed_manifest["workspace"]["dependencies"][name]["version"] = updated_req
+              toml_table_or_empty(
+                toml_table_or_empty(
+                  toml_table_or_empty(parsed_manifest["workspace"])["dependencies"]
+                )[name]
+              )["version"] = updated_req
             else
-              parsed_manifest["workspace"]["dependencies"][name] = updated_req
+              toml_table_or_empty(toml_table_or_empty(parsed_manifest["workspace"])["dependencies"])[name] = updated_req
             end
           end
         end
@@ -173,13 +177,14 @@ module Dependabot
 
           Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
             dependency_names_for_type(parsed_manifest, type).each do |name|
-              req = parsed_manifest.dig(type, name)
+              req = T.cast(parsed_manifest.dig(type, name), T.any(String, T::Hash[String, T.anything]))
               next unless req.is_a?(Hash)
               next unless [req["tag"], req["rev"]].compact.uniq.one?
 
-              parsed_manifest[type][name]["tag"] = replacement_git_pin if req["tag"]
+              dependency_options = toml_table_or_empty(toml_table_or_empty(parsed_manifest[type])[name])
+              dependency_options["tag"] = replacement_git_pin if req["tag"]
 
-              parsed_manifest[type][name]["rev"] = replacement_git_pin if req["rev"]
+              dependency_options["rev"] = replacement_git_pin if req["rev"]
             end
           end
 
@@ -188,9 +193,9 @@ module Dependabot
           TomlRB.dump(parsed_manifest)
         end
 
-        sig { params(parsed_manifest: T::Hash[String, T.untyped]).void }
+        sig { params(parsed_manifest: T::Hash[String, T.anything]).void }
         def replace_git_pin_on_target_specific_deps!(parsed_manifest)
-          parsed_manifest.fetch("target", {}).each do |target, _|
+          toml_table_or_empty(parsed_manifest.fetch("target", {})).each do |target, _|
             Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
               dependency_names = dependency_names_for_type_and_target(
                 parsed_manifest,
@@ -199,19 +204,15 @@ module Dependabot
               )
 
               dependency_names.each do |name|
-                req = parsed_manifest.dig("target", target, type, name)
+                req = target_dependency_declaration(parsed_manifest, target, type, name)
                 next unless req.is_a?(Hash)
                 next unless [req["tag"], req["rev"]].compact.uniq.one?
 
-                if req["tag"]
-                  parsed_manifest["target"][target][type][name]["tag"] =
-                    replacement_git_pin
-                end
+                target_dependency_table(parsed_manifest, target, type, name)["tag"] = replacement_git_pin if req["tag"]
 
-                if req["rev"]
-                  parsed_manifest["target"][target][type][name]["rev"] =
-                    replacement_git_pin
-                end
+                next unless req["rev"]
+
+                target_dependency_table(parsed_manifest, target, type, name)["rev"] = replacement_git_pin
               end
             end
           end
@@ -222,12 +223,12 @@ module Dependabot
           parsed_manifest = TomlRB.parse(content)
 
           Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-            (parsed_manifest[type] || {}).each do |_, details|
-              next unless details.is_a?(Hash)
-              next unless details["git"]
+            toml_table_or_empty(parsed_manifest[type]).each do |_, details|
+              details = toml_table_or_empty(details)
+              git = T.cast(details.fetch("git", nil), T.nilable(String))
+              next unless git
 
-              details["git"] = details["git"]
-                               .gsub(%r{ssh://git@(.*?)/}, 'https://\1/')
+              details["git"] = git.gsub(%r{ssh://git@(.*?)/}, 'https://\1/')
             end
           end
 
@@ -283,17 +284,29 @@ module Dependabot
         def git_dependency_version
           return unless lockfile
 
-          TomlRB.parse(T.must(lockfile).content)
-                .fetch("package", [])
-                .select { |p| p["name"] == dependency.name }
-                .find { |p| p["source"].end_with?(dependency.version) }
-                .fetch("version")
+          version = dependency.version
+          return unless version
+
+          packages = T.cast(
+            TomlRB.parse(T.must(lockfile).content).fetch("package", []),
+            T::Array[T::Hash[String, T.anything]]
+          )
+          package = packages
+                    .select { |p| T.cast(p["name"], T.nilable(String)) == dependency.name }
+                    .find do |p|
+                      source = T.cast(p["source"], T.nilable(String))
+                      source&.end_with?(version)
+                    end
+          return unless package
+
+          T.cast(package.fetch("version"), String)
         end
 
-        sig { params(parsed_manifest: T::Hash[String, T.untyped], type: String).returns(T::Array[String]) }
+        sig { params(parsed_manifest: T::Hash[String, T.anything], type: String).returns(T::Array[String]) }
         def dependency_names_for_type(parsed_manifest, type)
           names = []
-          parsed_manifest.fetch(type, {}).each do |nm, req|
+          toml_table_or_empty(parsed_manifest.fetch(type, {})).each do |nm, req|
+            req = dependency_declaration(req)
             next unless dependency.name == name_from_declaration(nm, req)
 
             names << nm
@@ -302,11 +315,13 @@ module Dependabot
         end
 
         sig do
-          params(parsed_manifest: T::Hash[String, T.untyped], type: String, target: String).returns(T::Array[String])
+          params(parsed_manifest: T::Hash[String, T.anything], type: String, target: String).returns(T::Array[String])
         end
         def dependency_names_for_type_and_target(parsed_manifest, type, target)
           names = []
-          (parsed_manifest.dig("target", target, type) || {}).each do |nm, req|
+          target_details = toml_table_or_empty(toml_table_or_empty(parsed_manifest["target"])[target])
+          toml_table_or_empty(target_details[type]).each do |nm, req|
+            req = dependency_declaration(req)
             next unless dependency.name == name_from_declaration(nm, req)
 
             names << nm
@@ -314,13 +329,63 @@ module Dependabot
           names
         end
 
-        sig { params(name: String, declaration: T.untyped).returns(String) }
+        sig { params(name: String, declaration: T.any(String, T::Hash[String, T.anything])).returns(String) }
         def name_from_declaration(name, declaration)
           return name if declaration.is_a?(String)
 
-          raise "Unexpected dependency declaration: #{declaration}" unless declaration.is_a?(Hash)
+          T.cast(declaration.fetch("package", name), String)
+        end
+
+        sig do
+          params(
+            parsed_manifest: T::Hash[String, T.anything],
+            target: String,
+            type: String
+          ).returns(T::Hash[String, T.anything])
+        end
+        def target_dependency_type_table(parsed_manifest, target, type)
+          target_details = toml_table_or_empty(toml_table_or_empty(parsed_manifest["target"])[target])
+          toml_table_or_empty(target_details[type])
+        end
+
+        sig do
+          params(
+            parsed_manifest: T::Hash[String, T.anything],
+            target: String,
+            type: String,
+            name: String
+          ).returns(T.any(String, T::Hash[String, T.anything]))
+        end
+        def target_dependency_declaration(parsed_manifest, target, type, name)
+          T.cast(
+            target_dependency_type_table(parsed_manifest, target, type)[name],
+            T.any(String, T::Hash[String, T.anything])
+          )
+        end
+
+        sig do
+          params(
+            parsed_manifest: T::Hash[String, T.anything],
+            target: String,
+            type: String,
+            name: String
+          ).returns(T::Hash[String, T.anything])
+        end
+        def target_dependency_table(parsed_manifest, target, type, name)
+          toml_table_or_empty(target_dependency_type_table(parsed_manifest, target, type)[name])
+        end
+
+        sig { params(value: T.anything).returns(T::Hash[String, T.anything]) }
+        def toml_table_or_empty(value)
+          obj = T.cast(value, T.nilable(Object))
+          obj.is_a?(Hash) ? obj : {}
+        end
+
+        sig { params(value: T.anything).returns(T.any(String, T::Hash[String, T.anything])) }
+        def dependency_declaration(value)
+          return T.cast(value, String) if T.cast(value, T.nilable(Object)).is_a?(String)
 
-          declaration.fetch("package", name)
+          T.cast(value, T::Hash[String, T.anything])
         end
 
         sig { returns(T::Array[Dependabot::DependencyFile]) }

data/lib/dependabot/cargo/update_checker/requirements_updater.rb

@@ -36,7 +36,7 @@ module Dependabot
         sig do
           params(
             requirements: T::Array[Dependabot::DependencyRequirement],
-            updated_source: T.nilable(T::Hash[T.any(String, Symbol), T.untyped]),
+            updated_source: T.nilable(T::Hash[T.any(String, Symbol), T.anything]),
             update_strategy: Dependabot::RequirementsUpdateStrategy,
             target_version: T.nilable(T.any(String, Gem::Version))
           ).void
@@ -51,7 +51,7 @@ module Dependabot
             requirements.map { |req| Dependabot::DependencyRequirement.create(req) },
             T::Array[Dependabot::DependencyRequirement]
           )
-          @updated_source = T.let(updated_source, T.nilable(T::Hash[T.any(String, Symbol), T.untyped]))
+          @updated_source = T.let(updated_source, T.nilable(T::Hash[T.any(String, Symbol), T.anything]))
           @update_strategy = T.let(update_strategy, Dependabot::RequirementsUpdateStrategy)
 
           check_update_strategy
@@ -87,7 +87,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :requirements
 
-        sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
+        sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
         attr_reader :updated_source
 
         sig { returns(Dependabot::RequirementsUpdateStrategy) }