dependabot-cargo 0.384.0 → 0.386.0

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -207,17 +207,19 @@ module Dependabot
           )
         end
 
-        sig { params(prepared: T::Boolean).returns(T.nilable(Integer)) }
+        sig { params(prepared: T::Boolean).void }
         def write_temporary_dependency_files(prepared: true)
           write_manifest_files(prepared: prepared)
 
           File.write(T.must(lockfile).name, T.must(lockfile).content) if lockfile
           File.write(T.must(toolchain).name, T.must(toolchain).content) if toolchain
-          config_file = config
-          return unless config_file
-
-          FileUtils.mkdir_p(File.dirname(config_file.name))
-          File.write(config_file.name, Helpers.sanitize_cargo_config(T.must(config_file.content)))
+          config_files.each do |config_file|
+            FileUtils.mkdir_p(File.dirname(config_file.name))
+            File.write(
+              config_file.name,
+              Helpers.sanitize_cargo_config(T.must(config_file.content), file_name: config_file.name)
+            )
+          end
         end
 
         sig { void }
@@ -554,13 +556,18 @@ module Dependabot
           )
         end
 
-        sig { returns(T.nilable(DependencyFile)) }
-        def config
-          @config ||= T.let(
-            original_dependency_files.find do |f|
-              f.name == ".cargo/config.toml"
+        # Cargo merges `.cargo/config.toml` hierarchically (package directory plus
+        # every ancestor up to the repo root), so we materialise all of them and
+        # let Cargo perform the merge with its own precedence rules. Ancestor
+        # configs carry relative `../` names and are written to the matching
+        # location within the temporary tree.
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def config_files
+          @config_files ||= T.let(
+            original_dependency_files.select do |f|
+              f.name.end_with?(".cargo/config.toml")
             end,
-            T.nilable(Dependabot::DependencyFile)
+            T.nilable(T::Array[Dependabot::DependencyFile])
           )
         end
 

data/lib/dependabot/cargo/update_checker.rb

@@ -178,7 +178,7 @@ module Dependabot
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
         if git_commit_checker.pinned_ref_looks_like_version?
-          latest_tag = git_commit_checker.local_tag_for_latest_version
+          latest_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
           return latest_tag&.fetch(:commit_sha) || dependency.version
         end
 
@@ -198,7 +198,7 @@ module Dependabot
         # of the latest tag that looks like a version.
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
-          new_tag = git_commit_checker.local_tag_for_latest_version
+          new_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
           return T.must(new_tag).fetch(:commit_sha)
         end
 
@@ -220,9 +220,9 @@ module Dependabot
 
         @latest_git_tag_is_resolvable_checked = true
 
-        return false if git_commit_checker.local_tag_for_latest_version.nil?
+        return false if git_commit_checker.local_tag_for_latest_version(update_cooldown).nil?
 
-        replacement_tag = T.must(git_commit_checker.local_tag_for_latest_version)
+        replacement_tag = T.must(git_commit_checker.local_tag_for_latest_version(update_cooldown))
 
         prepared_files = FilePreparer.new(
           dependency_files: dependency_files,
@@ -311,7 +311,7 @@ module Dependabot
         latest_resolvable_version
       end
 
-      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
+      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
       def updated_source
         # Never need to update source, unless a git_dependency
         return dependency_source_details unless git_dependency?
@@ -319,7 +319,7 @@ module Dependabot
         # Update the git tag if updating a pinned version
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
-          new_tag = T.must(git_commit_checker.local_tag_for_latest_version)
+          new_tag = T.must(git_commit_checker.local_tag_for_latest_version(update_cooldown))
           return T.must(dependency_source_details).merge(ref: new_tag.fetch(:tag))
         end
 
@@ -327,7 +327,7 @@ module Dependabot
         dependency_source_details
       end
 
-      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped])) }
+      sig { returns(T.nilable(T::Hash[T.any(String, Symbol), T.anything])) }
       def dependency_source_details
         dependency.source_details
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib