dependabot-cargo 0.223.0 → 0.224.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16eda558215c4e6e559914d48c4942996b3222f089c1ad94826dab4e9745d317
-  data.tar.gz: cc4e207ff45f80160c71279b553d7ce55cb25c06cdf2c98a4bdf00e767f31b78
+  metadata.gz: 40da4ff75944a40a942ec497e3399a0e14358e4097930868053b6b667824f9de
+  data.tar.gz: 25cc4cc1572467a4efc612fda4848d641e6b7b761c75efef1eb43fd3ee9b0131
 SHA512:
-  metadata.gz: af328574f254c93809acc12be8a302cee939ff6044721c564ec06ba2a67f219b8a127826692be94667ef2a6f14dc9aae0d6fd6fbf6356062c8f755ef0f40a5d7
-  data.tar.gz: 8ba928f93d0d833dfbdb06f1a8da4807f7278dd88c5eb8fab07a657911144e8d25de8b9b9dbd21d182c2035d6ee23ed34b39b4f38d72f83fb28b2a1733bd5ef8
+  metadata.gz: be0c11ba56cc69fea40d2fdc2cb73170e223ad42c73e792523ad2d9c7553f36234fe157b5e38cb6282369b920b10d2d71501703d26f1cac75905a263095721e9
+  data.tar.gz: fed053f592e5323a06ed35c19f85dd509f5fb43a2353e24ecf309689538a724d1a7251993a49550e9081786628753ab66e19d2e5135985e56d90920d1a0a0e4f

data/lib/dependabot/cargo/file_fetcher.rb

@@ -152,30 +152,32 @@ module Dependabot
               unfetchable_required_path_deps
       end
 
-      # rubocop:enable Metrics/PerceivedComplexity
+      def collect_path_dependencies_paths(dependencies)
+        paths = []
+        dependencies.each do |_, details|
+          next unless details.is_a?(Hash) && details["path"]
 
+          paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
+        end
+        paths
+      end
+
+      # rubocop:enable Metrics/PerceivedComplexity
       def path_dependency_paths_from_file(file)
         paths = []
 
-        # Paths specified in dependency declaration
+        workspace = parsed_file(file).fetch("workspace", {})
         Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-          parsed_file(file).fetch(type, {}).each do |_, details|
-            next unless details.is_a?(Hash)
-            next unless details["path"]
-
-            paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
-          end
+          # Paths specified in dependency declaration
+          paths += collect_path_dependencies_paths(parsed_file(file).fetch(type, {}))
+          # Paths specified as workspace dependencies in workspace root
+          paths += collect_path_dependencies_paths(workspace.fetch(type, {}))
         end
 
         # Paths specified for target-specific dependencies
         parsed_file(file).fetch("target", {}).each do |_, t_details|
           Cargo::FileParser::DEPENDENCY_TYPES.each do |type|
-            t_details.fetch(type, {}).each do |_, details|
-              next unless details.is_a?(Hash)
-              next unless details["path"]
-
-              paths << File.join(details["path"], "Cargo.toml").delete_prefix("/")
-            end
+            paths += collect_path_dependencies_paths(t_details.fetch(type, {}))
           end
         end
 
@@ -263,6 +265,16 @@ module Dependabot
           end
         end
 
+        # Paths specified for workspace-wide dependencies
+        workspace = parsed_file(file).fetch("workspace", {})
+        workspace.fetch("dependencies", {}).each do |_, details|
+          next unless details.is_a?(Hash)
+          next unless details["path"]
+          next unless path == File.join(details["path"], "Cargo.toml")
+
+          return true if details["git"].nil?
+        end
+
         # Paths specified as replacements
         parsed_file(file).fetch("replace", {}).each do |_, details|
           next unless details.is_a?(Hash)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.223.0
+  version: 0.224.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.224.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.224.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -205,7 +205,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.223.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.224.0
 post_install_message: 
 rdoc_options: []
 require_paths: