dependabot-cargo 0.381.0 → 0.382.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6969ef1e71173b6b45afbce9d53071fcf8799d35bb1a54f4150d38efd0a03beb
-  data.tar.gz: c92ba797c69ea44223a98c2fbd8250d4996042acf5139127544fb12ec3fd099e
+  metadata.gz: 51d4f61feae4b16e9007ba3a114ca34893d7232eb3786c88b9333917f064db35
+  data.tar.gz: 3ce4da7afe9eb34a9adf4db1a1a6e4f8d9cfe7f77e2ea116eae2c05aedca4341
 SHA512:
-  metadata.gz: 14a0eed715ee153c909113a284750548744f2fd7bd50e0a02b9740af3b61bff2c63ea54377739ea33f957320d57f47daf2f144a63f05f7c5f1717bf571116831
-  data.tar.gz: eb724b3f66b23ba163bf93be9587008c427ee42da13e4d973c2f394b66c7990898343e274b0a13cade68a1184b863ecf0e250b35e7a8b130b31a0493da6bb9f3
+  metadata.gz: 9c2eec9ce3b6ccea662a43c7576ba823ebde9156e36bcb0a5dc36e06b3da125e2caa7961b329e6bed364675249f8b084127c4b1c53b2a1e00a1b6a163cb9c604
+  data.tar.gz: 642f355d2a781ef02157dc33fabde13f5fbedca6ff7ec198a6d7b7575d320796b41c837b245f1d448bc0ea9117b1088fb5a4a38f1b7bde42e31d08e3f25da2f1

data/lib/dependabot/cargo/file_updater/workspace_manifest_updater.rb

@@ -64,7 +64,7 @@ module Dependabot
           updated_content
         end
 
-        sig { params(requirements: T.nilable(T::Array[T::Hash[Symbol, T.untyped]])).returns(T.nilable(String)) }
+        sig { params(requirements: T.nilable(T::Array[Dependabot::DependencyRequirement])).returns(T.nilable(String)) }
         def find_workspace_requirement(requirements)
           requirements&.find { |r| r[:groups]&.include?("workspace.dependencies") }
                       &.fetch(:requirement)

data/lib/dependabot/cargo/requirement.rb

@@ -50,7 +50,7 @@ module Dependabot
 
       # Parses a pre-commit Rust additional_dependency string.
       # Formats: "package_name:version", "cli:package_name:version"
-      sig { params(dep_string: String).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { params(dep_string: String).returns(T.nilable(T::Hash[Symbol, T.nilable(String)])) }
       def self.parse_dep_string(dep_string)
         stripped = dep_string.strip
         return nil if stripped.empty?

data/lib/dependabot/cargo/update_checker.rb

@@ -88,14 +88,16 @@ module Dependabot
         )
       end
 
-      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { override.returns(T::Array[Dependabot::DependencyRequirement]) }
       def updated_requirements
-        RequirementsUpdater.new(
-          requirements: dependency.requirements,
-          updated_source: updated_source,
-          target_version: target_version,
-          update_strategy: requirements_update_strategy
-        ).updated_requirements
+        wrap_requirements(
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            updated_source: updated_source,
+            target_version: target_version,
+            update_strategy: requirements_update_strategy
+          ).updated_requirements
+        )
       end
 
       sig { override.returns(T::Boolean) }
@@ -108,8 +110,12 @@ module Dependabot
         # If passed in as an option (in the base class) honour that option
         return @requirements_update_strategy if @requirements_update_strategy
 
-        # Otherwise, widen ranges for libraries and bump versions for apps
-        library? ? RequirementsUpdateStrategy::BumpVersionsIfNecessary : RequirementsUpdateStrategy::BumpVersions
+        # Cargo resolves to the newest compatible version and a bare version is a
+        # caret-equivalent (compatible) requirement, so only raise the requirement
+        # when it doesn't already allow the new version. Avoids needless churn and
+        # MSRV bumps.
+        # https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#caret-requirements
+        RequirementsUpdateStrategy::BumpVersionsIfNecessary
       end
 
       private
@@ -132,13 +138,12 @@ module Dependabot
         # present in other areas
         return unless preferred_resolvable_version
 
-        library? ? latest_version&.to_s : preferred_resolvable_version.to_s
+        # No lockfile: target the latest version. With one: the resolvable version.
+        no_lockfile? ? latest_version&.to_s : preferred_resolvable_version.to_s
       end
 
       sig { returns(T::Boolean) }
-      def library?
-        # If it has a lockfile, treat it as an application. Otherwise treat it
-        # as a library.
+      def no_lockfile?
         dependency_files.none? { |f| f.name == "Cargo.lock" }
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.381.0
+  version: 0.382.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.381.0
+        version: 0.382.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0
 rdoc_options: []
 require_paths:
 - lib