dependabot-cargo 0.384.0 → 0.385.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce6cbf95fb2a0787ae301e7c335ee65cc944996b5219eaba62874cdff315ffe4
-  data.tar.gz: 7b359e82973b40e2fc92e2c53e8c7eb9928ba1bded71a1e283849b4d91f7ffc5
+  metadata.gz: fe49d45601f5fe58da2ee6fad020f1edb4db50a2d9f2f2d47d1b0348cde16ff8
+  data.tar.gz: b01be9ba87a3a0a452e5e24fc8c8809c29342b119ba1de6477de77cedf6de58b
 SHA512:
-  metadata.gz: cee18fdefcd2ec3d06a882b08ab5f19da946e83eb38133e3a94273078baf2a460514a8e7e65281ae4d193a3643920e44f23eca9b3b4cddfef6a66ca174b730d1
-  data.tar.gz: 1dbadf2bbad402e5862d30e81e89e4add62dce33e7e59661d9330d55b49a8b390db34a96b26c205a346e7a56e3ff643c1ed2095714033904c5dde157a176ab54
+  metadata.gz: d14c302e2b6ac9b4b209dd5bc21d14f2062bf04220369c7f79a56c4affc6d5fdb2fd48042045c06a354c7c7c4a418db1130fc9e77eeb90adb8745d39eb94d896
+  data.tar.gz: 1f64b3f3937048eda866e9f9bb0b137803dc9174cf86574ea6556479e9e24779e3066c7fbf348e8d8b616f403974db53f13b9d0124ee0b814e10a921b63a652f

data/lib/dependabot/cargo/file_fetcher.rb

@@ -47,7 +47,7 @@ module Dependabot
       def fetch_files
         fetched_files = T.let([cargo_toml], T::Array[DependencyFile])
         fetched_files << T.must(cargo_lock) if cargo_lock
-        fetched_files << T.must(cargo_config) if cargo_config
+        fetched_files.concat(cargo_configs)
         fetched_files << T.must(rust_toolchain) if rust_toolchain
         fetched_files += fetch_path_dependency_and_workspace_files
         parsed_manifest = parsed_file(cargo_toml)
@@ -428,19 +428,53 @@ module Dependabot
         @cargo_lock ||= T.let(fetch_file_if_present("Cargo.lock"), T.nilable(Dependabot::DependencyFile))
       end
 
+      # Cargo merges configuration hierarchically: it reads `.cargo/config.toml`
+      # from the package directory *and* every ancestor directory up to the repo
+      # root, combining them. We therefore collect all of them so that registries
+      # (and other settings) defined higher up the tree are not dropped.
+      #
+      # The package-directory config keeps the canonical name `.cargo/config.toml`
+      # (single-config consumers rely on this). Ancestor configs keep their
+      # relative `../` paths so they are written to the correct location and can
+      # be merged by Cargo. When the package directory has no config of its own,
+      # the nearest ancestor is promoted to the canonical name to preserve the
+      # historical behaviour that downstream consumers depend on.
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def cargo_configs
+        return T.must(@cargo_configs) if defined?(@cargo_configs)
+
+        configs = T.let([], T::Array[Dependabot::DependencyFile])
+        local = local_cargo_config
+        parents = parent_dir_cargo_configs
+
+        if local
+          configs << local
+          configs.concat(parents)
+        elsif parents.any?
+          effective = T.must(parents.first)
+          effective.name = ".cargo/config.toml"
+          configs << effective
+          configs.concat(parents.drop(1))
+        end
+
+        @cargo_configs = T.let(configs, T.nilable(T::Array[Dependabot::DependencyFile]))
+        configs
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def cargo_config
-        return @cargo_config if defined?(@cargo_config)
+        cargo_configs.find { |f| f.name == ".cargo/config.toml" }
+      end
+
+      sig { returns(T.nilable(Dependabot::DependencyFile)) }
+      def local_cargo_config
+        return @local_cargo_config if defined?(@local_cargo_config)
 
-        @cargo_config = fetch_support_file(".cargo/config.toml")
-        @cargo_config ||= T.let(
+        @local_cargo_config = fetch_support_file(".cargo/config.toml")
+        @local_cargo_config ||= T.let(
           fetch_support_file(".cargo/config")&.tap { |f| f.name = ".cargo/config.toml" },
           T.nilable(Dependabot::DependencyFile)
         )
-        @cargo_config ||= T.let(
-          fetch_cargo_config_from_parent_dirs,
-          T.nilable(Dependabot::DependencyFile)
-        )
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -470,22 +504,26 @@ module Dependabot
         super.tap { |f| f.name = Pathname.new(f.name).cleanpath.to_s.gsub(%r{^/+}, "") }
       end
 
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      def fetch_cargo_config_from_parent_dirs
-        return nil if directory.empty?
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def parent_dir_cargo_configs
+        return T.must(@parent_dir_cargo_configs) if defined?(@parent_dir_cargo_configs)
+
+        configs = T.let([], T::Array[Dependabot::DependencyFile])
+        @parent_dir_cargo_configs = T.let(configs, T.nilable(T::Array[Dependabot::DependencyFile]))
+        return configs if directory.empty?
 
         # Count directory depth to determine how many levels to search up
         depth = directory.split("/").count { |s| !s.empty? }
-        return nil if depth.zero?
+        return configs if depth.zero?
 
-        # Try each parent directory level
+        # Collect a config from every ancestor directory that has one, nearest first
         depth.times do |i|
           parent_path = ([".."] * (i + 1)).join("/")
           config = try_fetch_config_at_path(parent_path)
-          return config if config
+          configs << config if config
         end
 
-        nil
+        configs
       end
 
       sig { params(parent_path: String).returns(T.nilable(Dependabot::DependencyFile)) }
@@ -499,7 +537,9 @@ module Dependabot
           )
           Dependabot.logger.debug("Successfully fetched config from: #{full_path}")
           config.support_file = true
-          config.name = ".cargo/config.toml"
+          # Normalise `.cargo/config` to `.cargo/config.toml` while preserving the
+          # relative `../` path so the file is written to the right location.
+          config.name = Pathname.new(File.join(parent_path, ".cargo/config.toml")).cleanpath.to_s
           return config
         rescue Dependabot::DependencyFileNotFound
           Dependabot.logger.debug("No config found at: #{full_path}")

data/lib/dependabot/cargo/file_parser.rb

@@ -332,10 +332,15 @@ module Dependabot
 
       sig { params(key_name: String).returns(T.nilable(String)) }
       def cargo_config_from_file(key_name)
-        config_file = cargo_config
-        return nil unless config_file
+        # Cargo merges `.cargo/config.toml` hierarchically, with nearer configs
+        # taking precedence over ancestors. Search the package-directory config
+        # first, then each ancestor config, returning the first match.
+        cargo_config_files.each do |config_file|
+          value = parsed_file(config_file).dig(*key_name.split("."))
+          return value if value
+        end
 
-        parsed_file(config_file).dig(*key_name.split("."))
+        nil
       end
 
       sig { params(name: String, declaration: T.any(String, T::Hash[String, String])).returns(T.nilable(String)) }
@@ -422,9 +427,18 @@ module Dependabot
         @lockfile ||= T.let(get_original_file("Cargo.lock"), T.nilable(Dependabot::DependencyFile))
       end
 
-      sig { returns(T.nilable(Dependabot::DependencyFile)) }
-      def cargo_config
-        @cargo_config ||= T.let(get_original_file(".cargo/config.toml"), T.nilable(Dependabot::DependencyFile))
+      # All `.cargo/config.toml` files in the fetched set, ordered nearest-first
+      # (package directory config, then successive ancestors). Ancestor configs
+      # carry relative `../` names, so we order by `../` depth to reflect Cargo's
+      # nearest-wins precedence.
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def cargo_config_files
+        @cargo_config_files ||= T.let(
+          dependency_files
+            .select { |f| f.name.end_with?(".cargo/config.toml") }
+            .sort_by { |f| f.name.scan("../").count },
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
       sig { returns(T.class_of(Dependabot::Version)) }

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -41,7 +41,7 @@ module Dependabot
           @path_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
           @lockfile = T.let(nil, T.nilable(Dependabot::DependencyFile))
           @toolchain = T.let(nil, T.nilable(Dependabot::DependencyFile))
-          @config = T.let(nil, T.nilable(Dependabot::DependencyFile))
+          @config_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
         end
 
         sig { returns(T.any(String, T.noreturn)) }
@@ -305,11 +305,13 @@ module Dependabot
 
           File.write(lockfile.name, replace_ssh_urls(T.must(lockfile.content)))
           File.write(T.must(toolchain).name, T.must(toolchain).content) if toolchain
-          config_file = config
-          return unless config_file
-
-          FileUtils.mkdir_p(File.dirname(config_file.name))
-          File.write(config_file.name, Helpers.sanitize_cargo_config(T.must(config_file.content)))
+          config_files.each do |config_file|
+            FileUtils.mkdir_p(File.dirname(config_file.name))
+            File.write(
+              config_file.name,
+              Helpers.sanitize_cargo_config(T.must(config_file.content), file_name: config_file.name)
+            )
+          end
         end
 
         sig { void }
@@ -537,9 +539,12 @@ module Dependabot
             dependency_files.find { |f| f.name == "rust-toolchain" }
         end
 
-        sig { returns(T.nilable(Dependabot::DependencyFile)) }
-        def config
-          @config ||= dependency_files.find { |f| f.name == ".cargo/config.toml" }
+        # Cargo merges `.cargo/config.toml` hierarchically (package directory plus
+        # every ancestor up to the repo root), so we materialise all of them and
+        # let Cargo perform the merge with its own precedence rules.
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def config_files
+          @config_files ||= dependency_files.select { |f| f.name.end_with?(".cargo/config.toml") }
         end
 
         sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }

data/lib/dependabot/cargo/helpers.rb

@@ -19,8 +19,8 @@ module Dependabot
       # These per-registry settings override the global CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS env var,
       # causing Cargo to look up tokens locally. Since the dependabot proxy handles all registry authentication
       # transparently, we remove these so Cargo makes plain unauthenticated requests that the proxy can intercept.
-      sig { params(config_content: String).returns(String) }
-      def self.sanitize_cargo_config(config_content)
+      sig { params(config_content: String, file_name: String).returns(String) }
+      def self.sanitize_cargo_config(config_content, file_name: ".cargo/config.toml")
         parsed = TomlRB.parse(config_content)
         return config_content unless parsed.is_a?(Hash)
 
@@ -40,7 +40,7 @@ module Dependabot
         TomlRB.dump(parsed)
       rescue TomlRB::Error => e
         raise Dependabot::DependencyFileNotParseable.new(
-          ".cargo/config.toml",
+          file_name,
           "Failed to parse Cargo config file: #{e.message}"
         )
       end
@@ -109,10 +109,17 @@ module Dependabot
         ).returns(T::Hash[String, String])
       end
       def self.registry_token_env_from_files(dependency_files, credentials)
-        config_file = dependency_files.find { |f| f.name == ".cargo/config.toml" }
-        return {} unless config_file
-
-        registry_token_env(T.must(config_file.content), credentials)
+        config_files = dependency_files.select { |f| f.name.end_with?(".cargo/config.toml") }
+        return {} if config_files.empty?
+
+        # Cargo gives nearer configs precedence over ancestors on key collisions.
+        # A config's `../` depth (how many parent hops appear in its name)
+        # indicates how far up the tree it lives, so merge farthest-first and let
+        # the nearest config (fewest `../`) win.
+        ordered = config_files.sort_by { |f| -f.name.scan("../").count }
+        ordered.each_with_object({}) do |config_file, env|
+          env.merge!(registry_token_env(T.must(config_file.content), credentials))
+        end
       end
 
       # Builds the complete environment variable hash for running cargo commands:

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -207,17 +207,19 @@ module Dependabot
           )
         end
 
-        sig { params(prepared: T::Boolean).returns(T.nilable(Integer)) }
+        sig { params(prepared: T::Boolean).void }
         def write_temporary_dependency_files(prepared: true)
           write_manifest_files(prepared: prepared)
 
           File.write(T.must(lockfile).name, T.must(lockfile).content) if lockfile
           File.write(T.must(toolchain).name, T.must(toolchain).content) if toolchain
-          config_file = config
-          return unless config_file
-
-          FileUtils.mkdir_p(File.dirname(config_file.name))
-          File.write(config_file.name, Helpers.sanitize_cargo_config(T.must(config_file.content)))
+          config_files.each do |config_file|
+            FileUtils.mkdir_p(File.dirname(config_file.name))
+            File.write(
+              config_file.name,
+              Helpers.sanitize_cargo_config(T.must(config_file.content), file_name: config_file.name)
+            )
+          end
         end
 
         sig { void }
@@ -554,13 +556,18 @@ module Dependabot
           )
         end
 
-        sig { returns(T.nilable(DependencyFile)) }
-        def config
-          @config ||= T.let(
-            original_dependency_files.find do |f|
-              f.name == ".cargo/config.toml"
+        # Cargo merges `.cargo/config.toml` hierarchically (package directory plus
+        # every ancestor up to the repo root), so we materialise all of them and
+        # let Cargo perform the merge with its own precedence rules. Ancestor
+        # configs carry relative `../` names and are written to the matching
+        # location within the temporary tree.
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        def config_files
+          @config_files ||= T.let(
+            original_dependency_files.select do |f|
+              f.name.end_with?(".cargo/config.toml")
             end,
-            T.nilable(Dependabot::DependencyFile)
+            T.nilable(T::Array[Dependabot::DependencyFile])
           )
         end
 

data/lib/dependabot/cargo/update_checker.rb

@@ -178,7 +178,7 @@ module Dependabot
         # we want to update that tag. The latest version will then be the SHA
         # of the latest tag that looks like a version.
         if git_commit_checker.pinned_ref_looks_like_version?
-          latest_tag = git_commit_checker.local_tag_for_latest_version
+          latest_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
           return latest_tag&.fetch(:commit_sha) || dependency.version
         end
 
@@ -198,7 +198,7 @@ module Dependabot
         # of the latest tag that looks like a version.
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
-          new_tag = git_commit_checker.local_tag_for_latest_version
+          new_tag = git_commit_checker.local_tag_for_latest_version(update_cooldown)
           return T.must(new_tag).fetch(:commit_sha)
         end
 
@@ -220,9 +220,9 @@ module Dependabot
 
         @latest_git_tag_is_resolvable_checked = true
 
-        return false if git_commit_checker.local_tag_for_latest_version.nil?
+        return false if git_commit_checker.local_tag_for_latest_version(update_cooldown).nil?
 
-        replacement_tag = T.must(git_commit_checker.local_tag_for_latest_version)
+        replacement_tag = T.must(git_commit_checker.local_tag_for_latest_version(update_cooldown))
 
         prepared_files = FilePreparer.new(
           dependency_files: dependency_files,
@@ -319,7 +319,7 @@ module Dependabot
         # Update the git tag if updating a pinned version
         if git_commit_checker.pinned_ref_looks_like_version? &&
            latest_git_tag_is_resolvable?
-          new_tag = T.must(git_commit_checker.local_tag_for_latest_version)
+          new_tag = T.must(git_commit_checker.local_tag_for_latest_version(update_cooldown))
           return T.must(dependency_source_details).merge(ref: new_tag.fetch(:tag))
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.385.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.385.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.385.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.385.0
 rdoc_options: []
 require_paths:
 - lib