dependabot-cargo 0.389.0 → 0.390.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 336de17c7a677e7928495324abae0c8f8a5aae4c5356c406b772f5fb14680d09
-  data.tar.gz: 1bb5fd2e4cee631d59ef78516afec7e89dfc560f74b0433592f91d6fc36c2822
+  metadata.gz: 7c5589c34a68938c08db740569195c7374cc0f991efb982533f5525703dcafd8
+  data.tar.gz: 47e442e693cbbe9c2dde8882a08f5b52e72e11f1821f72704ce9e5a77b553da1
 SHA512:
-  metadata.gz: ee25b6339012047a96906577f0c4b2a43f0b00ad5b065e3e7105aa83d40ef195acb6abdb2555b73c44415b814832e770fdb49e413e420ccff982d70cb46eecb7
-  data.tar.gz: 94aa126678f0926aab9b953de5dad986d559a5632c98f510dc166419a9dbd8bf23606d48a8c4d9908c6ad5f8a9daa1e68b4bab36874e60445dcd2d857d9a8784
+  metadata.gz: 413ed1890c6b9fbaaba4f22315ca2c58d16293b8f50e20edfbc93f18eacea2c9242c5079eb1f6de745e89e08c5be1bae727ea8d466b6b3bffc8e411157f9f552
+  data.tar.gz: cc1c93979034f78bd6ac629708d55ff76a3802f0d0d6de6215aa093dfc710cab96caf082c4e50c917c13e9cf30eb0cfe22257764dca1f5087b2fb2406137eb30

data/lib/dependabot/cargo/file_parser.rb

@@ -19,7 +19,7 @@ require "dependabot/cargo/package_manager"
 # - https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html
 module Dependabot
   module Cargo
-    class FileParser < Dependabot::FileParsers::Base
+    class FileParser < Dependabot::FileParsers::Base # rubocop:disable Metrics/ClassLength
       require "dependabot/file_parsers/base/dependency_set"
 
       DEPENDENCY_TYPES =
@@ -34,6 +34,7 @@ module Dependabot
         dependency_set += lockfile_dependencies if lockfile
 
         dependencies = dependency_set.dependencies
+        add_lockfile_package_metadata(dependencies) if lockfile
 
         # TODO: Handle patched dependencies
         dependencies.reject! { |d| patched_dependencies.include?(d.name) }
@@ -208,8 +209,6 @@ module Dependabot
         T.cast(lockfile_content.fetch("package", []), T::Array[T::Hash[String, T.anything]]).each do |package_details|
           next unless T.cast(package_details["source"], T.nilable(String))
 
-          # TODO: This isn't quite right, as it will only give us one
-          # version of each dependency (when in fact there are many)
           dependency_set << Dependency.new(
             name: T.cast(package_details["name"], String),
             version: version_from_lockfile_details(package_details),
@@ -221,6 +220,29 @@ module Dependabot
         dependency_set
       end
 
+      sig { params(dependencies: T::Array[Dependabot::Dependency]).void }
+      def add_lockfile_package_metadata(dependencies)
+        packages_by_name = lockfile_packages(parsed_file(T.must(lockfile)))
+                           .select { |package| package_field(package, "source") }
+                           .group_by { |package| T.must(package_field(package, "name")) }
+
+        dependencies.each do |dependency|
+          packages = packages_by_name.fetch(dependency.name, [])
+          next if dependency.top_level?
+          next unless packages.length > 1
+
+          dependency.metadata[:all_versions] = packages.map do |package|
+            Dependency.new(
+              name: dependency.name,
+              version: version_from_lockfile_details(package),
+              package_manager: "cargo",
+              requirements: [],
+              metadata: { cargo_package_source: T.must(package_field(package, "source")) }
+            )
+          end
+        end
+      end
+
       sig { returns(T::Array[String]) }
       def patched_dependencies
         root_manifest = manifest_files.find { |f| f.name == "Cargo.toml" }

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -35,7 +35,8 @@ module Dependabot
           @dependencies = T.let(dependencies, T::Array[Dependabot::Dependency])
           @dependency_files = T.let(dependency_files, T::Array[Dependabot::DependencyFile])
           @credentials = T.let(credentials, T::Array[Dependabot::Credential])
-          @custom_specification = T.let(nil, T.nilable(String))
+          @custom_specifications = T.let({}, T::Hash[String, String])
+          @current_dependency = T.let(nil, T.nilable(Dependabot::Dependency))
           @git_ssh_requirements_to_swap = T.let(nil, T.nilable(T::Hash[String, String]))
           @manifest_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
           @path_dependency_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
@@ -49,31 +50,11 @@ module Dependabot
           base_directory = T.must(dependency_files.first).directory
           SharedHelpers.in_a_temporary_directory(base_directory) do
             write_temporary_dependency_files
-
-            SharedHelpers.with_git_configured(credentials: credentials) do
-              # Shell out to Cargo, which handles everything for us, and does
-              # so without doing an install (so it's fast).
-              run_cargo_command("cargo update -p #{dependency_spec}", fingerprint: "cargo update -p <dependency_spec>")
-            end
+            run_updates
 
             updated_lockfile = File.read("Cargo.lock")
             updated_lockfile = post_process_lockfile(updated_lockfile)
-
-            next updated_lockfile if updated_lockfile.include?(desired_lockfile_content)
-
-            # If exact version match fails, accept any update
-            if dependency_updated?(updated_lockfile, dependency)
-              actual_version = extract_actual_version(updated_lockfile, dependency.name)
-              if actual_version && actual_version != dependency.version
-                Dependabot.logger.info(
-                  "Cargo selected version #{actual_version} instead of #{dependency.version} for #{dependency.name} " \
-                  "due to dependency constraints"
-                )
-              end
-              next updated_lockfile
-            end
-
-            raise "Failed to update #{dependency.name}!"
+            validate_updates(updated_lockfile)
           end
         rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
           retry if better_specification_needed?(e)
@@ -91,10 +72,67 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
-        # Currently, there will only be a single updated dependency
         sig { returns(Dependabot::Dependency) }
         def dependency
-          T.must(dependencies.first)
+          @current_dependency || T.must(dependencies.first)
+        end
+
+        sig { void }
+        def run_updates
+          SharedHelpers.with_git_configured(credentials: credentials) do
+            # Shell out to Cargo, which handles everything for us, and does
+            # so without doing an install (so it's fast).
+            dependencies.each do |dependency_to_update|
+              @current_dependency = dependency_to_update
+              next if previous_line_already_replaced?
+
+              run_cargo_command(
+                "cargo update -p #{dependency_spec}",
+                fingerprint: "cargo update -p <dependency_spec>"
+              )
+            end
+          end
+        end
+
+        # An earlier command in this run may already have resolved this
+        # dependency's line, in which case `cargo update -p name:version`
+        # would match no package and fail hard. Skip the command when the
+        # working lockfile has no entry left at the previous version and let
+        # validate_updates check the outcome.
+        sig { returns(T::Boolean) }
+        def previous_line_already_replaced?
+          previous_version = dependency.previous_version
+          return false unless previous_version
+          return false if previous_version == dependency.version || git_dependency?
+          return false unless version_class.correct?(previous_version)
+
+          package_version_count(File.read("Cargo.lock"), dependency, previous_version).zero?
+        end
+
+        sig { params(updated_lockfile: String).returns(String) }
+        def validate_updates(updated_lockfile)
+          dependencies.each do |updated_dependency|
+            @current_dependency = updated_dependency
+            validate_dependency_update(updated_lockfile)
+          end
+
+          updated_lockfile
+        end
+
+        sig { params(updated_lockfile: String).void }
+        def validate_dependency_update(updated_lockfile)
+          return if desired_version_present?(updated_lockfile)
+          return if git_line_resolved_differently?(updated_lockfile)
+
+          raise "Failed to update #{dependency.name}!" unless dependency_updated?(updated_lockfile, dependency)
+
+          actual_version = extract_actual_version(updated_lockfile, dependency)
+          return unless actual_version && actual_version != dependency.version
+
+          Dependabot.logger.info(
+            "Cargo selected version #{actual_version} instead of #{dependency.version} " \
+            "for #{dependency.name} due to dependency constraints"
+          )
         end
 
         sig { params(error: StandardError).returns(T.noreturn) }
@@ -144,7 +182,7 @@ module Dependabot
         # rubocop:disable Metrics/AbcSize
         sig { params(error: StandardError).returns(T::Boolean) }
         def better_specification_needed?(error)
-          return false if @custom_specification
+          return false if custom_specification
           return false unless error.message.match?(/specification .* is ambigu/)
 
           spec_options = error.message.gsub(/.*following:\n/m, "")
@@ -157,7 +195,7 @@ module Dependabot
                 end
 
           if ver && spec_options.one? { |s| s.end_with?(ver) }
-            @custom_specification = spec_options.find { |s| s.end_with?(ver) }
+            @custom_specifications[dependency_identity] = T.must(spec_options.find { |s| s.end_with?(ver) })
             return true
           elsif ver && spec_options.count { |s| s.end_with?(ver) } > 1
             spec_options.select! { |s| s.end_with?(ver) }
@@ -168,7 +206,7 @@ module Dependabot
             spec_options.select! { |s| s.include?(T.must(git_source_url)) }
           end
 
-          @custom_specification = spec_options.first
+          @custom_specifications[dependency_identity] = T.must(spec_options.first)
           true
         end
         # rubocop:enable Metrics/AbcSize
@@ -177,7 +215,7 @@ module Dependabot
 
         sig { returns(String) }
         def dependency_spec
-          return @custom_specification if @custom_specification
+          return T.must(custom_specification) if custom_specification
 
           spec = dependency.name
 
@@ -190,12 +228,27 @@ module Dependabot
           spec
         end
 
+        sig { returns(T.nilable(String)) }
+        def custom_specification
+          @custom_specifications[dependency_identity]
+        end
+
+        sig { returns(String) }
+        def dependency_identity
+          [
+            dependency.name,
+            dependency.previous_version,
+            dependency.version,
+            dependency.metadata[:cargo_package_source]
+          ].join("\0")
+        end
+
         sig { returns(T.nilable(String)) }
         def git_previous_version
           TomlRB.parse(lockfile.content)
                 .fetch("package", [])
                 .select { |p| p["name"] == dependency.name }
-                .find { |p| p["source"].end_with?(dependency.previous_version) }
+                .find { |p| p["source"]&.end_with?(dependency.previous_version) }
                 &.fetch("version")
         end
 
@@ -213,6 +266,24 @@ module Dependabot
           %(name = "#{dependency.name}"\nversion = "#{dependency.version}")
         end
 
+        # The desired name/version pair may also appear under another source
+        # (e.g. a git fork at the released version), so scope the check to the
+        # locked package's source identity for numeric versions. Git
+        # dependencies keep the SHA substring check.
+        sig { params(updated_lockfile: String).returns(T::Boolean) }
+        def desired_version_present?(updated_lockfile)
+          version = T.must(dependency.version)
+          if git_dependency?
+            # Scope to the dependency's own git identity: another ref of the
+            # same repository already at the expected commit must not satisfy
+            # the check for the targeted line.
+            return git_source_shas(updated_lockfile).any? { |sha| sha.start_with?(version) }
+          end
+          return updated_lockfile.include?(desired_lockfile_content) unless version_class.correct?(version)
+
+          package_version_count(updated_lockfile, dependency, version).positive?
+        end
+
         sig { params(command: String, fingerprint: String).void }
         def run_cargo_command(command, fingerprint:)
           start = Time.now
@@ -578,43 +649,149 @@ module Dependabot
         def dependency_updated?(lockfile_content, dependency)
           return false unless dependency.previous_version
 
-          # For multiple versions case, we need to check the specific entry
-          # that corresponds to our dependency (the one used by our package)
+          target_line_versions(lockfile_content, dependency).any? do |version|
+            dependency.version_class.new(version) > dependency.version_class.new(T.must(dependency.previous_version))
+          end
+        end
+
+        sig do
+          params(lockfile_content: String, dependency: Dependabot::Dependency)
+            .returns(T.nilable(String))
+        end
+        def extract_actual_version(lockfile_content, dependency)
+          target_line_versions(lockfile_content, dependency).max_by do |version|
+            dependency.version_class.new(version)
+          end
+        end
+
+        sig do
+          params(lockfile_content: String, dependency: Dependabot::Dependency)
+            .returns(T::Array[String])
+        end
+        def target_line_versions(lockfile_content, dependency)
+          target_version = dependency.version
+          return [] unless target_version && dependency.version_class.correct?(target_version)
+
+          requirements = [dependency.previous_version, target_version].compact.uniq.filter_map do |version|
+            dependency.requirement_class.new(version) if dependency.version_class.correct?(version)
+          end
+          dependency_lockfile_entries(lockfile_content, dependency).filter_map do |entry|
+            version = entry[/^version = "([^"]+)"$/, 1]
+            next unless version && dependency.version_class.correct?(version)
+
+            parsed_version = dependency.version_class.new(version)
+            next unless requirements.any? { |requirement| requirement.satisfied_by?(parsed_version) }
+
+            version
+          end
+        end
+
+        sig do
+          params(lockfile_content: String, dependency: Dependabot::Dependency)
+            .returns(T::Array[String])
+        end
+        def dependency_lockfile_entries(lockfile_content, dependency)
           entries = T.let([], T::Array[String])
           lockfile_content.scan(LOCKFILE_ENTRY_REGEX) do
             entries << Regexp.last_match.to_s
           end
-          entries.select! { |entry| entry.include?("name = \"#{dependency.name}\"") }
+          entries.select! { |entry| entry.match?(/^name = "#{Regexp.escape(dependency.name)}"$/) }
+
+          source = dependency.metadata[:cargo_package_source]
+          if source
+            entries.select! { |entry| entry.include?(%(source = "#{source}")) }
+          else
+            # Without an exact source identity, restrict to registry-style
+            # entries: git-sourced copies and source-less workspace or path
+            # packages must not satisfy the checks. Registry entries of any
+            # protocol (registry+, sparse+) stay visible.
+            entries.select! { |entry| entry.match?(/^source = "(?!git\+)/) }
+          end
+          entries
+        end
 
-          # Check if any entry has a version newer than the previous version
-          entries.any? do |entry|
-            version_match = entry.match(/version = "([^"]+)"/)
-            next false unless version_match
+        # A git dependency can legitimately resolve to a different commit than
+        # the checker expected (e.g. the tracked branch advanced between the
+        # check and this update). Accept the update when the dependency's git
+        # line moved off the previous commit, mirroring the version tolerance
+        # for registry dependencies.
+        sig { params(updated_lockfile: String).returns(T::Boolean) }
+        def git_line_resolved_differently?(updated_lockfile)
+          return false unless git_dependency?
 
-            new_version = version_match[1]
-            # Only consider it updated if it's newer than the previous version
-            # and either matches our expected version or is at least newer than previous
-            dependency.version_class.new(new_version) > dependency.version_class.new(dependency.previous_version)
-          end
+          previous_sha = dependency.previous_version
+          return false unless previous_sha
+
+          shas = git_source_shas(updated_lockfile)
+          # SHA comparisons use prefix semantics, matching the update
+          # checkers: previous_version may be an abbreviated commit.
+          return false if shas.empty? || shas.any? { |sha| sha.start_with?(previous_sha) }
+
+          Dependabot.logger.info(
+            "Cargo resolved #{dependency.name} to #{shas.join(', ')} " \
+            "instead of #{dependency.version} for the tracked git reference"
+          )
+          true
         end
 
-        sig { params(lockfile_content: String, dependency_name: String).returns(T.nilable(String)) }
-        def extract_actual_version(lockfile_content, dependency_name)
+        sig { params(lockfile_content: String).returns(T::Array[String]) }
+        def git_source_shas(lockfile_content)
           entries = T.let([], T::Array[String])
           lockfile_content.scan(LOCKFILE_ENTRY_REGEX) do
             entries << Regexp.last_match.to_s
           end
-          entries.select! { |entry| entry.include?("name = \"#{dependency_name}\"") }
+          entries.select! { |entry| entry.match?(/^name = "#{Regexp.escape(dependency.name)}"$/) }
+          entries.select! { |entry| entry.match?(/^source = "git\+/) }
 
-          # Get the highest version from matching entries
-          versions = entries.filter_map do |entry|
-            version_match = entry.match(/version = "([^"]+)"/)
-            version_match&.captures&.first
-          end
+          scope_entries_to_git_identity(entries)
+            .filter_map { |entry| entry[/^source = "git\+[^"]*#([0-9a-f]+)"$/, 1] }
+        end
 
-          return nil if versions.empty?
+        # Fail closed: the current identity serializes deterministically into
+        # the lockfile source string, so entries that don't match it are other
+        # identities, never fallbacks. An empty result means the expected
+        # identity is absent and validation must fail.
+        sig { params(entries: T::Array[String]).returns(T::Array[String]) }
+        def scope_entries_to_git_identity(entries)
+          url = git_source_detail(:url)
+          return entries unless url
+
+          entries.select { |entry| entry.match?(git_identity_pattern(url)) }
+        end
 
-          versions.max_by { |v| version_class.new(v) }
+        # Anchors the URL and ref together at the start of the source value so
+        # a prefix-related repository URL cannot satisfy the match.
+        sig { params(url: String).returns(Regexp) }
+        def git_identity_pattern(url)
+          base = "^source = \"git\\+#{Regexp.escape(url)}"
+          branch = git_source_detail(:branch)
+          return /#{base}\?branch=#{Regexp.escape(branch)}#/ if branch
+
+          ref = git_source_detail(:ref)
+          return /#{base}\?(?:tag|rev)=#{Regexp.escape(ref)}#/ if ref
+
+          /#{base}#/
+        end
+
+        # The updated lockfile is serialized with the dependency's current git
+        # identity (a ref change updates the source string), so prefer the
+        # current requirement's git source as a whole and use the previous one
+        # only when no current git source exists.
+        sig { params(key: Symbol).returns(T.nilable(String)) }
+        def git_source_detail(key)
+          source = dependency.requirements.find { |r| r.dig(:source, :type) == "git" }&.dig(:source) ||
+                   dependency.previous_requirements&.find { |r| r.dig(:source, :type) == "git" }&.dig(:source)
+          source&.dig(key)
+        end
+
+        sig do
+          params(lockfile_content: String, dependency: Dependabot::Dependency, version: String)
+            .returns(Integer)
+        end
+        def package_version_count(lockfile_content, dependency, version)
+          dependency_lockfile_entries(lockfile_content, dependency).count do |entry|
+            entry.match?(/^version = "#{Regexp.escape(version)}"$/)
+          end
         end
       end
       # rubocop:enable Metrics/ClassLength

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -106,22 +106,140 @@ module Dependabot
           versions = TomlRB.parse(lockfile_content).fetch("package")
                            .select { |p| p["name"] == dependency.name }
 
-          updated_version =
-            if dependency.top_level?
-              versions.max_by { |p| version_class.new(p.fetch("version")) }
-            else
-              versions.min_by { |p| version_class.new(p.fetch("version")) }
-            end
+          updated_version = updated_package(versions)
 
           return unless updated_version
 
           if git_dependency?
-            updated_version.fetch("source").split("#").last
+            T.cast(updated_version.fetch("source"), String).split("#").last
           else
-            updated_version.fetch("version")
+            T.cast(updated_version.fetch("version"), String)
           end
         end
 
+        sig do
+          params(
+            packages: T::Array[T::Hash[String, T.anything]]
+          ).returns(T.nilable(T::Hash[String, T.anything]))
+        end
+        def updated_package(packages)
+          if dependency.top_level?
+            packages.max_by do |package|
+              version_class.new(T.cast(package.fetch("version"), String))
+            end
+          else
+            updated_package_for_locked_identity(packages) ||
+              packages.min_by do |package|
+                version_class.new(T.cast(package.fetch("version"), String))
+              end
+          end
+        end
+
+        sig do
+          params(
+            updated_packages: T::Array[T::Hash[String, T.anything]]
+          ).returns(T.nilable(T::Hash[String, T.anything]))
+        end
+        def updated_package_for_locked_identity(updated_packages)
+          target = original_target_package
+          return unless target
+
+          source = T.cast(target["source"], T.nilable(String))
+          candidates = updated_package_candidates(updated_packages, target)
+
+          # Cargo can split a unified line across a version boundary, adding a
+          # new package while retaining the old one for dependents that still
+          # need it. A newly introduced identity is the update; the retained
+          # line only answers when nothing new appeared.
+          fresh = candidates.reject { |package| package_identity(package) == package_identity(target) }
+          return fresh.max_by { |package| version_class.new(T.cast(package.fetch("version"), String)) } if fresh.any?
+
+          candidates.find { |package| version_from_package(package) == dependency.version } ||
+            compatible_packages(updated_packages, source).max_by do |package|
+              version_class.new(T.cast(package.fetch("version"), String))
+            end
+        end
+
+        sig { returns(T.nilable(T::Hash[String, T.anything])) }
+        def original_target_package
+          return unless dependency.version
+
+          targets = original_packages_for_dependency.select do |package|
+            version_from_package(package) == dependency.version
+          end
+
+          package_source = T.cast(dependency.metadata[:cargo_package_source], T.nilable(String))
+          if package_source
+            targets.select! do |package|
+              T.cast(package["source"], T.nilable(String)) == package_source
+            end
+          end
+          targets.first if targets.one?
+        end
+
+        sig do
+          params(
+            updated_packages: T::Array[T::Hash[String, T.anything]],
+            target: T::Hash[String, T.anything]
+          ).returns(T::Array[T::Hash[String, T.anything]])
+        end
+        def updated_package_candidates(updated_packages, target)
+          target_source = T.cast(target["source"], T.nilable(String))
+          other_identities = original_packages_for_dependency
+                             .map { |package| package_identity(package) }
+          target_index = other_identities.index(package_identity(target))
+          other_identities.delete_at(target_index) if target_index
+
+          updated_packages
+            .select { |package| T.cast(package["source"], T.nilable(String)) == target_source }
+            .reject { |package| other_identities.include?(package_identity(package)) }
+        end
+
+        sig { returns(T::Array[T::Hash[String, T.anything]]) }
+        def original_packages_for_dependency
+          original_lockfile_packages.select do |package|
+            T.cast(package["name"], T.nilable(String)) == dependency.name
+          end
+        end
+
+        sig { returns(T::Array[T::Hash[String, T.anything]]) }
+        def original_lockfile_packages
+          original_lockfile = original_dependency_files.find { |file| file.name == "Cargo.lock" }
+          return [] unless original_lockfile
+
+          T.cast(
+            TomlRB.parse(T.must(original_lockfile.content)).fetch("package", []),
+            T::Array[T::Hash[String, T.anything]]
+          )
+        end
+
+        sig do
+          params(
+            packages: T::Array[T::Hash[String, T.anything]],
+            source: T.nilable(String)
+          ).returns(T::Array[T::Hash[String, T.anything]])
+        end
+        def compatible_packages(packages, source)
+          requirement = Requirement.new(T.must(dependency.version))
+          packages.select do |package|
+            T.cast(package["source"], T.nilable(String)) == source &&
+              requirement.satisfied_by?(version_class.new(T.cast(package.fetch("version"), String)))
+          end
+        end
+
+        sig { params(package: T::Hash[String, T.anything]).returns(T::Array[T.anything]) }
+        def package_identity(package)
+          [package["name"], package["version"], package["source"]]
+        end
+
+        sig { params(package: T::Hash[String, T.anything]).returns(String) }
+        def version_from_package(package)
+          source = T.cast(package["source"], T.nilable(String))
+          return T.must(source.split("#").last) if source&.start_with?("git+")
+
+          T.cast(package.fetch("version"), String)
+        end
+
         # rubocop:disable Metrics/PerceivedComplexity
         # rubocop:disable Metrics/CyclomaticComplexity
         # rubocop:disable Metrics/AbcSize
@@ -491,8 +609,8 @@ module Dependabot
           TomlRB.parse(T.must(lockfile).content)
                 .fetch("package", [])
                 .select { |p| p["name"] == dependency.name }
-                .find { |p| p["source"].end_with?(dependency.version) }
-                .fetch("version")
+                .find { |p| p["source"]&.end_with?(dependency.version) }
+                &.fetch("version")
         end
 
         sig { returns(T.nilable(String)) }

data/lib/dependabot/cargo/update_checker.rb

@@ -10,7 +10,7 @@ require "dependabot/update_checkers/base"
 
 module Dependabot
   module Cargo
-    class UpdateChecker < Dependabot::UpdateCheckers::Base
+    class UpdateChecker < Dependabot::UpdateCheckers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
       require_relative "update_checker/latest_version_finder"
@@ -18,10 +18,50 @@ module Dependabot
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/file_preparer"
 
+      sig { override.returns(T::Boolean) }
+      def up_to_date?
+        return super unless multiple_locked_versions?
+
+        raise Dependabot::AllVersionsIgnored if only_ignored_updates_remaining?
+
+        all_lines_current?
+      end
+
+      sig { override.params(requirements_to_unlock: T.nilable(Symbol)).returns(T::Boolean) }
+      def can_update?(requirements_to_unlock:)
+        return super unless multiple_locked_versions?
+
+        results, ignored_count = locked_version_results(false) do |checker|
+          checker.can_update?(requirements_to_unlock: requirements_to_unlock)
+        end
+        updatable = results.any?
+        raise Dependabot::AllVersionsIgnored if ignored_count.positive? && !updatable
+
+        updatable
+      end
+
+      sig do
+        override.params(requirements_to_unlock: T.nilable(Symbol))
+                .returns(T::Array[Dependabot::Dependency])
+      end
+      def updated_dependencies(requirements_to_unlock:)
+        return super unless multiple_locked_versions?
+
+        results, ignored_count = locked_version_results([]) do |checker|
+          checker.updated_dependencies(requirements_to_unlock: requirements_to_unlock)
+        end
+        updates = results.flatten
+        raise Dependabot::AllVersionsIgnored if ignored_count.positive? && updates.empty?
+
+        updates
+      end
+
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
         return if path_dependency?
 
+        raise Dependabot::AllVersionsIgnored if multiple_locked_versions? && only_ignored_updates_remaining?
+
         @latest_version = T.let(
           if git_dependency?
             latest_version_for_git_dependency
@@ -57,6 +97,8 @@ module Dependabot
 
       sig { override.returns(T.nilable(Gem::Version)) }
       def lowest_security_fix_version
+        raise Dependabot::AllVersionsIgnored if multiple_locked_versions? && only_ignored_updates_remaining?
+
         latest_version_finder.lowest_security_fix_version
       end
 
@@ -349,6 +391,113 @@ module Dependabot
         dependency.source_type == "path"
       end
 
+      sig { returns(T::Boolean) }
+      def multiple_locked_versions?
+        sources = locked_version_dependencies.map { |candidate| candidate.metadata[:cargo_package_source] }.uniq
+        !dependency.top_level? && locked_version_dependencies.length > 1 && sources.one?
+      end
+
+      sig { returns(T::Array[Dependabot::Dependency]) }
+      def locked_version_dependencies
+        @locked_version_dependencies ||= T.let(
+          begin
+            all_versions = dependency.metadata[:all_versions]
+            candidates = all_versions.is_a?(Array) ? all_versions.grep(Dependabot::Dependency) : []
+            numeric_candidates = candidates.select do |candidate|
+              !candidate.top_level? && version_class.correct?(candidate.version)
+            end
+            numeric_candidates.uniq { |candidate| [candidate.version, candidate.metadata[:cargo_package_source]] }
+          end,
+          T.nilable(T::Array[Dependabot::Dependency])
+        )
+      end
+
+      sig { returns(T::Array[Dependabot::Cargo::UpdateChecker]) }
+      def locked_version_checkers
+        @locked_version_checkers ||= T.let(
+          locked_version_dependencies_to_check.map do |locked_dependency|
+            self.class.new(
+              dependency: locked_dependency,
+              dependency_files: dependency_files,
+              repo_contents_path: repo_contents_path,
+              credentials: credentials,
+              ignored_versions: ignored_versions,
+              security_advisories: security_advisories,
+              raise_on_ignored: raise_on_ignored,
+              requirements_update_strategy: requirements_update_strategy,
+              dependency_group: dependency_group,
+              update_cooldown: update_cooldown,
+              options: options
+            )
+          end,
+          T.nilable(T::Array[Dependabot::Cargo::UpdateChecker])
+        )
+      end
+
+      # The operations layer only rescues AllVersionsIgnored around its
+      # preflight probes (latest_version, and lowest_security_fix_version for
+      # security jobs); anywhere else the error halts the whole update run.
+      # These helpers let those probes raise when ignored lines leave nothing
+      # actionable, so a mixed ignored/at-ceiling dependency surfaces as a
+      # clean ignored skip, and the aggregate overrides below can never be
+      # the first place the error appears.
+      sig { returns(T::Boolean) }
+      def only_ignored_updates_remaining?
+        evaluate_locked_line_currency
+        T.must(@only_ignored_updates_remaining)
+      end
+
+      sig { returns(T::Boolean) }
+      def all_lines_current?
+        evaluate_locked_line_currency
+        T.must(@all_lines_current)
+      end
+
+      sig { void }
+      def evaluate_locked_line_currency
+        return if defined?(@all_lines_current)
+
+        results, ignored_count = locked_version_results(true) do |checker|
+          checker.up_to_date? || checker.latest_resolvable_version&.to_s == checker.dependency.version
+        end
+        @all_lines_current = T.let(results.all?, T.nilable(T::Boolean))
+        @only_ignored_updates_remaining = T.let(ignored_count.positive? && results.all?, T.nilable(T::Boolean))
+      end
+
+      # Evaluates the block for every locked-line checker, substituting
+      # ignored_result for lines whose updates are all ignored. Returns the
+      # results alongside the ignored-line count so callers can re-raise
+      # AllVersionsIgnored when ignored lines exist and no other line yields
+      # an actionable result.
+      sig do
+        type_parameters(:U)
+          .params(
+            ignored_result: T.type_parameter(:U),
+            _blk: T.proc.params(checker: Dependabot::Cargo::UpdateChecker).returns(T.type_parameter(:U))
+          ).returns([T::Array[T.type_parameter(:U)], Integer])
+      end
+      def locked_version_results(ignored_result, &_blk)
+        ignored_count = 0
+        results = locked_version_checkers.map do |checker|
+          yield(checker)
+        rescue Dependabot::AllVersionsIgnored
+          ignored_count += 1
+          ignored_result
+        end
+
+        [results, ignored_count]
+      end
+
+      sig { returns(T::Array[Dependabot::Dependency]) }
+      def locked_version_dependencies_to_check
+        return locked_version_dependencies if security_advisories.empty?
+
+        locked_version_dependencies.select do |candidate|
+          version = version_class.new(T.must(candidate.version))
+          security_advisories.any? { |advisory| advisory.vulnerable?(version) }
+        end
+      end
+
       sig { returns(GitCommitChecker) }
       def git_commit_checker
         @git_commit_checker = T.let(

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.389.0
+  version: 0.390.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.389.0
+        version: 0.390.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.389.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0
 rdoc_options: []
 require_paths:
 - lib