dependabot-cargo 0.394.0 → 0.395.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05b8b9151f40c346f78a07209d9880fca5ad0d524c5f0664cd343fa234fcec1e
-  data.tar.gz: 3355e45e2e4b29238b096f1e9b171d22d267a2ebdcffe0d38e08250eca79aa1a
+  metadata.gz: 9b774b8f0b2b8a0a3fb28c32b85cd5efabfaa4a676f56cd01137046dd0a94363
+  data.tar.gz: 2a76d52fcea41bdc97f7774e764cf3c48a2cace477ebe3c4f7bb7ea88ca52873
 SHA512:
-  metadata.gz: 7382a767e5b8b3c2d05ded80f913c1e19aa02963a0216ed00d592199ee73354762b7b757e3ea1b7992a25e00e895082b86e4e52381be4f8adf0662e5a26fb748
-  data.tar.gz: a8f142ebf3dd3f37fb2421e8efe9e807a9141fa70ea1c1cf1effd919af5cee3da0533901d549780cc18441125824a79a088d189f3283b7c5e8aec6906e2033a4
+  metadata.gz: 0b9114edb24783f52711d7bd51296872c31d984794c969c8c1d392ea4d61c2883b203c33f14399f0652b51334f2087d01b6e96e5099e2cde60b7d4579f131958
+  data.tar.gz: 891667fa1b9ed313360204bb6b1ce23ce653222f3516d23f2e90635eec26fa58c1bec50b3c35b65ccd92f138099747ce7a664bc7e20179d95fe6335247b15e80

data/lib/dependabot/cargo/file_parser.rb

@@ -111,7 +111,7 @@ module Dependabot
         return unless workspace_config
 
         msg = "This project is part of a Rust workspace but is not the " \
-              "workspace root." \
+              "workspace root."
 
         if cargo_toml&.directory != "/"
           msg += "Please update your settings so Dependabot points at the " \

data/lib/dependabot/cargo/file_updater/lockfile_updater.rb

@@ -13,7 +13,7 @@ require "dependabot/shared_helpers"
 module Dependabot
   module Cargo
     class FileUpdater
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class LockfileUpdater
         extend T::Sig
 
@@ -86,14 +86,69 @@ module Dependabot
               @current_dependency = dependency_to_update
               next if previous_line_already_replaced?
 
+              lockfile_before = File.read("Cargo.lock")
               run_cargo_command(
                 "cargo update -p #{dependency_spec}",
                 fingerprint: "cargo update -p <dependency_spec>"
               )
+
+              force_precise_update if precise_update_needed?(lockfile_before)
             end
           end
         end
 
+        # The `--precise` retry is a best-effort recovery, not a hard gate. If
+        # the movement detector misfires (e.g. an earlier command already
+        # repointed this dependency while another consumer legitimately keeps
+        # the old version), forcing `--precise` can fail on the surviving
+        # transitive requirement. Swallow that failure, restore the plain
+        # result, and let `validate_updates` decide — it tolerates "Cargo
+        # selected a different valid version" and fails only on a real no-op.
+        sig { void }
+        def force_precise_update
+          lockfile_before_precise = File.read("Cargo.lock")
+          run_cargo_command(
+            "cargo update -p #{dependency_spec} --precise #{dependency.version}",
+            fingerprint: "cargo update -p <dependency_spec> --precise <version>"
+          )
+        rescue Dependabot::SharedHelpers::HelperSubprocessFailed => e
+          Dependabot.logger.info(
+            "Precise fallback for #{dependency.name} failed (#{e.message.lines.first&.strip}); " \
+            "keeping the plain update result for validation"
+          )
+          File.write("Cargo.lock", lockfile_before_precise)
+        end
+
+        # `cargo update -p name:version` won't move a package whose bump
+        # requires lockstep updates to sibling crates shared with other members
+        # (e.g. the `futures` family: 0.3.34 needs `futures-*` at `^0.3.34`).
+        # Cargo leaves the line unchanged and a later validation fails, so we
+        # retry with `--precise` to force the exact target and cascade the
+        # siblings.
+        #
+        # Only retry on a genuine no-op. Comparing the dependency's entries
+        # *and* its incoming edges before/after the plain command distinguishes
+        # a stuck line from one Cargo did resolve — including an edge repointed
+        # onto an already-present target entry, where forcing `--precise` would
+        # wrongly fail.
+        sig { params(lockfile_before: String).returns(T::Boolean) }
+        def precise_update_needed?(lockfile_before)
+          return false if git_dependency?
+
+          version = dependency.version
+          return false unless version && version_class.correct?(version)
+
+          previous_version = dependency.previous_version
+          return false unless previous_version && version_class.correct?(previous_version)
+          return false if previous_version == version
+
+          lockfile_after = File.read("Cargo.lock")
+          return false if dependency_move_signature(lockfile_before, dependency) !=
+                          dependency_move_signature(lockfile_after, dependency)
+
+          package_version_count(lockfile_after, dependency, previous_version).positive?
+        end
+
         # An earlier command in this run may already have resolved this
         # dependency's line, in which case `cargo update -p name:version`
         # would match no package and fail hard. Skip the command when the
@@ -710,6 +765,78 @@ module Dependabot
           entries
         end
 
+        # A "did this dependency move?" signature: the dependency's own package
+        # identity plus its incoming edges. An edge repointed onto an
+        # already-present target entry moves the dependency without changing any
+        # `[[package]]` block, so identity alone is not a reliable signal.
+        sig do
+          params(lockfile_content: String, dependency: Dependabot::Dependency)
+            .returns(T::Array[String])
+        end
+        def dependency_move_signature(lockfile_content, dependency)
+          dependency_identity_signature(lockfile_content, dependency) +
+            dependency_reference_edges(lockfile_content, dependency)
+        end
+
+        # Identity of each of the dependency's own `[[package]]` blocks, reduced
+        # to the fields that define which crate instance is present: `name`,
+        # `version` and `source`.
+        #
+        # This deliberately excludes the block's outgoing `dependencies` array
+        # (and checksum): during a grouped update Cargo may add or drop version
+        # qualifiers on this crate's own outgoing edges when a sibling starts or
+        # stops coexisting, even though this crate itself did not move. Folding
+        # the whole block in would misread that as movement and wrongly suppress
+        # the `--precise` fallback, leaving the requested version stuck.
+        sig do
+          params(lockfile_content: String, dependency: Dependabot::Dependency)
+            .returns(T::Array[String])
+        end
+        def dependency_identity_signature(lockfile_content, dependency)
+          dependency_lockfile_entries(lockfile_content, dependency).map do |entry|
+            entry.lines.filter_map do |line|
+              stripped = line.strip
+              stripped if stripped.match?(/\A(?:name|version|source) = /)
+            end.join("\n")
+          end.sort
+        end
+
+        # Incoming edges to the dependency (`"futures"` or `"futures 0.3.33"`
+        # inside other packages' `dependencies` arrays), each qualified by the
+        # parent package that owns it. Cargo only appends the version when
+        # several versions of the crate coexist, so a repointed edge is visible
+        # here even when both entries stay in place. Qualifying by parent means a
+        # pair of edges swapping targets between two parents (`foo 1` -> `foo 2`
+        # in one, `foo 2` -> `foo 1` in another) is still detected as movement
+        # rather than cancelling out in a globally-sorted list.
+        #
+        # The parent is identified by Cargo's full package identity
+        # (name/version/source), not just name/version: a lockfile can carry the
+        # same name *and* version from different sources (see the
+        # `duplicate_source_versions` fixture), and dropping the source would let
+        # such a pair swap edges without the signature changing.
+        sig do
+          params(lockfile_content: String, dependency: Dependabot::Dependency)
+            .returns(T::Array[String])
+        end
+        def dependency_reference_edges(lockfile_content, dependency)
+          edge_regex = /\A"#{Regexp.escape(dependency.name)}( [^"]+)?",?\z/
+          edges = T.let([], T::Array[String])
+          lockfile_content.scan(LOCKFILE_ENTRY_REGEX) do
+            block = Regexp.last_match.to_s
+            parent_id = [
+              block[/^name = "[^"]+"$/],
+              block[/^version = "[^"]+"$/],
+              block[/^source = "[^"]+"$/]
+            ].compact.join(" ")
+            block.lines.each do |line|
+              stripped = line.strip
+              edges << "#{parent_id} => #{stripped}" if stripped.match?(edge_regex)
+            end
+          end
+          edges.sort
+        end
+
         # A git dependency can legitimately resolve to a different commit than
         # the checker expected (e.g. the tracked branch advanced between the
         # check and this update). Accept the update when the dependency's git
@@ -794,7 +921,6 @@ module Dependabot
           end
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/cargo/update_checker/version_resolver.rb

@@ -348,7 +348,7 @@ module Dependabot
           return unless TomlRB.parse(T.must(cargo_toml).content)["workspace"]
 
           msg = "This project is part of a Rust workspace but is not the " \
-                "workspace root." \
+                "workspace root."
 
           if T.must(cargo_toml).directory != "/"
             msg += "Please update your settings so Dependabot points at the " \

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-cargo
 version: !ruby/object:Gem::Version
-  version: 0.394.0
+  version: 0.395.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.394.0
+        version: 0.395.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -178,19 +178,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: turbo_tests
+  name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.5
+        version: 3.2.7
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.394.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.395.0
 rdoc_options: []
 require_paths:
 - lib