@dennisrepa/elevate 1.5.0 → 1.7.0

package/README.md

@@ -215,7 +215,7 @@ Detailed parameter references are available in [`docs/en.md`](./docs/en.md) and
 * **pnpm specifics.** `catalog:` entries are updated where they are declared, in `pnpm-workspace.yaml`. A plain range on a workspace module (`^1.0.0`) is listed as *not linked* and never rewritten to `workspace:`, because pnpm resolves it from the registry. Elevate does not read pnpm settings such as `minimumReleaseAge` or the approval of build scripts, so pnpm may refuse an offered version; the update is then rolled back with pnpm's message. pnpm 8 and older, Windows and `shared-workspace-lockfile=false` are not covered.
 * **Broken configuration stops Elevate.** An `elevate.config.json` that is not valid JSON, not an object, or whose `internalScopes` is not a list of strings is reported and Elevate exits with code `1`, because ignoring it would switch off the protection of internal packages. Without any configuration file Elevate works with defaults.
 * **Dependency sections.** `dependencies`, `devDependencies` and `optionalDependencies` are covered. `peerDependencies` and `overrides` are never changed.
-* **Cargo.** Requirements are raised keeping their precision, so a loose `"1"` only shows breaking updates; wildcard and compound requirements (`*`, `>=1.2, <2`), git and external path dependencies are left alone. Lock-file-only updates, registries that need authentication and `[patch]` sections are not covered; a vendored or local-registry source replacement is refused rather than bypassed.
+* **Cargo.** Requirements are raised keeping their precision, so a loose `"1"` only shows breaking updates; wildcard and compound requirements (`*`, `>=1.2, <2`), git and external path dependencies are left alone. Lock-file-only updates (`[Lock]`) are offered for direct dependencies when `Cargo.lock` is behind a requirement that already allows a newer release; transitive crates are not, and a crate with a pending manifest update shows only that candidate. Registries that need authentication and `[patch]` sections are not covered; a vendored or local-registry source replacement is refused rather than bypassed.
 * **Maven.** Maven plugin versions and declarations inside `<profiles>` are not offered. Dependencies whose version is declared outside the repository (an external parent or BOM) are listed as *not offered* with the reason.
 
 ---

package/dist/cli.js

@@ -1351,7 +1351,7 @@ var CargoConfigReader = class {
 
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "1.5.0" : fromPackage();
+var VERSION = true ? "1.7.0" : fromPackage();
 
 // src/adapters/cargo/cargo-index.ts
 var RegistryAuthRequiredError = class extends Error {
@@ -1463,6 +1463,13 @@ import semver6 from "semver";
 // src/adapters/cargo/cargo-versions.ts
 import semver5 from "semver";
 var rust = (v) => semver5.coerce(v)?.version;
+function eligibleVersions(versions, options) {
+  const project = options.rustVersion ? rust(options.rustVersion) : void 0;
+  return versions.filter((v) => !v.yanked && semver5.valid(v.version)).filter((v) => options.channel === "all" || semver5.prerelease(v.version) === null).filter((v) => {
+    const needs = v.rustVersion ? rust(v.rustVersion) : void 0;
+    return !(project && needs && semver5.gt(needs, project));
+  }).map((v) => v.version).sort(semver5.rcompare);
+}
 function selectVersion(versions, options) {
   const candidates = versions.filter((v) => !v.yanked && semver5.valid(v.version)).filter((v) => options.channel === "all" || semver5.prerelease(v.version) === null).sort((a, b) => semver5.rcompare(a.version, b.version));
   const project = options.rustVersion ? rust(options.rustVersion) : void 0;
@@ -1549,7 +1556,7 @@ function cargoDiff(from, to) {
 }
 
 // src/adapters/cargo/cargo-scanner.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { join as join11, relative as relative4 } from "path";
 import semver8 from "semver";
 
@@ -1621,6 +1628,20 @@ function locateSection(path) {
   return { section, inWorkspace, target, rest: path.slice(i + 1) };
 }
 
+// src/adapters/cargo/cargo-lockfile.ts
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
+import { getStaticTOMLValue as getStaticTOMLValue2, parseTOML as parseTOML3 } from "toml-eslint-parser";
+function readLockedVersions(lockFile) {
+  const locked = /* @__PURE__ */ new Map();
+  if (!existsSync7(lockFile)) return locked;
+  try {
+    const data = getStaticTOMLValue2(parseTOML3(readFileSync10(lockFile, "utf8")));
+    for (const pkg of data.package ?? []) locked.set(pkg.name, [...locked.get(pkg.name) ?? [], pkg.version]);
+  } catch {
+  }
+  return locked;
+}
+
 // src/adapters/cargo/cargo-scanner.ts
 var CONCURRENCY2 = 6;
 var DIFF_ORDER2 = { major: 0, minor: 1, patch: 2 };
@@ -1634,6 +1655,7 @@ var CargoDependencyAdapter = class {
     const pkg = metadata.packages.find((p) => samePath(join11(p.manifest_path, ".."), module.path));
     if (!pkg) return { candidates: [], skipped: [] };
     const own = readDeclarations(pkg.manifest_path);
+    const locks = readLockedVersions(join11(metadata.workspace_root, "Cargo.lock"));
     const rootManifest = join11(metadata.workspace_root, "Cargo.toml");
     const root = readDeclarations(rootManifest);
     const groups = groupDependencies(pkg.dependencies);
@@ -1650,7 +1672,7 @@ var CargoDependencyAdapter = class {
         return target ? alignment(primary, target, located, common) : null;
       }
       if (!primary.source || primary.source.startsWith("git+")) return null;
-      const outcome = await this.registryOutcome(primary, located, pkg, metadata, common, context);
+      const outcome = await this.registryOutcome(primary, located, pkg, metadata, locks, common, context);
       const other = group.find((d) => d !== primary && !sameRequirement(d.req, primary.req));
       if (outcome && "candidate" in outcome && other) {
         outcome.note = {
@@ -1674,7 +1696,7 @@ var CargoDependencyAdapter = class {
     candidates.sort((a, b) => (DIFF_ORDER2[a.diff] ?? 3) - (DIFF_ORDER2[b.diff] ?? 3));
     return { candidates, skipped };
   }
-  async registryOutcome(dep, located, pkg, metadata, common, context) {
+  async registryOutcome(dep, located, pkg, metadata, locks, common, context) {
     const literal = located?.version.value ?? dep.req;
     if (!isUpgradableRequirement(literal)) return null;
     if (!located || !sameRequirement(located.version.value, dep.req)) {
@@ -1708,10 +1730,10 @@ var CargoDependencyAdapter = class {
       if (floor && held && semver8.gt(held.version, floor)) {
         return { skipped: { identifier: dep.name, origin: origin.kind, reason: "incompatible-rust-version", detail: ` (${held.version} needs Rust ${held.requires})` } };
       }
-      return null;
+      return yankedLock(dep, literal, origin, versions, locks);
     }
     const newRange = rewriteRequirement(literal, latest);
-    if (newRange === literal) return null;
+    if (newRange === literal) return lockOutcome(dep, literal, origin, versions, pkg, metadata, locks, common, context);
     const tag = semver8.prerelease(latest) ? extractPreReleaseTag(latest) ?? "PRE" : void 0;
     const diff = cargoDiff(floor, latest);
     const candidate = {
@@ -1734,6 +1756,39 @@ var CargoDependencyAdapter = class {
     return { candidate };
   }
 };
+function lockOutcome(dep, requirement, origin, versions, pkg, metadata, locks, common, context) {
+  const locked = (locks.get(dep.name) ?? []).filter((v) => satisfiesRequirement(requirement, v)).sort(semver8.rcompare)[0];
+  if (!locked) return null;
+  const options = { channel: context.channel, rustVersion: pkg.rust_version ?? void 0 };
+  const allowed = versions.filter((v) => satisfiesRequirement(requirement, v.version));
+  const newer = eligibleVersions(allowed, options).filter((v) => semver8.gt(v, locked));
+  const latest = newer[0];
+  if (!latest) return yankedLock(dep, requirement, origin, versions, locks);
+  const lockFile = join11(metadata.workspace_root, "Cargo.lock");
+  return {
+    candidate: {
+      coordinate: { identifier: dep.name, artifact: dep.name, ecosystem: "cargo", ...dep.registry ? { registry: dep.registry } : {} },
+      currentRange: locked,
+      currentClean: locked,
+      latest,
+      newRange: latest,
+      diff: cargoDiff(locked, latest),
+      scope: common.scope,
+      // A release the requirement allows is compatible by definition, so it is safe to preselect.
+      selected: true,
+      origin,
+      action: "lock",
+      declaration: { file: lockFile, kind: "lockfile", displayPath: display(context.rootDir, lockFile) },
+      availableVersions: newer,
+      ...common.qualifier ? { qualifier: common.qualifier } : {}
+    }
+  };
+}
+function yankedLock(dep, requirement, origin, versions, locks) {
+  const locked = (locks.get(dep.name) ?? []).filter((v) => satisfiesRequirement(requirement, v)).sort(semver8.rcompare)[0];
+  if (!locked || !versions.some((v) => v.yanked && v.version === locked)) return null;
+  return { skipped: { identifier: dep.name, origin: origin.kind, reason: "locked-version-yanked", detail: locked } };
+}
 function alignment(dep, target, located, common) {
   const local = target.version;
   if (!located || !local || !semver8.valid(local)) return null;
@@ -1772,7 +1827,7 @@ function groupDependencies(deps) {
 }
 function readDeclarations(manifestPath) {
   try {
-    return parseCargoManifest(readFileSync10(manifestPath, "utf8"));
+    return parseCargoManifest(readFileSync11(manifestPath, "utf8"));
   } catch {
     return [];
   }
@@ -1964,20 +2019,6 @@ function applyRangeEdits(source, edits) {
   return result;
 }
 
-// src/adapters/cargo/cargo-lockfile.ts
-import { existsSync as existsSync7, readFileSync as readFileSync11 } from "fs";
-import { getStaticTOMLValue as getStaticTOMLValue2, parseTOML as parseTOML3 } from "toml-eslint-parser";
-function readLockedVersions(lockFile) {
-  const locked = /* @__PURE__ */ new Map();
-  if (!existsSync7(lockFile)) return locked;
-  try {
-    const data = getStaticTOMLValue2(parseTOML3(readFileSync11(lockFile, "utf8")));
-    for (const pkg of data.package ?? []) locked.set(pkg.name, [...locked.get(pkg.name) ?? [], pkg.version]);
-  } catch {
-  }
-  return locked;
-}
-
 // src/adapters/cargo/cargo-updater.ts
 var UPDATE_TIMEOUT_MS = 10 * 6e4;
 var workspaceDir = (module, rootDir) => module.aggregatorDir ?? module.path ?? rootDir;
@@ -1991,6 +2032,9 @@ var CargoUpdaterAdapter = class {
     const dir = workspaceDir(module, rootDir);
     const lockFile = join12(dir, "Cargo.lock");
     const lockedBefore = readLockedVersions(lockFile);
+    const lockUpdates = updates.filter((u) => u.action === "lock");
+    updates = updates.filter((u) => u.action !== "lock");
+    this.checkLockUpdates(lockUpdates, lockFile, lockedBefore);
     const byFile = /* @__PURE__ */ new Map();
     for (const update of updates) {
       const file = resolve6(update.declaration?.file ?? join12(module.path, "Cargo.toml"));
@@ -2028,13 +2072,37 @@ var CargoUpdaterAdapter = class {
     if (existsSync8(lockFile) && registryUpdates.length > 0) {
       await this.refreshLock(dir, lockFile, lockedBefore, registryUpdates, onProgress);
     }
+    for (const update of lockUpdates) {
+      const name = update.coordinate.identifier;
+      onProgress(`Locking ${name} at ${update.latest}\u2026`);
+      await this.cargoUpdate(dir, ["-p", `${name}@${update.currentClean}`, "--precise", update.latest]);
+    }
+    const parts = [];
+    if (updates.length > 0) {
+      parts.push(`Updated ${updates.length} requirement(s) in ${writes.length} Cargo.toml file(s)${existsSync8(lockFile) ? "; Cargo.lock refreshed" : ""}`);
+    }
+    if (lockUpdates.length > 0) parts.push(`locked ${lockUpdates.length} crate(s) at a newer version in Cargo.lock`);
+    const message2 = parts.join("; ");
     return {
-      updatedCount: updates.length,
-      auditMessage: `Updated ${updates.length} requirement(s) in ${writes.length} Cargo.toml file(s)${existsSync8(lockFile) ? "; Cargo.lock refreshed" : ""}.`,
+      updatedCount: updates.length + lockUpdates.length,
+      auditMessage: `${message2.charAt(0).toUpperCase()}${message2.slice(1)}.`,
       auditSeverity: "clean",
       integrityViolations: []
     };
   }
+  /** A lock-only update needs a lock file that still holds the version the scan saw. */
+  checkLockUpdates(lockUpdates, lockFile, locked) {
+    if (lockUpdates.length === 0) return;
+    if (!existsSync8(lockFile)) {
+      throw new InstallError(`${lockFile} does not exist any more; rescan the module.`);
+    }
+    for (const update of lockUpdates) {
+      const name = update.coordinate.identifier;
+      if (!(locked.get(name) ?? []).includes(update.currentClean)) {
+        throw new InstallError(`Cargo.lock no longer locks ${name} at ${update.currentClean}; rescan the module.`);
+      }
+    }
+  }
   async resync() {
   }
   async refreshLock(dir, lockFile, before, updates, onProgress) {
@@ -2075,11 +2143,13 @@ var same = (a, b) => relative5(resolve7(a), resolve7(b)) === "";
 function planCheck(metadata, module, changedFiles, locked) {
   const args = ["check", "--all-targets", ...locked ? ["--locked"] : []];
   const rootManifest = join13(metadata.workspace_root, "Cargo.toml");
+  const lockFile = join13(metadata.workspace_root, "Cargo.lock");
   const memberManifests = new Set(metadata.packages.map((p) => resolve7(p.manifest_path)));
   if (changedFiles.some((f) => same(f, rootManifest))) {
     const isVirtualRoot = !memberManifests.has(resolve7(rootManifest));
     if (isVirtualRoot || metadata.packages.length > 1) return [...args, "--workspace"];
   }
+  if (changedFiles.length > 0 && changedFiles.every((f) => same(f, lockFile))) return [...args, "--workspace"];
   const changed = new Set(
     metadata.packages.filter((p) => changedFiles.some((f) => same(f, p.manifest_path))).map((p) => p.name)
   );
@@ -3480,6 +3550,7 @@ var de = {
     prod: "(prod/compile)",
     align: "[Angleichen]",
     internal: "[Intern]",
+    lock: "[Lock]",
     shared: (count) => `[+${count} Crates]`
   },
   status: {
@@ -3591,6 +3662,7 @@ var en = {
     prod: "(prod/compile)",
     align: "[Align]",
     internal: "[Internal]",
+    lock: "[Lock]",
     shared: (count) => `[+${count} crates]`
   },
   status: {
@@ -4361,6 +4433,10 @@ var PackageRow = ({ item, isFocused, t }) => {
         t.badges.align,
         " "
       ] }),
+      item.action === "lock" && /* @__PURE__ */ jsxs5(Text5, { bold: true, color: theme.colors.brandLight, children: [
+        t.badges.lock,
+        " "
+      ] }),
       item.origin.kind === "private" && /* @__PURE__ */ jsxs5(Text5, { color: theme.colors.brandLight, children: [
         t.badges.internal,
         " "
@@ -5309,6 +5385,8 @@ function describeSkip(skipped) {
       return `catalog entry could not be resolved${detail}`;
     case "incompatible-rust-version":
       return `newer versions need a newer Rust than the project's rust-version${detail}`;
+    case "locked-version-yanked":
+      return `Cargo.lock pins a yanked release and no allowed release can replace it${detail}`;
   }
 }
 
@@ -5397,7 +5475,7 @@ async function handleScanCommand(options, config) {
     if (result.candidates.length === 0) console.log("   \u2728 All dependencies are up to date.");
     for (const u of result.candidates) {
       const diffTag = `[${u.diff.toUpperCase()}]`.padEnd(9);
-      const actionTag = u.action === "align" ? "[ALIGN] " : u.origin.kind === "private" ? "[INTERNAL] " : "";
+      const actionTag = u.action === "align" ? "[ALIGN] " : u.action === "lock" ? "[LOCK] " : u.origin.kind === "private" ? "[INTERNAL] " : "";
       const preBadge = u.isPreRelease ? `[${u.preReleaseTag || "PRE"}] ` : "";
       const where = u.declaration && u.declaration.displayPath !== modulePom ? `  (in ${u.declaration.displayPath}${u.declaration.propertyName ? ` \${${u.declaration.propertyName}}` : ""})` : "";
       console.log(
@@ -5534,6 +5612,8 @@ function retarget(found, target, options) {
   const isPreRelease = isPreReleaseVersion(target);
   return {
     ...found,
+    // A lock update pins exactly the version that was picked.
+    ...found.action === "lock" ? { latest: target } : {},
     newRange: policyOf(options).rewrite(found.currentRange, target),
     diff,
     selected: true,