@dennisrepa/elevate 1.6.0 → 1.7.0

package/README.md

@@ -215,7 +215,7 @@ Detailed parameter references are available in [`docs/en.md`](./docs/en.md) and
 * **pnpm specifics.** `catalog:` entries are updated where they are declared, in `pnpm-workspace.yaml`. A plain range on a workspace module (`^1.0.0`) is listed as *not linked* and never rewritten to `workspace:`, because pnpm resolves it from the registry. Elevate does not read pnpm settings such as `minimumReleaseAge` or the approval of build scripts, so pnpm may refuse an offered version; the update is then rolled back with pnpm's message. pnpm 8 and older, Windows and `shared-workspace-lockfile=false` are not covered.
 * **Broken configuration stops Elevate.** An `elevate.config.json` that is not valid JSON, not an object, or whose `internalScopes` is not a list of strings is reported and Elevate exits with code `1`, because ignoring it would switch off the protection of internal packages. Without any configuration file Elevate works with defaults.
 * **Dependency sections.** `dependencies`, `devDependencies` and `optionalDependencies` are covered. `peerDependencies` and `overrides` are never changed.
-* **Cargo.** Requirements are raised keeping their precision, so a loose `"1"` only shows breaking updates; wildcard and compound requirements (`*`, `>=1.2, <2`), git and external path dependencies are left alone. Lock-file-only updates (`[Lock]`) are offered for direct dependencies when `Cargo.lock` is behind a requirement that already allows a newer release; transitive crates are not. Registries that need authentication and `[patch]` sections are not covered; a vendored or local-registry source replacement is refused rather than bypassed.
+* **Cargo.** Requirements are raised keeping their precision, so a loose `"1"` only shows breaking updates; wildcard and compound requirements (`*`, `>=1.2, <2`), git and external path dependencies are left alone. Lock-file-only updates (`[Lock]`) are offered for direct dependencies when `Cargo.lock` is behind a requirement that already allows a newer release; transitive crates are not, and a crate with a pending manifest update shows only that candidate. Registries that need authentication and `[patch]` sections are not covered; a vendored or local-registry source replacement is refused rather than bypassed.
 * **Maven.** Maven plugin versions and declarations inside `<profiles>` are not offered. Dependencies whose version is declared outside the repository (an external parent or BOM) are listed as *not offered* with the reason.
 
 ---

package/dist/cli.js

@@ -1351,7 +1351,7 @@ var CargoConfigReader = class {
 
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "1.6.0" : fromPackage();
+var VERSION = true ? "1.7.0" : fromPackage();
 
 // src/adapters/cargo/cargo-index.ts
 var RegistryAuthRequiredError = class extends Error {
@@ -1730,7 +1730,7 @@ var CargoDependencyAdapter = class {
       if (floor && held && semver8.gt(held.version, floor)) {
         return { skipped: { identifier: dep.name, origin: origin.kind, reason: "incompatible-rust-version", detail: ` (${held.version} needs Rust ${held.requires})` } };
       }
-      return null;
+      return yankedLock(dep, literal, origin, versions, locks);
     }
     const newRange = rewriteRequirement(literal, latest);
     if (newRange === literal) return lockOutcome(dep, literal, origin, versions, pkg, metadata, locks, common, context);
@@ -1763,7 +1763,7 @@ function lockOutcome(dep, requirement, origin, versions, pkg, metadata, locks, c
   const allowed = versions.filter((v) => satisfiesRequirement(requirement, v.version));
   const newer = eligibleVersions(allowed, options).filter((v) => semver8.gt(v, locked));
   const latest = newer[0];
-  if (!latest) return null;
+  if (!latest) return yankedLock(dep, requirement, origin, versions, locks);
   const lockFile = join11(metadata.workspace_root, "Cargo.lock");
   return {
     candidate: {
@@ -1784,6 +1784,11 @@ function lockOutcome(dep, requirement, origin, versions, pkg, metadata, locks, c
     }
   };
 }
+function yankedLock(dep, requirement, origin, versions, locks) {
+  const locked = (locks.get(dep.name) ?? []).filter((v) => satisfiesRequirement(requirement, v)).sort(semver8.rcompare)[0];
+  if (!locked || !versions.some((v) => v.yanked && v.version === locked)) return null;
+  return { skipped: { identifier: dep.name, origin: origin.kind, reason: "locked-version-yanked", detail: locked } };
+}
 function alignment(dep, target, located, common) {
   const local = target.version;
   if (!located || !local || !semver8.valid(local)) return null;
@@ -5380,6 +5385,8 @@ function describeSkip(skipped) {
       return `catalog entry could not be resolved${detail}`;
     case "incompatible-rust-version":
       return `newer versions need a newer Rust than the project's rust-version${detail}`;
+    case "locked-version-yanked":
+      return `Cargo.lock pins a yanked release and no allowed release can replace it${detail}`;
   }
 }