feat: Add support for workspace.dependencies in cargo 1.64.0+

Dockerfile

@@ -231,7 +231,7 @@ ENV RUSTUP_HOME=/opt/rust \
   PATH="${PATH}:/opt/rust/bin"
 RUN mkdir -p "$RUSTUP_HOME" && chown dependabot:dependabot "$RUSTUP_HOME"
 USER dependabot
-RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain 1.61.0 --profile minimal
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain 1.64.0 --profile minimal
 
 
 ### Terraform

cargo/lib/dependabot/cargo/file_parser.rb

@@ -56,6 +56,8 @@ def check_rust_workspace_root
         raise Dependabot::DependencyFileNotEvaluatable, msg
       end
 
+      # rubocop:disable Metrics/AbcSize
+      # rubocop:disable Metrics/CyclomaticComplexity
       # rubocop:disable Metrics/PerceivedComplexity
       def manifest_dependencies
         dependency_set = DependencySet.new
@@ -79,10 +81,21 @@ def manifest_dependencies
               end
             end
           end
+
+          workspace = parsed_file(file).fetch("workspace", {})
+          workspace.fetch("dependencies", {}).each do |name, requirement|
+            next unless name == name_from_declaration(name, requirement)
+            next if lockfile && !version_from_lockfile(name, requirement)
+
+            dependency_set <<
+              build_dependency(name, requirement, "workspace.dependencies", file)
+          end
         end
 
         dependency_set
       end
+      # rubocop:enable Metrics/AbcSize
+      # rubocop:enable Metrics/CyclomaticComplexity
       # rubocop:enable Metrics/PerceivedComplexity
 
       def build_dependency(name, requirement, type, file)

cargo/spec/dependabot/cargo/file_parser_spec.rb

@@ -365,6 +365,58 @@
         end
       end
 
+      context "with workspace dependencies" do
+        let(:manifest_fixture_name) { "workspace_dependencies_root" }
+        let(:lockfile_fixture_name) { "workspace_dependencies" }
+        let(:files) do
+          [
+            manifest,
+            lockfile,
+            workspace_child
+          ]
+        end
+        let(:workspace_child) do
+          Dependabot::DependencyFile.new(
+            name: "lib/inherit_ws_dep/Cargo.toml",
+            content: fixture("manifests", "workspace_dependencies_child")
+          )
+        end
+
+        describe "top level dependencies" do
+          subject(:top_level_dependencies) do
+            dependencies.select(&:top_level?)
+          end
+
+          its(:length) { is_expected.to eq(1) }
+
+          describe "the first dependency" do
+            subject(:dependency) { top_level_dependencies.first }
+
+            it "has the right details" do
+              expect(dependency).to be_a(Dependabot::Dependency)
+              expect(dependency.name).to eq("log")
+              expect(dependency.version).to eq("0.4.0")
+              expect(dependency.requirements).to eq(
+                [
+                  {
+                    requirement: "=0.4.0",
+                    file: "Cargo.toml",
+                    groups: ["workspace.dependencies"],
+                    source: nil
+                  },
+                  {
+                    requirement: nil,
+                    file: "lib/inherit_ws_dep/Cargo.toml",
+                    groups: ["dependencies"],
+                    source: nil
+                  }
+                ]
+              )
+            end
+          end
+        end
+      end
+
       context "with a git dependency" do
         let(:manifest_fixture_name) { "git_dependency" }
 

cargo/spec/fixtures/lockfiles/workspace_dependencies

@@ -0,0 +1,25 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "inherit_ws_dep"
+version = "0.1.0"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "log"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3a89a0c46ba789b8a247d4c567aed4d7c68e624672d238b45cc3ec20dc9f940"
+dependencies = [
+ "cfg-if",
+]

cargo/spec/fixtures/manifests/workspace_dependencies_child

@@ -0,0 +1,8 @@
+[package]
+name = "inherit_ws_dep"
+version = "0.1.0"
+edition = "2021"
+workspace = "../.."
+
+[dependencies]
+log.workspace = true

cargo/spec/fixtures/manifests/workspace_dependencies_root

@@ -0,0 +1,5 @@
+[workspace]
+members = ["lib/inherit_ws_dep"]
+
+[workspace.dependencies]
+log = "=0.4.0"