missing git-only Cargo dependencies in the production graph

[ardentperf]

Description

ran into this while creating SBOMs for paradedb oss software. AI generated summary:

---

Trivy's Cargo analyzer drops direct dependencies declared with a git source
when the dependency has no explicit Cargo version constraint. This causes the
dependency and its transitive dependencies to be absent from vulnerability
results and generated SBOMs, even though they are present in Cargo.lock and
are compiled into the application.

This is particularly visible with Cargo workspaces. Trivy 0.69.0 correctly
handles workspace-inherited package versions, but still omits git-only
dependencies such as:

tantivy-fst = { git = "https://github.com/paradedb/fst.git" }

Desired Behavior

For the reproduction above, Trivy's Cargo result and generated SPDX should
include:

tantivy-fst@0.5.0
utf8-ranges@1.0.5

No change is expected for packages that are only present in Cargo.lock as
dev dependencies.

Actual Behavior

missing

Reproduction Steps

The following dependency is a normal, direct dependency of pg-search:


# pg_search/Cargo.toml
[dependencies]
tantivy-fst = { git = "https://github.com/paradedb/fst.git" }


It is also listed directly in `pg_search`'s `Cargo.lock` entry:

```toml
[[package]]
name = "pg_search"
version = "0.25.6"
dependencies = [
    # ...
    "tantivy-fst",
]

[[package]]
name = "tantivy-fst"
version = "0.5.0"
source = "git+https://github.com/paradedb/fst.git#11e89334c578f26f9fbafbd1122ffb220ebbdbbf"
dependencies = [
    "byteorder",
    "regex-syntax",
    "utf8-ranges",
]

The application uses the crate at runtime:

tantivy_fst::Regex::new(pattern.as_str())

Scan the resulting builder image with Trivy 0.69.0:

$ trivy image --scanners vuln --format json \
    127.0.0.1:5000/pg-search-builder:v0.25.6-18-trixie

The build/Cargo.lock target contains pg_search, but does not contain
tantivy-fst or its transitive dependency utf8-ranges. A Cargo SBOM built
from cargo metadata/CycloneDX contains both packages, including the git
commit in the PURL:

pkg:cargo/tantivy-fst@0.5.0?vcs_url=git%2Bhttps://github.com/paradedb/fst.git%4011e89334c578f26f9fbafbd1122ffb220ebbdbbf

Operating System

Linux

Version

0.69.0