feat(manager/cargo): support git dependencies #36444

okkero · 2025-06-11T06:37:01Z

Changes

This PR reintroduces Cargo git dependencies, reverted in #36412. The original PR adding support for git dependencies also introduced two regressions. This PR addresses both:

cargo: Renovate attempts to "pin" Git dependencies with `rangeStrategy=pin` #36397 is addressed by not using cargo versioning by default for git dependencies, instead making a best effort decision between semver and loose based on the current value's shape.
Renovate jobs are failing: Cannot read properties of undefined (reading 'split') at cargo2npm #36408 is addressed by not trying to read currentValue if it is not defined, effectively skipping git dependencies without a specified ref, leaving it up to the lock file maintenance schedule to update the lock file.

Context

Closes feat(manager/cargo): support for git dependencies #26531

Documentation (please check one with an [x])

I have updated the documentation, or
No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

Code inspection only, or
Newly added/modified unit tests, or
No unit tests but ran on a real repository, or
Both unit tests + ran on a real repository

…port-git-dependencies-cargo

…ndencies-cargo

…ult to '*' instead of crashing. This is necessary in cases where you have a git dependency without a specified ref (no `rev`, `tag` or `branch`)

`cargo` versioning never makes sense for git dependencies, since the ref always has to be an exact match. If the current value looks like semver, we use `semver` versioning. Otherwise we use `loose` versioning.

lib/modules/manager/cargo/artifacts.ts

lib/modules/manager/cargo/extract.ts

lib/modules/manager/cargo/index.ts

lib/modules/manager/cargo/schema.ts

lib/modules/manager/util.ts

lib/modules/manager/cargo/index.ts

lib/modules/manager/cargo/schema.ts

lib/modules/manager/cargo/artifacts.ts

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

lib/modules/manager/cargo/schema.ts

lib/modules/manager/cargo/artifacts.ts

RahulGautamSingh

LGTM, except the comments and the protocol change situation

lib/modules/manager/cargo/artifacts.ts

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

…ndencies-cargo

RahulGautamSingh · 2025-07-07T15:45:47Z

lib/modules/manager/util.ts

@@ -20,7 +20,8 @@ export function applyGitSource(
        platform === 'github'
          ? GithubTagsDatasource.id
          : GitlabTagsDatasource.id;
-      const { protocol, source, full_name } = parseGitUrl(git);
+      const httpUrl = getHttpUrl(git);


Is this working fine on your test repo?

Yeah. I tested with git dependencies both using URLs of the form https://github.com/... and ssh://git@github.com/..., and they both work. Did you have any concerns about this? An edge case I may not be aware of?

I was wondering why you case didn't occur earlier as we use the same function at other places for the same purpose.

That I don't know. The dependency update breaks without this when using ssh://git@github.com/... style URLs with tags in the Cargo.toml. Here is the Cargo.toml file used, and this is the error message I get:

INFO: Renovate is exiting with a non-zero code due to the following logged errors "loggerErrors": [ { "name": "renovate", "level": 50, "logContext": "h4eoLGnOiFF5APflydRsn", "repository": "okkero/renovate-test", "url": "/graphql", "baseUrl": "ssh://github.com/api/", "resolvedUrl": "ssh://github.com/api/graphql", "msg": "Request Error: cannot parse url" } ]

I see that massageUrl does something similar, although it seems more thorough and that it covers more cases.

Should we reuse that here instead? Or should this replacement be done at a different level entirely? I mean, it seems to me that this has to be done at some point or other, but I don't know what would be the best way to go about it...

Do you think that would work, @RahulGautamSingh , or do you recommend another approach? It just seems that the protocol for the registry URL can't be ssh, even though cargo supports it. So, the GitHub API must be called through https, which makes sense, so it has to be converted at some point. I am just unsure where exactly it would be best to do that.

RahulGautamSingh · 2025-07-09T07:38:28Z

lib/modules/manager/cargo/__snapshots__/extract.spec.ts.snap

-    "currentValue": "0.1.0",
-    "datasource": "crate",
+    "currentValue": undefined,
+    "datasource": "git-refs",
    "depName": "git_dep_with_version",
    "depType": "dependencies",
    "managerData": {
      "nestedVersion": true,
    },
-    "skipReason": "git-dependency",


The version was detected before, but now it is unspecified? 🤔

Good catch. Why is currentValue now undefined?

Right, hmm. So, for cargo git dependencies, the version field does not specify which version of the crate to fetch, but may exist alongside branch, rev or tag as a sort of sanity check: https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#the-role-of-the-version-key

So, to me it seems correct that currentValue would be unspecified in this case, but I'm not exactly sure what to do with the version key for git dependencies, or whether we should do anything at all.

Could you please point to me which change cause this? I am unable to find the change that triggered this

I think it's this: 8bbf203#diff-09657ce916b4a05cf4f9d8b64a7c5fc2eb4e4d6078cf7c45583656dc230899c1R65

@mkniewallner Can you confirm?

RahulGautamSingh · 2025-08-05T06:12:40Z

lib/modules/manager/util.ts

@@ -20,7 +20,8 @@ export function applyGitSource(
        platform === 'github'
          ? GithubTagsDatasource.id
          : GitlabTagsDatasource.id;
-      const { protocol, source, full_name } = parseGitUrl(git);
+      const httpUrl = getHttpUrl(git);


I was wondering why you case didn't occur earlier as we use the same function at other places for the same purpose.

RahulGautamSingh · 2025-08-05T06:17:33Z

lib/modules/manager/cargo/__snapshots__/extract.spec.ts.snap

-    "currentValue": "0.1.0",
-    "datasource": "crate",
+    "currentValue": undefined,
+    "datasource": "git-refs",
    "depName": "git_dep_with_version",
    "depType": "dependencies",
    "managerData": {
      "nestedVersion": true,
    },
-    "skipReason": "git-dependency",


Could you please point to me which change cause this? I am unable to find the change that triggered this

RahulGautamSingh · 2025-08-05T06:18:21Z

lib/modules/manager/cargo/artifacts.spec.ts

I don't know. These were added before I took over the PR. Perhaps @mkniewallner can fill us in?

I tried removing these, and then two tests broke. It's not clear to me exactly what's happening here.

FAIL lib/modules/manager/cargo/artifacts.spec.ts > modules/manager/cargo/artifacts > returns updated Cargo.lock with precise version update AssertionError: expected [ { …(2) } ] to match object [ …(2) ] - Expected + Received [ { "cmd": "cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --workspace", + "options": { + "cwd": "/tmp/github/some/repo", + "encoding": "utf-8", + "env": { + "HOME": "/home/user", + "HTTPS_PROXY": "https://example.com", + "HTTP_PROXY": "http://example.com", + "LANG": "en_US.UTF-8", + "LC_ALL": "en_US", + "NO_PROXY": "localhost", + "PATH": "/tmp/path", }, - { - "cmd": "cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --package dep1@1.0.0 --precise 1.0.1", + "maxBuffer": 10485760, + "timeout": 900000, + }, }, ] ❯ lib/modules/manager/cargo/artifacts.spec.ts:142:27 140| { file: { contents: undefined, path: 'Cargo.lock', type: 'addition' } }, 141| ]); 142| expect(execSnapshots).toMatchObject([ | ^ 143| { 144| cmd:

FAIL lib/modules/manager/cargo/artifacts.spec.ts > modules/manager/cargo/artifacts > returns updated Cargo.lock when a preceding dependency triggers an update in a later dependency AssertionError: expected [ Array(1) ] to deeply equal [ { file: { …(3) } } ] - Expected + Received [ { "file": { - "contents": undefined, + "contents": " + [[package]] + name = \"dep1\" + version = \"1.0.1\" + + [[package]] + name = \"dep2\" + version = \"1.0.2\" + + [[package]] + name = \"dep3\" + version = \"1.0.0\" + ", "path": "Cargo.lock", "type": "addition", }, }, ] ❯ lib/modules/manager/cargo/artifacts.spec.ts:310:7 308| config, 309| }), 310| ).toEqual([ | ^ 311| { file: { contents: undefined, path: 'Cargo.lock', type: 'addition' } }, 312| ]);

mkniewallner and others added 10 commits November 2, 2024 15:47

feat(manager/cargo): support git dependencies

8bbf203

feat(manager/cargo): add git sources to supportedDatasources

55282f2

fix(manager/cargo): only warn for non-locked on crates

ab69e05

Merge branch 'main' of github.com:mkniewallner/renovate into feat/sup…

db68bc8

…port-git-dependencies-cargo

test(manager/cargo): add datasource for deps

6702e5d

Merge remote-tracking branch 'origin/main' into feat/support-git-depe…

bdfcc74

…ndencies-cargo

Merge remote-tracking branch 'origin/main' into feat/support-git-depe…

7df1933

…ndencies-cargo

Default to https for registryUrl git dependency protocol is ssh

d690ef7

Cargo: if dep.currentValue is unset when getting locked version, defa…

f338e95

…ult to '*' instead of crashing. This is necessary in cases where you have a git dependency without a specified ref (no `rev`, `tag` or `branch`)

Cargo: Never use cargo versioning for git dependencies

49572a2

`cargo` versioning never makes sense for git dependencies, since the ref always has to be an exact match. If the current value looks like semver, we use `semver` versioning. Otherwise we use `loose` versioning.

viceice self-requested a review June 11, 2025 07:23

okkero added 2 commits June 11, 2025 10:43

Explicitly skip getting lockedVersion if currentValue is not set

3bfa0cb

Test that git dependencies do not extract locked version

3fa3bd2

RahulGautamSingh reviewed Jun 11, 2025

View reviewed changes

lib/modules/manager/cargo/artifacts.ts Outdated Show resolved Hide resolved

viceice reviewed Jun 11, 2025

View reviewed changes

RahulGautamSingh reviewed Jun 11, 2025

View reviewed changes

lib/modules/manager/cargo/schema.ts Outdated Show resolved Hide resolved

RahulGautamSingh reviewed Jun 11, 2025

View reviewed changes

lib/modules/manager/cargo/artifacts.ts Outdated Show resolved Hide resolved

okkero and others added 4 commits June 11, 2025 13:11

Let crate datasource handle default versioning for cargo

38ab09f

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

Set type and initial value for lockedVersion

a88c72b

Apply suggested comment changes

1d76591

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

Use consistent naming for import of semverVersioning

6c75555

okkero requested review from viceice and RahulGautamSingh June 20, 2025 12:54

RahulGautamSingh reviewed Jul 5, 2025

View reviewed changes

lib/modules/manager/cargo/schema.ts Outdated Show resolved Hide resolved

RahulGautamSingh reviewed Jul 5, 2025

View reviewed changes

lib/modules/manager/cargo/artifacts.ts Outdated Show resolved Hide resolved

RahulGautamSingh reviewed Jul 5, 2025

View reviewed changes

okkero commented Jul 7, 2025

View reviewed changes

lib/modules/manager/cargo/artifacts.ts Outdated Show resolved Hide resolved

okkero and others added 3 commits July 7, 2025 12:08

Apply suggestions from code review

7dc091e

Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>

Merge remote-tracking branch 'origin/main' into feat/support-git-depe…

863bded

…ndencies-cargo

Use getHttpUrl instead of manually replacing protocol in applyGitSource

94e08af

okkero added 3 commits July 7, 2025 12:48

Fix lint errors

b274dde

Remove versioning override from cargo manager

47e82ac

Update cargo snapshot to remove versioning requirement

6311025

okkero requested a review from RahulGautamSingh July 7, 2025 11:30

RahulGautamSingh reviewed Jul 7, 2025

View reviewed changes

RahulGautamSingh reviewed Jul 9, 2025

View reviewed changes

okkero requested review from rarkins and RahulGautamSingh July 29, 2025 07:52

RahulGautamSingh reviewed Aug 5, 2025

View reviewed changes

feat(manager/cargo): support git dependencies #36444

Are you sure you want to change the base?

feat(manager/cargo): support git dependencies #36444

Conversation

okkero commented Jun 11, 2025 • edited by viceice Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Context

Documentation (please check one with an [x])

How I've tested my work (please select one)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RahulGautamSingh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

okkero commented Jun 11, 2025 •

edited by viceice

Loading