rust

package
v0.23.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 14, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Overview

Package rust implements omnibump support for Rust projects. Ported from cargobump with enhancements for the unified omnibump architecture.

Package rust implements omnibump support for Rust projects. Ported from cargobump with enhancements for the unified omnibump architecture.

Package rust implements omnibump support for Rust projects. Ported from cargobump with enhancements for the unified omnibump architecture.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrInvalidCrateName is returned when a crate name is invalid.
	ErrInvalidCrateName = errors.New("invalid crate name")

	// ErrInvalidVersion is returned when a version string is invalid.
	ErrInvalidVersion = errors.New("invalid version string")
)
View Source 
var (
	// ErrCargoLockNotFound is returned when Cargo.lock is not found.
	ErrCargoLockNotFound = errors.New("cargo.lock not found")

	// ErrRemoteAnalysisNotImplemented is returned when remote analysis is not implemented.
	ErrRemoteAnalysisNotImplemented = errors.New("remote analysis not yet implemented")

	// ErrUnappliedPins is returned by Validate when one or more requested pins did
	// not land: the crate is present in Cargo.lock on the requested SemVer line but
	// still below the requested floor. A silently-unapplied pin is worse than an
	// error because a CVE scan reads the resulting clean lock as "fixed"
	// (AUTO-1142), so callers can opt into failing the build on it.
	ErrUnappliedPins = errors.New("requested dependency pins were not applied")
)
View Source 
var ErrAmbiguousTarget = errors.New("crate resolves to multiple versions")

ErrAmbiguousTarget is returned when a bare crate name resolves to multiple present versions, so the caller must pin one explicitly as name@<version>.

View Source 
var ErrCrateNotActivated = errors.New("crate is locked but not activated in the inverted dependency tree")

ErrCrateNotActivated indicates that `cargo tree -i` found no reachable inverted tree for the crate: it is locked but not activated in the resolved graph this query sees (host target, normal+build edges). This happens for an optional dependency behind a disabled feature or a platform-gated dependency on a non-matching host. cargo reports it either as an empty tree ("warning: nothing to print.", exit 0) or as "did not match any packages" (exit non-zero). It is not a fatal error: the caller falls back to a direct lockfile pin.

View Source 
var ErrCrateNotFound = errors.New("crate not found in crates.io index")

ErrCrateNotFound is returned when the crates.io index has no entry for a crate.

View Source 
var ErrInvalidPackageSpec = errors.New("invalid package spec")

ErrInvalidPackageSpec is returned when a package spec is missing required fields.

View Source 
var ErrNoCompatibleVersion = errors.New("no compatible version can be upgraded to")

ErrNoCompatibleVersion is returned when a crate is pinned below the requested floor by a dependent's caret constraint and so cannot be upgraded to a compatible version. This is a genuine failure: omnibump must not silently pass.

View Source 
var ErrNoMatchingVersion = errors.New("no published version satisfies the constraint")

ErrNoMatchingVersion is returned when no published version of a crate satisfies the requested SemVer constraint.

View Source 
var ErrUnexpectedIndexStatus = errors.New("unexpected status from crates.io index")

ErrUnexpectedIndexStatus is returned when the crates.io index responds with an unexpected (non-200, non-404) HTTP status.

View Source 
var ErrUpgradeBrokeBuild = errors.New("upgrade broke the build; no compatible upgrade is possible")

ErrUpgradeBrokeBuild is returned when a SemVer-breaking manifest edit was applied but `cargo check` then failed: the upgrade leaves the project unbuildable, so no upgrade is possible.

Functions

func CargoCheck added in v0.21.0 

func CargoCheck(ctx context.Context, cargoRoot string) (string, error)

CargoCheck runs `cargo check --workspace --release` to verify the project still compiles. It returns the combined output (so compiler errors can be surfaced) and an error if the check fails. Used to gate SemVer-breaking upgrades, which can leave the project unbuildable.

--release compiles in the release profile so a subsequent `cargo build --release` can reuse these artifacts rather than recompiling from scratch.

func CargoUpdate 

func CargoUpdate(ctx context.Context, cargoRoot string) (string, error)

CargoUpdate runs 'cargo update' to refresh the Cargo.lock file. Ported from cargobump/pkg/run/cargo.go.

func CargoUpdatePackage 

func CargoUpdatePackage(ctx context.Context, name, oldVersion, newVersion, cargoRoot string) (string, error)

CargoUpdatePackage updates a specific package to a precise version. Uses: cargo update --precise <newVersion> --package <name>@<oldVersion> Ported from cargobump/pkg/run/cargo.go.

func DoUpdate 

func DoUpdate(ctx context.Context, packages map[string]*Package, cargoPackages []CargoPackage, cfg *UpdateConfig) error

DoUpdate performs the actual update of Rust package dependencies. Ported from cargobump/pkg/update.go.

func GetCargoLockPath added in v0.17.0 

func GetCargoLockPath(cargoRoot string) (string, error)

GetCargoLockPath returns the path to Cargo.lock in the given cargo root directory.

func LatestCrateVersion added in v0.18.6 

func LatestCrateVersion(ctx context.Context, pkg string) (string, error)

LatestCrateVersion queries the crates.io index for the crate referenced by `pkg` and returns its latest published version within the SemVer constraint. A bare crate name ("rand") returns the highest stable version overall (e.g. 0.10.1); a pinned name ("rand@0.9.0") returns the highest stable version in that caret-compatible line (e.g. 0.9.4). Yanked and pre-release versions are ignored. Returns ErrNoMatchingVersion when no version qualifies.

The constraint comes from the `@version` only; any `=precise` component of a "name@from=to" arg is ignored.

func ParseBumpFile 

func ParseBumpFile(r io.Reader) (map[string]*Package, error)

ParseBumpFile parses a YAML file containing package update specifications. Ported from cargobump/pkg/parser/parser.go:ParseBumpFile.

Types

type CargoPackage 

type CargoPackage struct {
	Name         string
	Version      string
	Source       string
	Dependencies []string
}

CargoPackage represents a package from Cargo.lock.

func GetCurrentPackages added in v0.17.0 

func GetCurrentPackages(ctx context.Context, cargoRoot string) ([]CargoPackage, error)

GetCurrentPackages parses Cargo.lock to get the current packages.

func ParseCargoLock 

func ParseCargoLock(r io.Reader) ([]CargoPackage, error)

ParseCargoLock parses a Cargo.lock file and returns the list of packages.

func (CargoPackage) IsLocal added in v0.20.0 

func (c CargoPackage) IsLocal() bool

IsLocal reports whether the package is the local/workspace crate itself rather than an external dependency. Local crates have no Source in Cargo.lock, whereas registry, git, and remote-path dependencies always carry one.

type Lockfile 

type Lockfile struct {
	Packages []cargoLockPackage `toml:"package"`
}

Lockfile represents a Cargo.lock file structure. Based on https://doc.rust-lang.org/cargo/reference/manifest.html

type Package 

type Package struct {
	Name    string
	Version string
	Index   int // For ordering updates
}

Package represents a Cargo package dependency.

type PackageList 

type PackageList struct {
	Packages []Package `json:"packages" yaml:"packages"`
}

PackageList is used to marshal from yaml/json file to get the list of packages.

type Rust 

type Rust struct{}

Rust implements the Language interface for Rust projects.

func (*Rust) Detect 

func (r *Rust) Detect(ctx context.Context, dir string) (bool, error)

Detect checks if Rust manifest files exist in the directory.

func (*Rust) GetManifestFiles 

func (r *Rust) GetManifestFiles() []string

GetManifestFiles returns Rust manifest files.

func (*Rust) Name 

func (r *Rust) Name() string

Name returns the language identifier.

func (*Rust) SupportsAnalysis 

func (r *Rust) SupportsAnalysis() bool

SupportsAnalysis returns true since Rust now has analysis capabilities.

func (*Rust) Update 

func (r *Rust) Update(ctx context.Context, cfg *languages.UpdateConfig) error

Update performs dependency updates on a Rust project.

func (*Rust) Validate 

func (r *Rust) Validate(ctx context.Context, cfg *languages.UpdateConfig) error

Validate checks that each requested update landed in the updated Cargo.lock.

A request is judged against the updater's contract — a floor (">= dep.Version") within the crate's Cargo caret line — not by exact equality. This is required because a single Cargo.lock legitimately locks one crate at several SemVer-incompatible versions at once (e.g. rand 0.9.0 and 0.10.1, each required by a different dependent). The earlier exact-equality check compared the request against *every* locked instance, so it emitted spurious warnings ("expected 0.9.0, got 0.10.1") against the unrelated line and reported a crate that had legitimately moved to a higher line as "not found".

The floor-and-line rules below mirror the updater (upgradeReverseDependencies / pinPrecise) so the two agree on what "satisfied" means:

  • the requested line is present: that instance must be >= the floor;
  • the requested line is absent but a higher line exists (a dependent pulled the crate up, e.g. anstream 0.6 -> 1.0): the floor is still met, so the update correctly left it alone;
  • only lower instances remain: genuinely stale, so warn.

The precise-pin form (name@from=to) reaches here with the "@from" marker still on dep.Name and the exact target in dep.Version. It is judged on the same floor-and-line basis: a crate locked *above* its exact target — because a dependent requires the newer version, so pinPrecise refused to downgrade it — still satisfies the floor. That exact-match / refused-downgrade case is owned by pinPrecise and verifyTransitiveUpgrade in the updater (which warn at update time), so Validate defers to them rather than emitting a redundant warning.

type RustAnalyzer 

type RustAnalyzer struct {
	// contains filtered or unexported fields
}

RustAnalyzer implements the Analyzer interface for Rust projects.

func (*RustAnalyzer) Analyze 

func (ra *RustAnalyzer) Analyze(ctx context.Context, projectPath string) (*analyzer.AnalysisResult, error)

Analyze performs dependency analysis on a Rust project.

func (*RustAnalyzer) AnalyzeRemote 

func (ra *RustAnalyzer) AnalyzeRemote(ctx context.Context, files map[string][]byte) (*analyzer.RemoteAnalysisResult, error)

AnalyzeRemote performs dependency analysis on remotely-fetched Rust files. Not yet implemented for Rust - returns error. TODO: Implement this function and use ctx for logging and files for analysis.

func (*RustAnalyzer) RecommendStrategy 

func (ra *RustAnalyzer) RecommendStrategy(ctx context.Context, analysis *analyzer.AnalysisResult, deps []analyzer.Dependency) (*analyzer.Strategy, error)

RecommendStrategy suggests update strategy for Rust dependencies. For Rust, updates are always direct using cargo update.

type UpdateConfig 

type UpdateConfig struct {
	CargoRoot string
	Update    bool // Run 'cargo update' before updating packages
	ShowDiff  bool
}

UpdateConfig holds configuration for Rust project updates.

Source Files

View all Source files

Directories

Path Synopsis
Package revdep computes, for a Rust crate and a target version, the minimum version each reverse dependency must be upgraded to so the target becomes reachable — terminating at the workspace crate whose Cargo.toml must be edited.
 Package revdep computes, for a Rust crate and a target version, the minimum version each reverse dependency must be upgraded to so the target becomes reachable — terminating at the workspace crate whose Cargo.toml must be edited.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.