GeezerVison is showing github.com — Fix Cargo hosted workspace redirects by mikolalysenko · Pull Request #256 · SocketDev/socket-patch
Conversation
LLM Description written by Codex:gpt-6-astra
Hosted Cargo patches incorrectly reject workspace-inherited dependency aliases and can mistake an editable local package for a different version outside the project. Quoted dependency values and annotated registry tables also bypass parts of the rewriter, leaving declarations unpatched or producing duplicate TOML tables on reruns.
Root Cause
Workspace references were filtered by their local alias before resolving the root definition. The lockfile ownership guard compared only package names. Several source-preserving TOML readers recognized fewer valid string and table-header forms than Cargo accepts.
Fix
- Resolve workspace aliases before matching the patched crate, including normal, dev, build, and target declarations.
- Match local lockfile owners by name and version, including inherited workspace versions and Cargo's default version.
- Validate proposed manifests against parsed TOML and refuse any matching declaration left unpinned, including legal root/target/workspace dotted and inline forms.
- Recognize literal-string dependency aliases and quoted or annotated registry tables; preserve healthy configuration on repeated application.
Testing
- Regression tests added.
- 73 Cargo redirect Rust unit tests passed.
- CLI built with
cargo build --locked -p socket-patch-cli.
- Full workspace Clippy passed with
cargo clippy --workspace --all-features -- -D warnings.
- Real depscan converter, PostgreSQL, object store, registry server, and API end-to-end tests passed: direct and workspace projects across hosted, vendored service, and vendored build modes.
- Fresh Cargo caches, locked offline execution of a patch-only function, byte-exact hosted downloads, idempotence, quoted/commented configuration, revert, tampered archive rejection, outside-path refusal, and legacy rows without index metadata all passed.
- Changed Rust file passes rustfmt and diff whitespace checks.
Public Changelog
Hosted Cargo patches now handle inherited workspace aliases and annotated registry configuration correctly, and safely refuse dependencies outside the editable project.
Checklist
- Is PR safe to revert (yes/no)?: Yes.
Companion to SocketDev/depscan#26792. Based on the current main commit 2390c5ff784d2a0fbca5fd13f9dff83752b7615a.
Note Medium Risk
Changes core Cargo.toml/Cargo.lock rewrite logic for hosted patches; mistakes could block valid redirects or still miss edge-case declarations, but failures are fail-closed with warnings rather than silent partial writes.
Overview
Hosted Cargo registry redirects are tightened so workspace aliases, lockfile ownership, and TOML edge cases no longer produce partial or wrong pins.
After plan_cargo_toml, a new validate_cargo_toml_pins pass parses the planned manifest and refuses the whole dependency if any matching declaration (root dotted forms, target.*, workspace.dependencies, workspace-inherited keys) is still unpinned—replacing behavior that could skip garbage lines and leave a partial redirect.
Workspace inheritance is resolved by alias/key before deciding whether an entry targets the patched crate (CargoWorkspaceEntry::OtherPackage, NeedsWorkspacePin for workspace = true in table blocks). Lock transitive checks now treat “pinned” local packages as (name, version) via cargo_manifest_package_id, including workspace-inherited versions and Cargo’s default 0.0.0.
TOML handling moves from narrow regexes to toml_edit-based string/inline parsing for registry pins, renames, and .cargo/config registry blocks (quoted headers, single-quoted values, comments). Malformed manifests that fail validation now emit redirect_cargo_toml_dep_unrewritable instead of best-effort partial rewrites.
Extensive regression tests cover partial-redirect refusal, renamed workspace deps, literal-string forms, and name+version lock matching.
Reviewed by Cursor Bugbot for commit a156d87. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Resolve inherited dependency aliases through their workspace definitions
and match local lockfile owners by both package name and version. This
allows valid workspace patches while refusing consumers outside the
editable project.
Read quoted dependency values and annotated registry tables consistently
so repeated application cannot leave an alias unpatched or create an
invalid duplicate TOML table.
Validated with 70 Cargo redirect unit tests and real service-backed
hosted, vendored service, and vendored build installs using fresh Cargo
caches, locked offline builds, integrity rejection, and revert.
Assisted-by: Codex:gpt-6-astra
Validate planned dependency pins against parsed TOML before writing any
files. Legal root and target dotted or inline declarations that the
source-preserving editor cannot rewrite now refuse the entire patch
instead of leaving a mixture of original and patched sources.
Validate unchanged member manifests too, while preserving workspace
inheritance and declarations for other package versions. Malformed TOML
is refused without changing the project.
Validated with 73 Cargo unit tests and the real converter/API/CLI matrix,
including an actual Cargo build proving the dotted manifest is valid
and remains byte-identical after refusal.
Assisted-by: Codex:gpt-6-astra
claude[bot] reacted with eyes emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
cursor[bot] reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Combine identical refusal branches for dotted dependencies without
changing which declarations are refused. Full workspace Clippy and all
73 Cargo redirect tests pass.
Assisted-by: Codex:gpt-6-astra
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit a156d87. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Mikola Lysenko (mikolalysenko)
added a commit
that referenced
this pull request
Sep 27, 2026
#256 replaced the cargo manifest regex readers (CARGO_TOML_PACKAGE_RE,
CARGO_TOML_VERSION_VAL_RE, and the capturing CARGO_TOML_REGISTRY_VAL_RE)
with TOML-parsed values (cargo_toml_string / cargo_toml_inline_string),
so single-quoted literals, quoted keys, and trailing comments read the
same way everywhere. The textual merge was clean, but #257's
CargoRegistryPins (the one-scan-per-manifest pin extractor behind the
vendored cargo PIN_MEMO) still used the removed package regex and the
old capture group of the registry regex.
Resolutions:
- CargoRegistryPins::of now reads values exactly as #256's
cargo_socket_registry_pin does: header-table `package`/`registry` via
cargo_toml_string, dotted `<crate>.registry` via cargo_toml_string,
inline tables via cargo_toml_inline_string (registry first, package
parsed only when a Socket pin is present). cargo_socket_registry_pin
(now #256's semantics) stays its #[cfg(test)] equivalence oracle.
- The V-7 pin-equivalence corpus gains #256's spellings (literal
strings, quoted inline keys, commented header lines) so the oracle
pins the new semantics.
- Everything else from #256 (workspace-inheritance resolution, (name,
version) lock owners, validate_cargo_toml_pins, annotated registry
headers in plan_cargo_config) merged untouched; #257's lock_block_end
bounded search + oracle, parse memos, presence probe and parallel
rewriter groups needed no change.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|