[v-kbukum1]

What are you trying to accomplish?

Improve observability for recurring Cargo sparse-index download failures from crates.io, especially transport errors such as Weird server reply (Invalid status line). The goal is to add enough sanitized structured context to distinguish whether these failures are coming from Cargo/libcurl, crates.io/CDN, Dependabot proxying, or surrounding infrastructure, without adding sensitive registry data to Sentry context.

Related public issues: #14743, #14540

Anything you want to highlight for special attention from reviewers?

The added context is intentionally narrow: it is only populated for recognized public index.crates.io sparse-index download failures. Arbitrary registry URLs, credentials, Cargo config contents, environment values, and raw Cargo output are not copied into the new structured context.

This keeps the existing Cargo subprocess failure flow intact while adding safe fields that should make the recurring failure mode easier to group and investigate.

How will you know you've accomplished your goal?

The Cargo lockfile updater spec covers both the positive crates.io sparse-index case and a private/arbitrary registry failure case to ensure sensitive registry details are not added to the structured context.

Validation run:

• bundle exec rspec spec/dependabot/cargo/file_updater/lockfile_updater_spec.rb
• bundle exec rubocop lib/dependabot/cargo/file_updater/lockfile_updater.rb spec/dependabot/cargo/file_updater/lockfile_updater_spec.rb

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

This PR improves observability for recurring Cargo sparse-index transport failures when downloading from the public index.crates.io sparse index by attaching a small, sanitized set of structured fields to HelperSubprocessFailed error context (without adding structured context for arbitrary/private registries).

Changes:

• Add parsing logic in the Cargo lockfile updater to detect index.crates.io sparse-index download failures and extract safe structured fields (host, index path, download path, package name, curl code/message, protocol when known).
• Sanitize curl error messages before attaching them to structured context (dropping messages that look like they might contain URLs or userinfo).
• Add specs covering (1) the crates.io sparse-index transport failure case and (2) an arbitrary registry failure case to ensure no credential-like registry details are added to error_context.

Show a summary per file

File	Description
cargo/lib/dependabot/cargo/file_updater/lockfile_updater.rb	Adds crates.io sparse-index error-context extraction and sanitized curl error message handling, merged into existing helper subprocess failure context.
cargo/spec/dependabot/cargo/file_updater/lockfile_updater_spec.rb	Adds regression coverage ensuring crates.io failures get structured context and arbitrary registry failures do not.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[v-kbukum1]

Fixed through dependabot/proxy#138