[goosewobbler]

Description

Releases now update every committed Cargo.lock that records a bumped crate, so no follow-up sync PR is needed. It needs no Rust toolchain or network, and a lock that can't be updated fails the run instead of warning.

Checked against webdriverio/desktop-mobile#748, the last manual sync PR: replaying its bumps changes the same four locks, byte for byte.

Every bump path syncs. Every version-step Cargo.toml write goes through updateCargoVersion, which now records the bump; VersionEngine.run syncs the locks once at the end. Groups, the per-package processor and updateCargoFiles are all covered, and a new bump path can't skip it. Every edit is worked out before any lock is written.

No cargo. The lock text is edited the way cargo would edit it: the entry's version line, any "<name> <old version>" references, and cargo's ordering when the lock also holds another version of the crate. Byte-identical to cargo for v3 and v4 locks.

Which locks. Every git-tracked Cargo.lock, plus each crate's own lock (at its workspace root, by cargo's rule) unless git ignores it. Crate names repeat across workspaces (every tauri init app is app, and 0.1.0 is cargo's default version), so another workspace's lock follows a bump only if that workspace reaches the crate's directory through path dependencies, as cargo resolves them: target-specific, workspace = true, and dev-dependencies of its own members. [patch] isn't followed yet (#706): cargo drops a patch the bumped version no longer satisfies.

Failures. An ambiguous lock (several path entries with the name, or another source holding the crate at the old or new version), or one in a format newer than v4, throws CARGO_LOCK_SYNC_ERROR, exit family VERSION_ERROR, in dry runs too. docs/rust.md covers each case.

Where the edits land.

• Standing PR: the version step writes them and git add -A stages them.
• releasekit version: writes them.
• Direct release: flushed with the manifests; publish's prepare stage re-syncs and stages every lock that lists a bumped crate.
• Publish's own sync only warns: after a standing-PR merge, a lock fix-up mustn't strand a release that's already on the base branch.

Breaking changes

• Removed @releasekit/version's syncCargoLockfile export; only the integration test used it.
• findCargoLockfile follows cargo's workspace-root rule, including exclude and package.workspace pointers, and no longer returns an ancestor lock that isn't the root.
• New core exports: planCargoLockUpdates and its types. @releasekit/git gains lsFiles and isIgnored.
• createSync/Single/AsyncStrategy called directly, without VersionEngine, no longer sync locks. No in-repo caller does that.

CARGO_LOCK_SYNC_ERROR sits next to where #616 expands CODE_TO_EXIT; whichever lands second keeps both.

Related Issue(s)

Closes #650. Follow-up to #496.

Type of Change

• feat — New feature
• fix — Bug fix
• docs — Documentation change
• refactor — Code refactoring
• test — Adding or updating tests
• chore — Maintenance, dependencies, tooling
• Breaking change — Requires major version bump

Scope

• @releasekit/version
• @releasekit/notes
• @releasekit/publish
• @releasekit/config
• @releasekit/core
• CI / workflows
• Root / monorepo

Checklist

• Lint passes (pnpm lint)
• Tests pass (pnpm test)
• Typecheck passes (pnpm typecheck)
• Documentation updated (if applicable)
• Breaking changes noted in description

Testing Notes

• test/integration/cargo-lock-sync.spec.ts runs the built CLI with no cargo and an empty CARGO_HOME, then checks the result with real cargo. Every lock passes cargo metadata --locked unchanged, for groups, the per-package processor and updateCargoFiles; the edit matches cargo update --workspace byte for byte, reordering included; a same-named app's lock is left alone. CI's Integration Tests job installs a Rust toolchain for it.
• Unit tests drive every bump path through VersionEngine.run in a real git work tree, and cover the lock edit, the workspace-root rule and the planner in core.
• Checked by hand against real cargo: prerelease crossings, and the 22 workspace layouts cargo accepts.
• Lint, typecheck and every unit and integration suite pass.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge with the documented limitation for patch-only dependencies.

Summary

The PR updates related Cargo.lock files without running Cargo and fails the version step when a selected lock cannot be edited safely.

• Cargo locks follow path-linked crates and receive Cargo-style version edits.
• Version runs sync Cargo locks for every crate they bump.
• Direct releases sync and stage every lock that records a bumped crate.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Write Cargo.toml versions] --> B[Record bumped crates]
  B --> C[Find related Cargo.lock files]
  C --> D[Plan all lock edits]
  D --> E{Can selected locks be edited?}
  E -->|Yes| F[Write locks or record dry-run edits]
  E -->|No| G[Fail the version step]

Loading

_{Reviews (5) · Last reviewed commit: "fix(core): stop following [patch] when s..." · Reviewed by Greptile}

[github-actions]

Standing release PR: #614 · v0.42.0 queued (4 packages) · open 82d 18h 14m · ✅ ready to merge

Release Preview — v0.41.2 → v0.41.3

Note: Labels on this PR are advisory in standing-pr mode. Bumps come from conventional commits in the standing PR; override by editing labels on the standing PR itself. Add release:immediate to bypass the standing PR and release this PR directly.

These changes will be added to the release PR (#614) when merged:

Changelog

monorepo 0.41.2 → 0.41.3

Changed

• add a Live Tests job, starting with notes against Ollama Cloud (PR #697 · closes #589)
• run tests when packages/forge or packages/git change (PR #705 · closes #704)
• cut isOllamaUnreachable's tests to the three that pin its rule (notes) (PR #702)
• generate release notes with the OLLAMA_MODEL repo variable's model (PR #703)
• make the LLM e2e infra-tolerant and close a false green (notes) (PR #618)
• cut Cargo.lock sync comments to the non-obvious
• pin whole-component exclude matching; note the unfollowed workspace pointer (core)
• note the any-version case of the same-name limitation (rust)
• shorten the same-name limitation (rust)
• narrow the same-name claim, note the residual case and exit codes (rust)
• keep the exit-code table to families; shorten the lock-sync bullet
• document CARGO_LOCK_SYNC_ERROR and how lock entries are matched
• add braces to every single-statement body

Fixed

• stop following [patch] when syncing Cargo.lock (core)
• refuse to edit a Cargo.lock format newer than v4 (core)
• follow package.workspace pointers, and only the root's [patch] (core)
• sync another workspace's Cargo.lock only if it reaches the crate by path (core)
• push the current branch when git.branch is unset (publish) (PR #696 · closes #688)
• find a crate's Cargo.lock by cargo's workspace-root rule (core)
• treat a lock beside a crate's manifest as its own (version)
• sync a lock entry only for the crate it records, never an ignored lock (version)
• keep cargo's order when a lock bump passes another version (core)
• sync every committed Cargo.lock that records a bumped crate (version)
• sync Cargo.lock on every Cargo.toml bump path (version) (#650)

All packages → 0.41.3 (sync versioning)

• @releasekit/version
• @releasekit/notes
• @releasekit/publish
• @releasekit/release

After merge — predicted release

No version escalation — this PR's changes will be included in the queued release without affecting the projected versions.

Package	Standing PR	This PR	After merge
monorepo	0.42.0	0.41.3	0.42.0

---

Updated automatically by ReleaseKit