Cargo: force --precise fallback for lockstep family updates

[kbukum1]

Fixes #16092

What are you trying to accomplish?

• Problem: when a dependency's target version requires sibling crates to move in lockstep (e.g. futures 0.3.34 requires futures-* at ^0.3.34) and those siblings are shared across workspace members, a plain single-package cargo update can't move them and silently leaves the line unchanged.
• Result: validation sees the dependency still at its old version and errors out.
• Fix: fall back to a --precise retry only when the plain update leaves the dependency stuck, forcing the coordinated family update.

Anything you want to highlight for special attention from reviewers?

• Targeted fallback, not a change to the happy path — the --precise retry fires only when the dep is still pinned at its previous version.
• The "did the plain update move it?" decision compares the dependency's [[package]] entries and its incoming edges before/after, so an edge repointed onto an already-present target entry is correctly treated as a real move (avoids forcing a doomed --precise when the target already coexists).
• No-regression by design: constraint-driven "Cargo chose a different valid version" and git-dependency paths are intentionally left untouched.

How will you know you've accomplished your goal?

• New regression test reproduces the stuck lockstep case and asserts the --precise retry resolves it.
• An unstubbed real-cargo test runs against a workspace fixture built from the actual reproduction, confirming the fallback works end-to-end (not just against a mock).
• Guard tests confirm the fallback does not fire when the plain update already worked, when Cargo legitimately resolved to a different version, or when the target version already coexists and only an edge is repointed.
• Validated locally: cargo suite, Sorbet, and RuboCop all pass.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 3

New issues introduced by this change (3)

Severity	Finding
	cargo/​lib/​dependabot/​cargo/​file_updater/​lockfile_updater.rb — The signature includes each package block verbatim, so a change to the package's outgoing…
	cargo/​lib/​dependabot/​cargo/​file_updater/​lockfile_updater.rb — This collects only the referenced target strings and discards the parent package for each incoming…
	cargo/​spec/​dependabot/​cargo/​file_updater/​lockfile_updater_spec.rb — This spec explicitly resolves against the live crates.io registry, making the Cargo suite…

Issues resolved since last review (1)

Severity	Finding
	cargo/​spec/​dependabot/​cargo/​file_updater/​lockfile_updater_spec.rb — --precise 0.3.34 constrains only the selected futures package; its sibling requirements are… View resolved comment

[Copilot]

Copilot review overview

🔵 Needs a closer look

Review tier: Balanced
Findings: 1

Pre-existing issues (1)

Severity	Finding
	cargo/​spec/​dependabot/​cargo/​file_updater/​lockfile_updater_spec.rb — This spec explicitly resolves against the live crates.io registry, making the Cargo suite… View comment

Issues resolved since last review (2)

Severity	Finding
	cargo/​lib/​dependabot/​cargo/​file_updater/​lockfile_updater.rb — This collects only the referenced target strings and discards the parent package for each incoming… View resolved comment
	cargo/​lib/​dependabot/​cargo/​file_updater/​lockfile_updater.rb — The signature includes each package block verbatim, so a change to the package's outgoing… View resolved comment

Suppressed comments (2)

cargo/lib/dependabot/cargo/file_updater/lockfile_updater.rb:135

• This only compares the state immediately around the current command. In a grouped update, an earlier dependency command can already repoint this dependency to the target while retaining the old entry for another constrained consumer; the current plain command then makes no change, this condition returns true, and --precise is run against the legitimately retained old package—the same doomed operation the edge check is intended to avoid. Preserve a pre-run signature (or otherwise detect movement that occurred before this command) and cover the retained-old-entry, multi-dependency case.

          return false if dependency_move_signature(lockfile_before, dependency) !=
                          dependency_move_signature(lockfile_after, dependency)

          package_version_count(lockfile_after, dependency, previous_version).positive?

cargo/lib/dependabot/cargo/file_updater/lockfile_updater.rb:807

• The parent qualifier omits source, although Cargo can contain two parent packages with the same name/version from different sources. If those parents swap foo versions, both edge arrays sort to the same values, so a real edge move is misclassified as a no-op and the fallback may force a doomed update. Include the parent's source in its identity.

            parent_id = [block[/^name = "[^"]+"$/], block[/^version = "[^"]+"$/]].compact.join(" ")