From 9b4ed0201cb4e47a97e6750d67bea5b4d4c1b8d0 Mon Sep 17 00:00:00 2001
From: NullSablex <244216261+NullSablex@users.noreply.github.com>
Date: Sun, 20 Sep 2026 18:00:30 -0300
Subject: [PATCH] ci: faz o Dependabot cobrir dependencias transitivas do Cargo

Por padrao o Dependabot so acompanha o que esta no manifesto, e a maior
parte do que o lockfile fixa nao vem daqui: vem atraves de outras crates.
Uma versao corrigida de uma dessas nunca aparece sozinha - ninguem esta
olhando para ela -, entao o `cargo audit` so reporta o problema quando
alguem abre um PR qualquer, e reprova esse PR, que nao causou nada.

Foi exatamente o que aconteceu no mysql_samp com o RUSTSEC-2026-0285: o
`rustls` corrigido estava publicado havia dias, chegava via `mysql` e nao
estava no Cargo.toml, entao nada o trouxe ate o audit reprovar um PR que
so subia versoes de actions.

`allow: dependency-type: all` e suportado para cargo e inclui as
dependencias das dependencias diretas. Com ele, a rodada semanal renova
tambem as transitivas: uma versao corrigida chega como bump de lockfile
comum e passa pelo `cargo audit` do CI como qualquer outra mudanca. Como
o grupo `cargo` casa `*`, tudo continua vindo num PR unico por semana.

O grupo novo `cargo-security` existe porque grupo so vale para version
updates a menos que diga o contrario: sem `applies-to: security-updates`,
varios advisories de uma vez virariam varios PRs.
---
 .github/dependabot.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 411f148..9051b84 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,13 +21,36 @@ updates:
     open-pull-requests-limit: 5
     commit-message:
       prefix: "chore(deps)"
+    # Transitive dependencies too, not just what Cargo.toml declares.
+    #
+    # By default Dependabot only tracks the manifest, and most of what the
+    # lockfile pins arrives through other crates rather than from here. A
+    # fixed version of one of those never shows up on its own: nothing is
+    # watching it, so `cargo audit` only reports the problem once someone
+    # happens to open a pull request - and then it fails that pull request,
+    # which did not cause it.
+    #
+    # With `all`, the weekly run refreshes transitive crates as well, so a
+    # patched version arrives as an ordinary lockfile bump and goes through
+    # `cargo audit` in CI like any other change. Supported for cargo:
+    # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
+    allow:
+      - dependency-type: "all"
     groups:
+      # One pull request per week for the lot, rather than one per crate.
       cargo:
         patterns:
           - "*"
         update-types:
           - "minor"
           - "patch"
+      # Security updates are not grouped by the block above: a group applies
+      # to version updates unless it says otherwise. Without this, several
+      # advisories at once would mean several pull requests.
+      cargo-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
   - package-ecosystem: "pip"
     directory: "/docs"
     schedule: