⚠️ Potential issue | 🟡 Minor

#!/bin/bash
# Check if serde_core appears in any Cargo.toml or Cargo.lock
echo "=== Checking Cargo.lock ==="
rg -n 'serde_core' Cargo.lock || echo "Not found in Cargo.lock"

echo ""
echo "=== Checking Cargo.toml files ==="
fd 'Cargo.toml' --exec rg -l 'serde_core' {} || echo "Not found in any Cargo.toml"

Reconsider including serde_core in the groups section—it appears to be a transitive dependency, not a direct one.

serde_core is present in Cargo.lock but not declared in any Cargo.toml file, meaning it's a transitive dependency that will be pulled in by another package. Including transitive dependencies explicitly in Dependabot groups is usually unnecessary since they're updated indirectly through their parent packages. Consider removing it or investigating whether explicit grouping here serves a specific purpose you need to maintain.

In @.github/dependabot.yml around lines 83 - 87, The dependabot group currently
lists "serde_core" which is a transitive dependency (present in Cargo.lock but
not in any Cargo.toml); remove "serde_core" from the serde group in the
dependabot.yml so only direct packages ("serde", "serde_derive") are grouped, or
if you intentionally need to pin it, document why and add a direct dependency
declaration to Cargo.toml; search for the serde group entry and remove the
"serde_core" pattern or replace it with a comment explaining the intent.

How can we ensure that transitive dependencies are upgraded in lockstep with direct dependencies?

@fanninpm Great question! In the Cargo ecosystem, transitive dependencies are automatically upgraded in lockstep with their direct dependencies when Dependabot (or cargo update) updates the Cargo.lock file. Here's how it works:

How Cargo Handles Transitive Dependencies

When Dependabot updates a direct dependency like serde:

1. It runs cargo update for that package
2. Cargo automatically resolves and updates all transitive dependencies (like serde_core) to versions compatible with the new direct dependency version
3. The entire dependency tree is updated atomically in Cargo.lock

Dependabot Groups and Transitive Dependencies

You don't need to explicitly include transitive dependencies in Dependabot groups because:

• Dependabot respects Cargo's dependency resolution
• When serde is updated, serde_core will automatically be updated to the version that serde requires
• Including serde_core explicitly in the group pattern won't change this behavior since it's not in any Cargo.toml

Recommendation

For the serde group, you can safely keep just the direct dependencies:

serde:
  patterns:
    - "serde"
    - "serde_derive"

The transitive dependency serde_core will still be updated whenever serde is updated—the grouping just controls which direct dependency updates are batched together in a single PR. If serde_core isn't a direct dependency, the pattern won't match anything anyway, so including it is harmless but unnecessary.

If you have concerns about specific transitive dependency versions, you can make them direct dependencies by adding them to your Cargo.toml with explicit version requirements.