⚠️ Potential issue | 🟡 Minor

#!/bin/bash
# 1) Check whether a `crates/` parent directory exists and what it contains.
echo "=== crates/ tree ==="
fd -t d -d 2 . crates 2>/dev/null || echo "(no crates/ directory found)"

# 2) List all Cargo.toml files in the repo (excluding vendored/target dirs)
echo
echo "=== All Cargo.toml locations ==="
fd -H -t f '^Cargo\.toml$' -E target -E vendor

# 3) Inspect workspace members declared at the repo root
echo
echo "=== Root Cargo.toml [workspace] section ==="
sed -n '/\[workspace\]/,/^\[/p' Cargo.toml 2>/dev/null | head -n 80

Consider simplifying to directory: "/" unless per-crate configurations are intentional.

The glob pattern crates/* does match workspace member directories; however, Dependabot's official guidance (as of June 2024) states that for Cargo workspaces, configuring directory: "/" alone is sufficient and recommended. Dependabot automatically discovers and updates all workspace members listed in the root workspace configuration. Adding member directories separately via the directories field may lead to redundant configurations and overlapping update rules.

If the intent is to apply distinct schedules, ignore rules, or version groups to specific crates, then explicit per-crate entries make sense. Otherwise, remove "crates/*" and rely on the root configuration.

Verify each finding against the current code and only fix it if needed.

In @.github/dependabot.yml around lines 5 - 7, The dependabot config currently
lists directories: - "/" and - "crates/*", which is redundant for a Cargo
workspace; update the dependabot.yml by removing the "crates/*" entry so only
directories: - "/" remains unless you intentionally need per-crate schedules or
ignore rules; locate the directories key in .github/dependabot.yml and delete
the "crates/*" line or replace the array with a single "directory: \"/\"" entry
when simplifying to root-only workspace discovery.

The problem is that Dependabot was updating blake2 in /Cargo.toml (in the root directory) but simultaneously not updating blake2 in crates/stdlib/Cargo.toml. Is there any way to fix this?

@fanninpm, that's a well-known pain point with Dependabot and Cargo workspaces — my earlier concern was unwarranted. When both the root Cargo.toml and a subdirectory crate (e.g. crates/stdlib/Cargo.toml) share a dependency, Dependabot historically opened a PR only for the root crate, leaving the subdirectory crate behind and causing version drift.

Adding "crates/*" via the directories glob is the correct fix here — it explicitly tells Dependabot to scan each subdirectory under crates/ for its own Cargo.toml and open update PRs for those manifests independently. The change is valid and the PR looks good as-is. Sorry for the noise!

Learnt from: fanninpm
Repo: RustPython/RustPython PR: 7687
File: .github/dependabot.yml:5-7
Timestamp: 2026-04-25T16:47:08.900Z
Learning: In RustPython/RustPython, Dependabot only updates the root `/Cargo.toml` when using `directory: "/"` for the Cargo ecosystem, but does NOT automatically update dependencies in workspace member crates under `crates/` (e.g. `crates/stdlib/Cargo.toml`). The correct fix is to use the `directories` field with both `"/"` and `"crates/*"` in `.github/dependabot.yml` so that Dependabot scans each crate subdirectory separately.

Learnt from: CR
Repo: RustPython/RustPython PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-06T05:30:53.056Z
Learning: Applies to **/*.rs : Follow the default rustfmt code style by running `cargo fmt` to format Rust code