Support Cargo workspace/path-only dependencies and the pnpm workspace protocol

[johncarmack1984]

Supersedes #369. I lost write access to the fork that branch lives on (left the org), so this is the same change rebuilt from scratch on current main: one commit, tests written against the Effection v4 / vitest v4 setup, no lockfile churn this time.

And your February question deserves an actual answer, so:

Are you defining and publishing/changelog multiple crates as part monorepo where some/all have their version actually defined in the Cargo.toml at the root? Or is it just if any deps don't have a version number?

The second one. Every crate keeps its own [package] version in its own manifest; the root version inheritance covector already supports isn't involved. What breaks is two dependency shapes that are legitimately version-less in Cargo:

• dep = { workspace = true }: the version lives in the root [workspace.dependencies], not in the member manifest covector is reading
• dep = { path = "../pkg" }: no version anywhere, which is normal for internal crates that never touch a registry

The real-world setup this came from (a private aviation monorepo, ~60 covector-managed crates): the root [workspace.dependencies] declares each internal crate as { path = "...", version = "*" }, members consume them with { workspace = true }, covector runs the version/changelog cascade, and nothing publishes to crates.io. getPackageFileVersion throws on both shapes today, so covector version can't run at all on that repo.

Your intent (bump a dep's declared version if it has one) is preserved:

• String deps and object deps with a version bump exactly as before.
• For the two shapes above there is no version string in the member manifest to bump, and setPackageFileVersion already skips version-less object deps, so the manifest is left untouched and cargo resolves through the workspace/path. There's an apply test now asserting a { workspace = true } table survives a cascade bump byte-for-byte.
• Any other version-less object dep (git-only, say) still throws, so the publish guard stays.

One honest flag: the existing validate test for path-only deps flips from "expects an error" to "expects success". That IS the behavior change, not collateral damage.

What this deliberately does not do: bump versions inside the root [workspace.dependencies] table, which a workspace that publishes to crates.io with real requirements there would eventually want. Happy to take that as a follow-up if you're interested.

For whatever it's worth: this exact change ran in production on that monorepo for about six months of releases before I left. It held up.

---

Update: pnpm/yarn workspace: protocol for JS packages (second commit, same branch)

Following up from Discord: the JS side had the same class of bug. A "workspace:*" dependency contains no ., so deriveVersionConsideringPartials treated it as a partial version pin and rewrote it to the dep's bare major version — "0" for any 0.x package. workspace:^ became "^0", and workspace:~1.2.3 lost its protocol prefix entirely.

Handling now lives in getDepBumpVersion:

• workspace:* / workspace:^ / workspace:~ (and aliased workspace:name@range declarations) are left untouched: they pin to whatever version the workspace holds and the package manager rewrites them at publish time, so there is no version in the declaration to bump.
• An embedded range like workspace:^1.2.3 keeps the protocol prefix and bumps the range within it (so a minor bump of the dep yields workspace:^1.3.0), preserving the existing partial-pin semantics.

An apply-level test (new fixture pkg.js-pnpm-workspace) asserts the float forms survive a cascade bump byte-for-byte, the embedded range bumps in place, and the dependent's own version still bumps.

[github-actions]

Package Changes Through a861b7e

There are 9 changes which include action with minor, @covector/assemble with minor, @covector/files with minor, covector with minor, @covector/apply with minor, @covector/changelog with minor, @covector/command with minor, @covector/toml with minor, @covector/types with minor

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
covector	0.12.5	0.13.0
@covector/apply	0.10.0	0.11.0
@covector/assemble	0.12.0	0.13.0
@covector/changelog	0.12.0	0.13.0
@covector/files	0.8.0	0.9.0
@covector/command	0.8.0	0.9.0
@covector/toml	0.2.0	0.3.0
@covector/types	0.0.0	0.1.0
action	0.12.5	0.13.0

Add another change file through the GitHub UI by following this link.

---

Read about change files or the docs at github.com/jbolda/covector

[jbolda]

Super appreciate it! Looks great!