Hmbown/CodeWhale · error · ValidationError

Cargo metadata dependencies for {dependent} must be a list

Error message

Cargo metadata dependencies for {dependent} must be a list

What it means

For the named workspace package, the metadata 'dependencies' field is not a JSON array. cargo metadata always emits dependencies as a list, so this is a fixture/metadata-integrity guard before the path-dependency scan iterates it.

Source

Thrown at scripts/release/validate-crate-publish-order.py:126

    missing = sorted(set(release_names) - ordered_set)
    extra = sorted(ordered_set - set(release_names))
    if missing or extra:
        messages = []
        if missing:
            messages.append("publish package list is missing workspace crates: " + " ".join(missing))
        if extra:
            messages.append(
                "publish package list contains non-workspace crates: " + " ".join(extra)
            )
        raise ValidationError("\n".join(messages))

    positions = {name: index for index, name in enumerate(ordered_crates)}
    has_workspace_dependencies = {name: False for name in release_names}
    publish_edges: set[tuple[str, str, str]] = set()
    for dependent in release_names:
        dependencies = workspace_by_name[dependent].get("dependencies", [])
        if not isinstance(dependencies, list):
            raise ValidationError(f"Cargo metadata dependencies for {dependent} must be a list")
        for dependency in dependencies:
            if not isinstance(dependency, dict) or dependency.get("path") is None:
                continue
            dependency_name = dependency.get("name")
            if dependency_name not in workspace_by_name:
                continue
            has_workspace_dependencies[dependent] = True
            kind = dependency.get("kind") or "normal"
            # Cargo does not compile dev-dependencies while verifying a publish.
            # They may legitimately point back across the publication DAG.
            if kind == "dev":
                continue
            if dependency_name not in positions:
                raise ValidationError(
                    f"{dependent} depends on workspace crate {dependency_name} "
                    f"[{kind}], which is not in the codewhale-* release inventory"
                )
            publish_edges.add((dependency_name, dependent, str(kind)))

View on GitHub (pinned to 8880682c63)

Solutions

1. Regenerate the fixture from real cargo output: cargo metadata --locked --format-version 1 --no-deps
2. Or fix the named package's 'dependencies' entry in the fixture to be a list (possibly empty)

def dependencies_are_lists(packages: list) -> bool:
    return all(
        isinstance(p.get("dependencies", []), list)
        for p in packages
        if isinstance(p, dict)
    )

When it happens

Trigger: A --metadata-file fixture where a package's 'dependencies' was written as an object, a string, or null; a hand-merged fixture that mangled the field.

Common situations: Authoring synthetic metadata for the validator's unit tests with a malformed dependencies entry.

Related errors

• workspace package is missing a name
• receipt metric `representative_context.fixture_id` must be `
• budget metric `representative_context.fixture_id` must be `{
• Cargo metadata is not valid JSON: {error}
• Cargo metadata root must be an object

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/94ac4f0f5876e431. Report an issue: GitHub.