Hmbown/CodeWhale · error · ValidationError

Cargo metadata dependencies for

Error message

Cargo metadata dependencies for {dependent} must be a list

What it means

The validator expects each package's `dependencies` entry in cargo metadata to be a JSON list. If it is not (malformed or unexpected metadata shape), graph construction cannot proceed and it throws naming the offending dependent crate.

Solutions

Regenerate metadata with `cargo metadata --format-version 1 > metadata.json` and rerun.
Inspect workspace_by_name[dependent]['dependencies'] in the JSON to see the wrong shape.
Remove any custom transformation of the metadata before it reaches the validator.
Verify the script receives the file produced by the canonical cargo command, not a cached copy.

Example fix

// before
"dependencies": {"codewhale-config": {}}
// after (cargo metadata format)
"dependencies": [{"name": "codewhale-config", "path": "..."}]

Defensive patterns

Strategy: type-guard

Validate before calling

deps = pkg.get('dependencies', [])
if not isinstance(deps, list):
    raise SystemExit(f'regenerate metadata: dependencies for {pkg["name"]} is {type(deps).__name__}')

Type guard

def is_dep_list(v): return isinstance(v, list) and all(isinstance(d, dict) for d in v)

Try / catch

try:
    validate_order(...)
except ValidationError as e:
    print('metadata shape error:', e)

Prevention

Always feed the script raw `cargo metadata --format-version 1` output
Do not cache or post-process metadata between generation and validation
Assert the metadata JSON schema in tooling before consumption

When it happens

Trigger: Feeding the script hand-edited or non-standard JSON instead of real `cargo metadata --format-version 1` output; a wrapper script transforming the metadata and coercing dependencies to an object/null.

Common situations: Custom tooling post-processes cargo metadata; piping output of a different cargo command by mistake; a Python script consuming a stale cached snapshot with mangled structure.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@433685b202 (2026-09-15). Data as JSON: /api/errors/94ac4f0f5876e431. Report an issue: GitHub.

Appendix: source

Thrown at scripts/release/validate-crate-publish-order.py:126

    missing = sorted(set(release_names) - ordered_set)
    extra = sorted(ordered_set - set(release_names))
    if missing or extra:
        messages = []
        if missing:
            messages.append("publish package list is missing workspace crates: " + " ".join(missing))
        if extra:
            messages.append(
                "publish package list contains non-workspace crates: " + " ".join(extra)
            )
        raise ValidationError("\n".join(messages))

    positions = {name: index for index, name in enumerate(ordered_crates)}
    has_workspace_dependencies = {name: False for name in release_names}
    publish_edges: set[tuple[str, str, str]] = set()
    for dependent in release_names:
        dependencies = workspace_by_name[dependent].get("dependencies", [])
        if not isinstance(dependencies, list):
            raise ValidationError(f"Cargo metadata dependencies for {dependent} must be a list")
        for dependency in dependencies:
            if not isinstance(dependency, dict) or dependency.get("path") is None:
                continue
            dependency_name = dependency.get("name")
            if dependency_name not in workspace_by_name:
                continue
            has_workspace_dependencies[dependent] = True
            kind = dependency.get("kind") or "normal"
            # Cargo does not compile dev-dependencies while verifying a publish.
            # They may legitimately point back across the publication DAG.
            if kind == "dev":
                continue
            if dependency_name not in positions:
                raise ValidationError(
                    f"{dependent} depends on workspace crate {dependency_name} "
                    f"[{kind}], which is not in the codewhale-* release inventory"
                )
            publish_edges.add((dependency_name, dependent, str(kind)))

View on GitHub (pinned to 433685b202)