{"record":{"id":"94ac4f0f5876e431","repo":"Hmbown/CodeWhale","slug":"cargo-metadata-dependencies-for-dependent-must-b","errorCode":null,"errorMessage":"Cargo metadata dependencies for {dependent} must be a list","messagePattern":"Cargo metadata dependencies for (.+?) must be a list","errorType":"validation","errorClass":"ValidationError","httpStatus":null,"severity":"error","filePath":"scripts/release/validate-crate-publish-order.py","lineNumber":126,"sourceCode":"    missing = sorted(set(release_names) - ordered_set)\n    extra = sorted(ordered_set - set(release_names))\n    if missing or extra:\n        messages = []\n        if missing:\n            messages.append(\"publish package list is missing workspace crates: \" + \" \".join(missing))\n        if extra:\n            messages.append(\n                \"publish package list contains non-workspace crates: \" + \" \".join(extra)\n            )\n        raise ValidationError(\"\\n\".join(messages))\n\n    positions = {name: index for index, name in enumerate(ordered_crates)}\n    has_workspace_dependencies = {name: False for name in release_names}\n    publish_edges: set[tuple[str, str, str]] = set()\n    for dependent in release_names:\n        dependencies = workspace_by_name[dependent].get(\"dependencies\", [])\n        if not isinstance(dependencies, list):\n            raise ValidationError(f\"Cargo metadata dependencies for {dependent} must be a list\")\n        for dependency in dependencies:\n            if not isinstance(dependency, dict) or dependency.get(\"path\") is None:\n                continue\n            dependency_name = dependency.get(\"name\")\n            if dependency_name not in workspace_by_name:\n                continue\n            has_workspace_dependencies[dependent] = True\n            kind = dependency.get(\"kind\") or \"normal\"\n            # Cargo does not compile dev-dependencies while verifying a publish.\n            # They may legitimately point back across the publication DAG.\n            if kind == \"dev\":\n                continue\n            if dependency_name not in positions:\n                raise ValidationError(\n                    f\"{dependent} depends on workspace crate {dependency_name} \"\n                    f\"[{kind}], which is not in the codewhale-* release inventory\"\n                )\n            publish_edges.add((dependency_name, dependent, str(kind)))","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/scripts/release/validate-crate-publish-order.py#L108-L144","documentation":"For the named workspace package, the metadata 'dependencies' field is not a JSON array. cargo metadata always emits dependencies as a list, so this is a fixture/metadata-integrity guard before the path-dependency scan iterates it.","triggerScenarios":"A --metadata-file fixture where a package's 'dependencies' was written as an object, a string, or null; a hand-merged fixture that mangled the field.","commonSituations":"Authoring synthetic metadata for the validator's unit tests with a malformed dependencies entry.","solutions":["Regenerate the fixture from real cargo output: cargo metadata --locked --format-version 1 --no-deps","Or fix the named package's 'dependencies' entry in the fixture to be a list (possibly empty)"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"def dependencies_are_lists(packages: list) -> bool:\n    return all(\n        isinstance(p.get(\"dependencies\", []), list)\n        for p in packages\n        if isinstance(p, dict)\n    )","tryCatchPattern":null,"preventionTips":["Regenerate fixtures from real cargo metadata after any change instead of editing them by hand"],"tags":["json","validation","cargo","fixtures","python"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}