feat(deps): parse Cargo build-dependencies and target.* dependency tables

[Arthur742Ramos]

Summary

extractCargoDependencies only recognized [dependencies] and [dev-dependencies], so [build-dependencies] and platform-specific [target.<spec>.dependencies] tables were silently dropped — undercounting dependencies for a large class of real Rust crates (anything using build.rs deps like cc/bindgen, or platform-gated deps like winapi/nix).

Now also parses:

• [build-dependencies] (+ detailed .<crate> tables) → dev. Build-deps run only at compile time (build.rs) and aren't shipped in the runtime artifact. The Dependency.type enum has no "build" member, so "dev" (not-shipped-at-runtime tooling) is the accurate bucket and keeps totalCount correct.
• [target.<triple-or-cfg>.dependencies] → runtime
• [target.<...>.dev-dependencies] / [target.<...>.build-dependencies] → dev

Implementation note

The target prefix is matched with an optional, backtracking (?:target\..+\.)? group, so cfg() expressions and dotted triples — which contain dots, quotes, and parens (e.g. [target.'cfg(windows)'.dependencies], [target.x86_64-pc-windows-msvc.dependencies]) — classify correctly, and the existing [dependencies.<crate>] detailed-table path extends for free to [target.<x>.dependencies.<crate>]. [features]/[profile]/[[bin]] are still ignored, and dedup-by-${section}:${name} is preserved.

Test plan

• CI green on Node 20/22/24 (Linux + Windows)
• New tests: build-deps→dev (incl. detailed table version backfill), target cfg+triple deps→runtime, target dev/build→dev, [features]/[profile] still ignored, dedup across [dependencies]+[target.*]
• Existing two Cargo cases (features/profile reset; inline-table + [dependencies.<crate>]) still pass

[Copilot]

Pull request overview

This PR expands the Rust Cargo.toml dependency extraction so dependency tables beyond the top-level [dependencies] / [dev-dependencies] are no longer silently ignored, improving accuracy for crates that use build tooling deps (build.rs) and platform-gated deps.

Changes:

• Extend Cargo parsing to recognize [build-dependencies] (including detailed .<crate> tables) and classify them as dev.
• Add support for platform-specific [target.<spec>.(dependencies|dev-dependencies|build-dependencies)] tables, mapping dependencies → runtime and the others → dev.
• Add targeted tests covering build deps, target cfg/triple tables, dedup behavior, and continued ignoring of [features] / [profile].

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/deps.ts	Updates Cargo table-header recognition to include build-dependencies and target.* tables; maps build/dev tables to dev and keeps non-dependency tables from leaking keys into results.
test/deps-parsers.test.ts	Adds new Cargo-focused unit tests validating classification, detailed-table version backfill, dedup across target/runtime deps, and ignoring non-dependency tables.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.