Match dependency kind in find_resolved_dep to avoid inlining wrong spec

find_resolved_dep previously matched only by name/target, ignoring
DependencyKind. When a crate declares the same dep in multiple tables
(e.g. [dependencies] and [dev-dependencies]) with different settings,
the wrong entry could be returned.

Add a kind parameter to find_resolved_dep and pass the appropriate
DependencyKind (derived from the dep_kind table name) from both
resolve_workspace_deps and the target-specific loop.

Also add a workspace dev-dependency (log) to the test crate to cover
the dev-dependencies path, and update pyo3 to 0.27.0 to match other
test crates.

Author: messense

src/source_distribution/cargo_toml_rewrite.rs

@@ -1,6 +1,7 @@
 use super::PathDependency;
 use super::utils::{normalize_path, relative_path};
 use anyhow::{Context, Result};
+use cargo_metadata::DependencyKind;
 use fs_err as fs;
 use path_slash::PathExt as _;
 use std::collections::{HashMap, HashSet};
@@ -226,9 +227,12 @@ pub(super) fn resolve_workspace_inheritance(
                     if !is_workspace {
                         continue;
                     }
-                    if let Some(resolved_dep) =
-                        find_resolved_dep(resolved, &dep_name, Some(&target_key))
-                    {
+                    if let Some(resolved_dep) = find_resolved_dep(
+                        resolved,
+                        &dep_name,
+                        Some(&target_key),
+                        dep_kind_from_str(dep_kind),
+                    ) {
                         deps.insert(&dep_name, resolved_dep_to_toml(&resolved_dep));
                     } else {
                         debug!(
@@ -277,7 +281,9 @@ fn resolve_workspace_deps(
             continue;
         }
 
-        if let Some(resolved_dep) = find_resolved_dep(resolved, &dep_name, None) {
+        if let Some(resolved_dep) =
+            find_resolved_dep(resolved, &dep_name, None, dep_kind_from_str(dep_kind))
+        {
             let new_entry = resolved_dep_to_toml(&resolved_dep);
             if let Some(deps_table) = document.get_mut(dep_kind).and_then(|t| t.as_table_mut()) {
                 deps_table.insert(&dep_name, new_entry);
@@ -288,18 +294,32 @@ fn resolve_workspace_deps(
     }
 }
 
+/// Maps a Cargo.toml dependency table name to the corresponding `DependencyKind`.
+fn dep_kind_from_str(dep_kind: &str) -> DependencyKind {
+    match dep_kind {
+        "dev-dependencies" => DependencyKind::Development,
+        "build-dependencies" => DependencyKind::Build,
+        _ => DependencyKind::Normal,
+    }
+}
+
 /// Finds a resolved dependency by name in the package metadata.
 fn find_resolved_dep(
     resolved: &cargo_metadata::Package,
     name: &str,
     target: Option<&str>,
+    kind: DependencyKind,
 ) -> Option<ResolvedDep> {
     resolved.dependencies.iter().find_map(|d| {
         // Match by name, considering renames
         let matches_name = d.rename.as_deref() == Some(name) || d.name == name;
         if !matches_name {
             return None;
         }
+        // Match by dependency kind
+        if d.kind != kind {
+            return None;
+        }
         // If a target is specified, match against it
         if let Some(target_str) = target
             && d.target.as_ref().map(|t| t.to_string()).as_deref() != Some(target_str)

test-crates/parent_workspace_sdist/Cargo.toml

@@ -6,3 +6,6 @@ resolver = "2"
 [workspace.package]
 edition = "2021"
 readme = "README.md"
+
+[workspace.dependencies]
+log = "0.4"

test-crates/parent_workspace_sdist/crates/pysof/Cargo.lock

@@ -11,5 +11,5 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [dependencies]
-pyo3 = { version = "0.25.0", features = ["extension-module"] }
+pyo3 = { version = "0.27.0", features = ["extension-module"] }
 shared_crate = { path = "../shared_crate" }

test-crates/parent_workspace_sdist/crates/pysof/Cargo.toml

@@ -5,3 +5,6 @@ edition.workspace = true
 readme.workspace = true
 
 [lib]
+
+[dev-dependencies]
+log = { workspace = true }

test-crates/parent_workspace_sdist/crates/shared_crate/Cargo.toml

@@ -909,6 +909,9 @@ fn lib_with_parent_workspace_path_dep_sdist() {
         readme = "README.md"
 
         [lib]
+
+        [dev-dependencies]
+        log = "^0.4"
     "#]];
     handle_result(other::test_source_distribution(
         "test-crates/parent_workspace_sdist/crates/pysof",