feat: update dependencies and enhance package spec parsing with unknown key handling

Cargo.lock

@@ -418,7 +418,7 @@ checksum = "807800ff3288b621186fe0a8f3392c4652068257302709c24efd918c3dffcdc2"
 
 [[package]]
 name = "depot"
-version = "0.15.0"
+version = "0.15.1"
 dependencies = [
  "anyhow",
  "ar",
@@ -441,6 +441,7 @@ dependencies = [
  "rusqlite",
  "semver",
  "serde",
+ "serde_ignored",
  "sha2",
  "suppaftp",
  "sys-mount",
@@ -1880,6 +1881,16 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "serde_ignored"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115dffd5f3853e06e746965a20dcbae6ee747ae30b543d91b0e089668bb07798"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.149"
@@ -2100,9 +2111,9 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.26.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
  "getrandom 0.4.1",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "depot"
-version = "0.15.0"
+version = "0.15.1"
 edition = "2024"
 
 [lints.rust]
@@ -21,7 +21,7 @@ serde = { version = "1.0.228", features = ["derive"] }
 yaml-rust2 = "0.11.0"
 sha2 = "0.10.9"
 tar = "0.4.44"
-tempfile = "=3.26.0"
+tempfile = "=3.27.0"
 thiserror = "2.0.18"
 toml = "1.0.6"
 url = "2.5.8"
@@ -42,6 +42,7 @@ clap_mangen = "0.2.31"
 sys-mount = { version = "3.1.0", default-features = false }
 time = { version = "0.3.47", features = ["formatting", "parsing"] }
 b2sum-rust = "0.3.0"
+serde_ignored = "0.1.14"
 
 [dev-dependencies]
-tempfile = "=3.26.0"
+tempfile = "=3.27.0"

meson.build

@@ -1,6 +1,6 @@
 project(
   'depot',
-  version: '0.15.0',
+  version: '0.15.1',
   meson_version: '>=0.60.0',
 )
 

src/package/spec.rs

@@ -62,8 +62,22 @@ impl PackageSpec {
             preprocess_spec_toml_appends(&content).with_context(|| {
                 format!("Failed to preprocess package spec: {}", abs_path.display())
             })?;
-        let mut spec: PackageSpec = toml::from_str(&base_content)
+        let mut unknown_key = None;
+        let deserializer = toml::Deserializer::parse(&base_content)
             .with_context(|| format!("Failed to parse package spec: {}", abs_path.display()))?;
+        let mut spec: PackageSpec = serde_ignored::deserialize(deserializer, |path| {
+            if unknown_key.is_none() {
+                unknown_key = Some(path.to_string());
+            }
+        })
+        .with_context(|| format!("Failed to parse package spec: {}", abs_path.display()))?;
+        if let Some(path) = unknown_key {
+            anyhow::bail!(
+                "Failed to parse package spec: {}: unknown key: {}",
+                abs_path.display(),
+                path
+            );
+        }
         spec.spec_dir = abs_path
             .parent()
             .map(PathBuf::from)
@@ -2421,6 +2435,43 @@ type = "autotools"
         assert!(spec.build.flags.skip_tests);
     }
 
+    #[test]
+    fn reject_unknown_nested_keys_from_spec() {
+        let tmp = tempfile::tempdir().unwrap();
+        let path = tmp.path().join("pkg.toml");
+
+        std::fs::write(
+            &path,
+            r#"
+[package]
+name = "foo"
+version = "1.0"
+description = "d"
+homepage = "h"
+license = "MIT"
+
+[source]
+url = "https://example.com/foo.tar.gz"
+sha256 = "skip"
+extract_dir = "foo"
+
+[build]
+type = "autotools"
+
+[dependencies]
+runtime = ["glibc"]
+skip_tests = true
+"#,
+        )
+        .unwrap();
+
+        let err = PackageSpec::from_file(&path).expect_err("expected unknown nested key to fail");
+        assert!(
+            err.to_string()
+                .contains("unknown key: dependencies.skip_tests")
+        );
+    }
+
     #[test]
     fn parse_configure_file_from_spec() {
         let tmp = tempfile::tempdir().unwrap();