feat: Rust Cargo support (#241)

* feat: Rust Cargo support

* fix: add missing Kotlin-based DSL script name build.gradle.kts for Gradle

* docs: centralize manifest file references in Configuration section

* feat: implement version update quick fix for all Cargo.toml dependency formats

Author: soul2zimate

README.md

@@ -20,6 +20,7 @@ while you build your application.
 - Yarn Berry and Classic (yarn)
 - Gradle Kotlin and Groovy (gradle)
 - Golang (go mod)
+- Rust (cargo)
 - Python (pip) ecosystems, and base images in Dockerfile.
 
 In future releases, Red Hat plans to support other package managers.
@@ -45,14 +46,8 @@ vulnerability report.
 
 **Prerequisites**
 
-- For Maven projects, analyzing a `pom.xml` file, you must have the `mvn` binary in your IDE's `PATH` environment.
-- For Node projects, analyzing a `package.json` file, you must have one of the corresponding package manager `npm`, `pnpm` or `yarn`, `node` binaries in your IDE's `PATH`
-  environment.
-- For Golang projects, analyzing a `go.mod` file, you must have the `go` binary in your IDE's `PATH` environment.
-- For Python projects, analyzing a `requirements.txt` file, you must have the `python3` and `pip3` binaries in your
-  IDE's `PATH` environment.
-- For Gradle projects, analyzing a `build.gradle` file or `build.gradle.kts` file, you must have the `gradle` binary in your system's `PATH` environment.
-- For base images, analyzing a `Dockerfile`, you must have the [`syft`](https://github.com/anchore/syft?tab=readme-ov-file#installation) and [`skopeo`](https://github.com/containers/skopeo/blob/main/install.md) binaries in your IDE's `PATH` environment.
+- You must have the package manager binary for your ecosystem available in your IDE's `PATH` environment.
+  See the [Configuration](#configuration) section for the full list of supported package managers, their manifest files, and binary path settings.
 
 **Procedure**
 
@@ -82,7 +77,7 @@ according to your preferences.
 
 **Configurable parameters**
 
-- **Maven** :
+- **Maven** (`pom.xml`) :
   <br >Set the full path of the Maven executable, which allows Exhort to locate and run the `mvn` command to resolve
   dependencies for Maven projects.
   <br >Path of the `JAVA_HOME` directory is required by the `mvn` executable.
@@ -95,20 +90,25 @@ according to your preferences.
   <br >`false`: Never use the wrapper regardless of `Build,Execution,Deployment › Build Tools > Maven: Maven home path` setting
   <br >`fallback`: Use IntelliJ's `Build,Execution,Deployment › Build Tools > Maven: Maven home path` setting (default behavior)
 
-- **Node** :
+- **Node** (`package.json`) :
   <br >Set the full path of the Node executable, which allows Exhort to locate and run one of the corresponding `npm`, `pnpm` or `yarn` command to resolve
   dependencies for Node projects.
   <br >Path of the directory containing the `node` executable is required by one of the corresponding `npm`, `pnpm` or `yarn` executable.
   <br >If the paths are not provided, your IDE's `PATH` environment will be used to locate the executables.
 
-- **Golang** :
+- **Golang** (`go.mod`) :
   <br >Set the full path of the Go executable, which allows Exhort to locate and run the `go` command to resolve
   dependencies for Go projects.
   <br >If the path is not provided, your IDE's `PATH` environment will be used to locate the executable.
   <br >When option `Strictly match package version` is selected, the resolved dependency versions will be compared to
   the versions specified in the manifest file, and users will be alerted if any mismatch is detected.
 
-- **Python** :
+- **Rust** (`Cargo.toml`) :
+  <br >Set the full path of the Cargo executable, which allows Exhort to locate and run the `cargo` command to resolve
+  dependencies for Rust projects.
+  <br >If the path is not provided, your IDE's `PATH` environment will be used to locate the executable.
+
+- **Python** (`requirements.txt`) :
   <br >Set the full paths of the Python and the package installer for Python executables, which allows Exhort to locate
   and run the `pip3` commands to resolve dependencies for Python projects.
   <br >Python 2 executables `python` and `pip` can be used instead, if the `Use python 2.x` option is selected.
@@ -120,13 +120,13 @@ according to your preferences.
   specified in the manifest file will be ignored, and dependency versions will be resolved dynamically instead (this
   feature cannot be enabled when `Strictly match package version` is selected).
 
-- **Gradle** :
+- **Gradle** (`build.gradle`, `build.gradle.kts`) :
   <br >Set the full path of the Gradle executable, which allows Exhort to locate and run the `gradle` command to resolve
   dependencies for Gradle projects.
   <br >By not setting a path to the gradle binary, IntelliJ IDEA uses its default path environment to locate the file.
 
 
-- **Image** :
+- **Image** (`Dockerfile`) :
   <br >Set the full path of the Syft executable, which allows Exhort to locate and run the `syft` command to
   generate Software Bill of Materials for the base images.
   <br >Optionally, set the full path of the Docker or Podman executable. Syft will attempt to find the images in the
@@ -167,7 +167,7 @@ according to your preferences.
 ## Features
 
 - **Component analysis**
-  <br >Upon opening a manifest file, such as a `pom.xml`, `package.json`, `go.mod` or `requirements.txt` file, a scan
+  <br >Upon opening a supported manifest file (see [Configuration](#configuration) for the full list), a scan
   starts the analysis process.
   The scan provides immediate inline feedback on detected security vulnerabilities for your application's dependencies.
   Such dependencies are appropriately underlined in red, and hovering over it gives you a short summary of the security
@@ -301,14 +301,23 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
   ```text
   requests==2.28.1 # trustify-da-ignore
   ```
-  If you want to ignore vulnerabilities for a dependency in a `build.gradle` file, you must add `trustify-da-ignore` as a
+  If you want to ignore vulnerabilities for a dependency in a `build.gradle` or `build.gradle.kts` file, you must add `trustify-da-ignore` as a
   comment against the dependency in the manifest file.
   For example:
   ```text
   implementation "log4j:log4j:1.2.17" // trustify-da-ignore
   implementation group: 'log4j', name: 'log4j', version: '1.2.17' // trustify-da-ignore
   ```
 
+  If you want to ignore vulnerabilities for a dependency in a `Cargo.toml` file, you must add `trustify-da-ignore` as a comment
+  against the dependency in the manifest file.
+  For example:
+  ```toml
+  [dependencies]
+  serde = "1.0" # trustify-da-ignore
+  tokio = { version = "1.0", features = ["full"] } # trustify-da-ignore
+  ```
+
 - **Excluding developmental or test dependencies**
   <br >Red Hat Dependency Analytics does not analyze dependencies marked as `dev` or `test`, these dependencies are
   ignored.
@@ -373,6 +382,49 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
   Report** tab remains open.
   Closing the tab removes the temporary HTML file.
 
+## Rust/Cargo Component Analysis Limitations
+
+The plugin provides vulnerability analysis for Rust projects using `Cargo.toml` manifest files. While stack analysis (full dependency report) works completely for all Cargo dependency formats, the component analysis feature (inline vulnerability detection) has some current limitations in version resolution and automatic fixes.
+
+### Component Analysis Version Resolution
+
+During inline component analysis, some dependency types cannot have their versions resolved directly from the manifest file and are marked as `UNRESOLVED_VERSION`. These dependencies will still appear in the full stack analysis report with correct version information.
+
+Dependencies that result in unresolved versions in component analysis:
+- **Workspace dependencies**: `workspace = true` (version inherited from workspace root)
+- **Git dependencies**: `git = "https://github.com/user/repo"` (version resolved at build time)
+- **Path dependencies**: `path = "../local"` (version from local Cargo.toml)
+- **Registry dependencies without explicit version**: Dependencies that rely on registry resolution
+
+Example:
+```toml
+[dependencies]
+# These will show UNRESOLVED_VERSION in inline component analysis
+workspace-dep = { workspace = true }
+git-dep = { git = "https://github.com/user/repo" }
+local-dep = { path = "../local" }
+registry-dep = { registry = "my-registry" }
+```
+
+### Component Analysis Quick-Fix Support
+
+The automatic version update feature (quick-fix suggestions) has varying support across different dependency declaration formats:
+
+**Supported formats:**
+- Simple string versions: `serde = "1.0"`
+
+**Unsupported formats:**
+- Complex inline tables: `tokio = { version = "1.0", features = ["full"] }`
+- Complex inline tables without version field: `tokio = { features = ["full"] }`
+- Standard table format:
+  ```toml
+  [dependencies.cratename]
+  version = "1.0"
+  features = ["derive"]
+  ```
+
+For unsupported formats, vulnerability detection still works and the full stack analysis report will contain complete information and recommendations. Manual updates to the manifest file are required for these cases.
+
 ## Know more about the Red Hat Dependency Analytics platform
 
 The goal of this project is to significantly enhance a developer's experience by providing helpful vulnerability

gradle.properties

@@ -9,7 +9,7 @@ ideaVersion=2025.1
 gradleVersion=8.5
 
 # Plugin Dependencies -> https://plugins.jetbrains.com/docs/intellij/plugin-dependencies.html
-platformBundledPlugins=org.jetbrains.plugins.yaml,com.intellij.java,org.jetbrains.idea.maven
+platformBundledPlugins=org.jetbrains.plugins.yaml,com.intellij.java,org.jetbrains.idea.maven,org.toml.lang
 platformPlugins=com.redhat.devtools.intellij.telemetry:1.1.0.52
 
 # Opt-out flag for bundling Kotlin standard library -> https://jb.gg/intellij-platform-kotlin-stdlib

src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java

@@ -270,20 +270,15 @@ private InspectionProfileEntry getInspection(@NotNull PsiElement context, @NotNu
     }
 
     public static String getPackageManager(String file) {
-        switch (file) {
-            case "pom.xml":
-                return "maven";
-            case "package.json":
-                return "npm";
-            case "go.mod":
-                return "go";
-            case "requirements.txt":
-                return "python";
-            case "build.gradle":
-                return "gradle";
-            default:
-                return null;
-        }
+        return switch (file) {
+            case "pom.xml" -> "maven";
+            case "package.json" -> "npm";
+            case "go.mod" -> "go";
+            case "requirements.txt" -> "python";
+            case "build.gradle", "build.gradle.kts" -> "gradle";
+            case "Cargo.toml" -> "cargo";
+            default -> null;
+        };
     }
 
     public static class Info {

src/main/java/org/jboss/tools/intellij/componentanalysis/ExcludeManifestIntentionAction.java

@@ -42,13 +42,15 @@ public boolean isAvailable(@NotNull Project project, Editor editor, PsiFile file
         if (file == null || file.getVirtualFile() == null) {
             return false;
         }
-        
+
         String fileName = file.getName();
-        return "pom.xml".equals(fileName) || 
-               "package.json".equals(fileName) || 
-               "go.mod".equals(fileName) || 
-               "requirements.txt".equals(fileName) || 
-               "build.gradle".equals(fileName);
+        return "pom.xml".equals(fileName) ||
+                "package.json".equals(fileName) ||
+                "go.mod".equals(fileName) ||
+                "requirements.txt".equals(fileName) ||
+                "build.gradle".equals(fileName) ||
+                "build.gradle.kts".equals(fileName) ||
+                "Cargo.toml".equals(fileName);
     }
 
     @Override

src/main/java/org/jboss/tools/intellij/componentanalysis/SAIntentionAction.java

@@ -46,7 +46,10 @@ public boolean isAvailable(@NotNull Project project, Editor editor, PsiFile file
         return "pom.xml".equals(file.getName())
                 || "package.json".equals(file.getName())
                 || "go.mod".equals(file.getName())
-                || "requirements.txt".equals(file.getName());
+                || "requirements.txt".equals(file.getName())
+                || "build.gradle".equals(file.getName())
+                || "build.gradle.kts".equals(file.getName())
+                || "Cargo.toml".equals(file.getName());
     }
 
     @Override