cargo: path-based and [patch.crates-io] sibling-repo dependencies fail to resolve

Summary

Dependabot's cargo updater cannot update any dependency in a workspace whose Cargo.toml declares a dependency (or a [patch.crates-io] override) that points at a sibling repository via a filesystem path. Dependabot only clones the consumer repo, so the sibling path never resolves, and every job aborts during file fetching — including security advisories on unrelated crates (e.g. openssl).

This is the same class of failure as #9181 / #8428, but specifically for the cross-repo (non-submodule) case, which the submodule-recursion fix in #9278 does not cover. Existing open issues #11500 and #12766 cover other cargo path/workspace edge cases but not this one.

Reproducer

Consumer repo Cargo.toml:

[dependencies]
aegis-proto = { path = "../aegis-proto" }

dependabot.yml: standard cargo ecosystem, security updates enabled.

Expected: cargo dep updates succeed.
Actual:

Error during file fetching; aborting: The following path based dependencies could not be retrieved: ../aegis-proto/Cargo.toml

Real failing CI run: https://github.com/100monkeys-ai/aegis-orchestrator/actions/runs/25530550606

Second failure mode: [patch.crates-io]

Switching to a published version with [patch.crates-io] to the sibling does not work — Dependabot evaluates the patch and fails the same way:

[dependencies]
aegis-proto = "0.1"

[patch.crates-io]
aegis-proto = { path = "../aegis-proto" }

failed to load source for dependency `aegis-orchestrator-proto`
... Unable to update tmp/aegis-proto
... No such file or directory (os error 2)

Workarounds tried

What we'd want

Either:

1. Dependabot skips [patch] resolution when fetching/parsing manifests (the patch is irrelevant to dependency version resolution against crates.io), OR
2. A documented config option to exclude a [patch] block (or specific path deps) from Dependabot's manifest evaluation.

Environment

• Ecosystem: cargo
• Public repos
• Rust stable