cargo should provide strict dependency analysis

[jackmygreat]

By default, cargo resolves the dependency without the operator to “^version”，for example：

[dependencies]
time = "0.1.12"

Since "0.0.12"" does not have any operators in it, it is interpreted the same way as if we had specified "^0.1.12".

For dependencies and sub-dependent versions without operators，cargo should provide a strict mode that provides a deterministic target package. This is extremely necessary for project and teamwork。

[lukaslueg]

Did I miss something? =0.1.12 does that.

[ehuss]

There is an unstable feature called minimal-versions which will try to resolve all versions to the lowest possible version. Would that cover your needs?

[jackmygreat]

Did I miss something? =0.1.12 does that.

yes，
If the dependency has child dependencies, the child dependency is also parsed like this

[dwijnand]

Can this issue be closed then?

[jackmygreat]

There is an unstable feature called minimal-versions which will try to resolve all versions to the lowest possible version. Would that cover your needs?

hi，I used minimal-versions feature to make a demo。

[dependencies]
curl = "=0.4.11"

curl has a sub dependent,libc package ,Its format is as follows:

[dependencies.libc]
version = "0.2"

I excuted commend cargo update -Z minimal-versions,in cargo.lock, the version of libc is 0.2.14.
I want to know the parsing rules of x.y version.

[jackmygreat]

Can this issue be closed then?

ok

[ehuss]

I excuted commend cargo update -Z minimal-versions,in cargo.lock, the version of libc is 0.2.14.

That is because socket2 0.2, another dependency of libcurl, has a minimum libc requirement of 0.2.14. As you may notice, curl doesn't compile with minimal-versions. We've noticed that using that feature is difficult because many projects do not accurately publish their Cargo.toml with the true minimal versions they support.

You can use cargo tree in this example to see what other crates have libc as a dependency, and then look at what their requirements are.

If you want to learn more about how version parsing and version requirements works, see the semver and semver-parser crates which are used by Cargo.

[jackmygreat]

@ehuss
thanks very much.
I think minimal-versions feature is very important for team work。It is very important for teamwork. This is why more and more teams use yarn to manage node dependencies instead of npm. Certainty is very important.