You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Report newly held back dependencies on all commands #13539
Split out of #9930 for RFC #3537 for a more focused conversation
We need to make sure users know when Cargo selects old dependencies so users can make a conscious choice on their risks. This affects both MSRV and semver
For performance, we can leverage the "is this changed" check that is part of write_pkg_lockfile.
This gets me thinking, should we report all dependency changes on all commands?
If you don't have a lockfile already, we likely don't want to report everything as that would be noisy
We could put this behind --verbose
We'd need to modify the language of the messages so they are understandable in other contexts, like changing "Adding foo v1.0.0" to "Adding dependency foo v1.0.0"
I wonder if we should also put "Remove" messages behind verbose
Activity
epage commentedon Mar 5, 2024
For performance, we can leverage the "is this changed" check that is part of
write_pkg_lockfile.This gets me thinking, should we report all dependency changes on all commands?
--verboseExample:
epage commentedon Mar 5, 2024
Started a zulip thread to raise visibility: https://rust-lang.zulipchat.com/#narrow/stream/246057-t-cargo/topic/How.20to.20report.20.22held.20back.22.20dependencies.20from.20MSRV.20resolver
Auto merge of #13561 - epage:msrv-report, r=weihanglo