Skip to content

Report newly held back dependencies on all commands #13539

Closed

Description

@epage

Split out of #9930 for RFC #3537 for a more focused conversation

We need to make sure users know when Cargo selects old dependencies so users can make a conscious choice on their risks. This affects both MSRV and semver

Activity

  1. epage commented on Mar 5, 2024

    @epage
    ContributorAuthor

    For performance, we can leverage the "is this changed" check that is part of write_pkg_lockfile.

    This gets me thinking, should we report all dependency changes on all commands?

    • If you don't have a lockfile already, we likely don't want to report everything as that would be noisy
      • We could put this behind --verbose
    • We'd need to modify the language of the messages so they are understandable in other contexts, like changing "Adding foo v1.0.0" to "Adding dependency foo v1.0.0"
    • I wonder if we should also put "Remove" messages behind verbose

    Example:

    1   1         Updating `dummy-registry` index
        2    +      Adding dependency baz v0.0.1
    2   3      Downloading crates ...
    3   4       Downloaded baz v0.0.1 (registry `dummy-registry`)
    4   5         Checking baz v0.0.1
    5   6         Checking foo v0.0.1 [..]
    6   7         Finished [..]
    
  2. added a commit that references this issue on Mar 20, 2024
    266a5ef
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions