Cargo duplicating dependency when it seems like it shouldn't be

pkgw · January 20, 2023, 3:13pm

After doing a bit more digging, I see that this issue is explored in:

github.com/rust-lang/cargo

Cargo resolver picks two versions of a crate, even when one is enough

opened 07:39AM - 26 Apr 22 UTC

closed 05:14PM - 24 May 22 UTC

omid

C-bug

### Problem Diesel 2 (rc.0) depends on `uuid >=0.7.0, <2.0.0` and my app depe…nds on `uuid =0.8.2` because some other deps depend on that. Cargo resolver always pick two versions of `uuid`, `0.8.2` and `1.0.0`. (in my case) It's the same if I remove the `=`, also the same if I remove `uuid` dep from my app and only some other deps depend on `uuid 0.8.2`. Test scenario to cover this case: ``` #[cargo_test] fn uuid_test() { Package::new("uuid", "0.8.2").publish(); Package::new("uuid", "1.0.0").publish(); Package::new("diesel", "2.0.0") .dep("uuid", ">=0.7.0, <2.0.0") .publish(); let p = project() .file( "Cargo.toml", r#" [package] name = "foo" version = "1.0.0" [dependencies] diesel = "2.0" uuid = "0.8.2" "#, ) .file("src/lib.rs", "") .build(); p.cargo("tree -i uuid").with_stdout_contains("uuid v0.8.2").run(); } ``` ### Steps 1. Create a new project 2. Add the following deps: ``` diesel = {version = "2.0.0-rc.0", features = ["uuid"]} uuid = "=0.8.2" ``` 3. Run `cargo tree -i uuid` ### Possible Solution(s) _No response_ ### Notes _No response_ ### Version ```text cargo 1.60.0 (d1fd9fe 2022-03-01) release: 1.60.0 commit-hash: d1fd9fe2c40a1a56af9132b5c92ab963ac7ae422 commit-date: 2022-03-01 host: x86_64-unknown-linux-gnu ```

Major-open semver range does not properly unify with closed semver ranges

opened 12:07AM - 31 Dec 20 UTC

CAD97

C-bug A-dependency-resolution

**Problem** If a dependency's version is constrained to cover multiple semver…-incompatible releases, the version selected does not unify with more specific restrictions from elsewhere in the build graph. E.g. a requirement for `>=0.0.0, <0.9.0` and a requirement for `^0.4.0` results in both version `0.4.x` and `0.8.y` being pulled in (or `0.4.x` and `0.1.0` with `-Zminimal-versions`), rather than unifying both versions to just `0.4.x`. Manually adjusting the lockfile to use `0.4.x` in both cases works as expected; this is just an issue with the "find the best solution" codepath, not the "check the lockfile satisfies" codepath. Originally reported by @MaximilianKoestler on URLO: https://users.rust-lang.org/t/crate-interoperability-and-3rd-party-types-in-interfaces/53431 **Steps** Repro from @MaximilianKoestler : https://github.com/MaximilianKoestler/crate-version-testing Using the `rgb` crate as our target, this is exemplified using just the three packages: ```toml [package] name = "lib_a" [dependencies] rgb = ">=0.4.0, <0.5.0" ``` ```toml [package] name = "lib_b" [dependencies] rgb = ">=0.0.0, <0.9.0" ``` ```toml [package] name = "bin_c" [dependencies] lib_a = { path = "../lib_a" } lib_b = { path = "../lib_b" } ``` The generated lockfile: ```toml # irrelevant parts removed and reordered [[package]] name = "lib_a" dependencies = [ "rgb 0.4.0", ] [[package]] name = "lib_b" dependencies = [ "rgb 0.8.25", ] [[package]] name = "bin_c" dependencies = [ "lib_a", "lib_b", ] [[package]] name = "rgb" version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" [[package]] name = "rgb" version = "0.8.25" source = "registry+https://github.com/rust-lang/crates.io-index" ``` **Possible Solution(s)** Ideally, if all constraints overlap, only a single version should be selected. Otherwise, maintaining support for old semver-incompatible versions of public dependencies (when the subset you're using didn't change) is almost meaningless, as cargo won't unify the dependency off of the most recent semver-compatible range (or first with `-Zminimal-versions`). **Notes** Output of `cargo version`: `cargo 1.50.0-nightly (75d5d8cff 2020-12-22)` (also occurs on stable)

Topic		Replies	Views
Managing multiple versions of a dependency help	13	934	May 2, 2021
Cargo refuses to compile multiple SemVer-compatible versions of the same crate	4	690	March 30, 2021
Cargo: how to "import" dependency versions from another dependent crate? help	4	777	June 21, 2020
PSA: Please specify precise dependency versions in Cargo.toml announcements	51	10696	May 15, 2022
Add a crate with same version as a dependency is using? help	13	2171	January 12, 2023

Cargo duplicating dependency when it seems like it shouldn't be

Related Topics