PSA: Please specify precise dependency versions in Cargo.toml

[CAD97]

@chris-morgan

(I write all this as one who recently published a crate release depending on hashbrown >= 0.1.1, <0.13 , testing at both ends of the range, and feeling good about the whole thing.)

First off: you'd need to test at least every semver incompatible version in the range to be sure the constraint is accurate. It's not good enough to test 0.1.1 and 0.12 if 0.8 doesn't work.

But on the other side of the coin: you'll actually only ever get 0.1.1 or 0.12.latest, due to how cargo's resolver works.

@CAD97

Major-open semver range does not properly unify with closed semver ranges · Issue #9029 · rust-lang/cargo · GitHub

@Eh2406

Cargos resolver (with in the one-per-major constraints) attempts to optimize for "getting everyone the most recent they can use" and does not optimize for "have the fewest versions".

I can not think of how to make the current resolver flexible over this optimization target. If pubgrub gets incorporated into Cargo things may be more flexible.

This is the correct behavior for private dependencies; public dependencies are special in that you do want to solve for everyone using the same version.

So while dependency constraints across multiple major versions are valid (e.g. tiny_http = ">=0.6.0, <0.11.0"), you'll always get the most recent major version (e.g. 0.10) with either of the current resolvers.

Minimal versions will get you the bottom of your range, but there's no way to get something in the middle of the range without crafting an artisanal lockfile.