rust-lang / rust-lang/cargo

Unused path dependency patches don't emit warning or show up in lock file on update

Open
#12,464 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-diagnostics A-lockfile A-patch C-bug E-medium S-needs-design
Dominant language
Rust
Stars
15.5k
Forks
3k
Avg merge
23h 30m
Merged PRs (30d)
51

Description

Problem

While investigating #12419, a solution is to use the unused_patches field of the Resolve returned from resolve_ws. It turns out this field wasn't being populated for path dependency patches. As a result, an unused patch doesn't emit a warning or show up in the lock file as an unused patch during cargo update

Steps
# Cargo.toml

[workspace]
members = ["serde", "serde_derive"]

[patch.crates-io]
serde = { path = "serde" }
# serde/Cargo.toml

[package]
name = "serde"
version = "1.0.0"

[dependencies]
serde_derive = { path = "../serde_derive" }
# serde_derive/Cargo.toml

[package]
name = "serde_derive"
version = "1.0.0"

Same test case in #12419, but running cargo update instead.

Current:
No warning and lock file below:

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3

[[package]]
name = "serde"
version = "1.0.0"
dependencies = [
 "serde_derive",
]

[[package]]
name = "serde_derive"
version = "1.0.0"

Expectation:
The expectation is if a patch is unused, a warning would be emitted and would show up as a patch.unused section in the lock file

The following warning is emitted:

warning: Patch `serde v1.0.0 (/Users/alcolmenar/dev/3rd/test-patch/serde)` was not used in the crate graph.
Perhaps you misspelled the source URL being patched.
Possible URLs for `[patch.<URL>]`:
    /Users/alcolmenar/dev/3rd/test-patch/serde

Cargo file:

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3

[[package]]
name = "serde"
version = "1.0.0"
dependencies = [
 "serde_derive",
]

[[package]]
name = "serde_derive"
version = "1.0.0"

[[patch.unused]]
name = "serde"
version = "1.0.0"
Possible Solution(s)

Haven't really looked into how to do it but I think the errant code is here:
https://github.com/rust-lang/cargo/blob/211fd7eac105f0960433a935ce17b8d787233692/src/cargo/core/resolver/resolve.rs#L142-L148

Notes

No response

Version
cargo 1.73.0-nightly (45782b6b8 2023-07-05)
release: 1.73.0-nightly
commit-hash: 45782b6b8afd1da042d45c2daeec9c0744f72cc7
commit-date: 2023-07-05
host: aarch64-apple-darwin
libgit2: 1.6.4 (sys:0.17.2 vendored)
libcurl: 7.79.1 (sys:0.4.63+curl-8.1.2 system ssl:(SecureTransport) LibreSSL/3.3.6)
ssl: OpenSSL 1.1.1u  30 May 2023
os: Mac OS 12.5.1 [64-bit]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the provided workspace manifests and cargo update. Then inspect src/cargo/core/resolver/resolve.rs around lines 142-148, focusing on how path dependency patches populate unused_patches. Done means the unused patch emits the warning and appears as [[patch.unused]] in Cargo.lock.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.