Next step for deprecations in Cargo

2024 Deprecations

Problem

Cargo has been emitting a bunch deprecation message for a (long?) while. Since edition 2024 is approaching (1.82.0 anticipated), and a Cargo linting system is on the way (https://github.com/rust-lang/cargo/pull/13621), we might want to take advantage of this timing to evaluate whether this deprecations could be turned into a hard error.

The main risk here is CI automation might fail. Unlike rustc and clippy lints, people hardly noticed Cargo warnings becuase because there was no way to set -D on them.

Deprecations

2024 Edition

These are being tracked in rust-lang/rust#123754

dev_dependencies/build_dependencies/default_features/crate_types/proc_macro

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/mod.rs#L198-L199

• Warn since: 1.61 (2022-05-19) but only when conflicting with dash ones
• may become a hard error? NO
• Risk: Old crates fail to compile. Might need an edition boundary.
• https://github.com/rust-lang/cargo/pull/10316
• Next step:
  • Error on 2024 edition

good old [project] (replaced with [package])

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/mod.rs#L497-L498

• Warn since: 1.66 (2022-12-15)
• may become a hard error? ✅
• Risk: Old crates fail to compile. Require an edition boundary.
• https://github.com/rust-lang/cargo/pull/11135
• Next step:
  • Error on 2024 edition

default-features in inherited dependencies

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/mod.rs#L1801-L1803

• Warn since: 1.69.0 (2023-04-29)
• may become a hard error? ✅
• Risk: Build failures. Easy to fix.
• https://github.com/rust-lang/cargo/pull/11409
• Next step:
  • Error in 2024 Edition

Independent of Edition

Approved changes

• plugin support
  • see #13902
• dependency without path, version, git, workspace specified
  • see #13775
• license-file and readme pointing to a non-existent file
  • see #13921
• --release is ignored when paired with --profile
  • see #13971
• cargo read-manifest

Proposed changes

• [replace] is deprecated
• old cargo tree flags
• path override modifying dependency graph
• rustc-cdylib-link-arg used in non-cdylib target
• user-defined alias is shadowing an external subcommand found
• output artifact name collisions
• Bail out when trying to link to a library that is not linkable
• Ambiguous package name in git dependency

plugin support

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/targets.rs#L211-L216

• Warn since: 1.77.0 (2024-03-21)
• may become a hard error? ✅ (stop supporting plugin)
• Risk: Too new.
• https://github.com/rust-lang/cargo/pull/13248
• https://github.com/rust-lang/cargo/pull/13902
• Next step:
  • Remove key, making it an "unused key" warning

dependency without path, version, git, workspace specified

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/toml/mod.rs#L1914-L1918

• Warn since: Merged on 2016-01-20
• May become a hard error? ✅
  • Was this a bug?
    • Yes
    • https://github.com/rust-lang/cargo/issues2147#issuecomment-156879677
• Risk: Old crates and deps fail to build. See https://github.com/rust-lang/cargo/issues/9885
• https://github.com/rust-lang/cargo/pull/2270
• Next step:
  • Hard error, see #13775

Note:

• this affects [dependencies] as well as [patch], [replace], including in virtual workspaces and config where Editions don't apply
• hard error makes the format more future proof for adding additional sources (otherwise old cargos would do wildly bad things)

license-file and readme pointing to a non-existent file

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/ops/cargo_package.rs#L416-L418

• Warn since: 1.43.0 (2020-04-23) for license-file; 1.71.0 (2023-08-03) for readme
• may become a hard error? ✅ )
• Risk: Publish might fail. Easy to fix in normal cases.
• https://github.com/rust-lang/cargo/pull/7905
• https://github.com/rust-lang/cargo/pull/12036
• Next step:
  • Hard error, even for empty string

--release is ignored when paired with --profile

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/command_prelude.rs#L570-L573

• Warn since: 1.57.0 (2021-12-02)
• may become a hard error? ✅
• Risk: Break people's build. Easy to fix by themselves.
• https://github.com/rust-lang/cargo/pull/9943
• Next step:
  • Hard error

cargo read-manifest

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/bin/cargo/commands/read_manifest.rs#L9

• Warn since: Merged on 2016-10-03.
• Become a hard error? NO
• Risk: Automations might still rely on it. cargo metadata --no-deps should cover its use cases.
• https://github.com/rust-lang/cargo/pull/3150
• Next step:
  • Needs further investigation (unclear why this was deprecated and if it still fills a unique niche)

[replace] is deprecated

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/doc/src/reference/overriding-dependencies.md?plain=1#L300-L301

• Warn since: 1.42.0 (2020-03-12)
• may become a hard error? NO
• Risk: Can we patch [patch] to fully replace [repalce]?
• https://github.com/rust-lang/cargo/pull/7733
• Next step (proposed)
  • Deprecation warning using lint system (since restricted Carog.toml)
  • Maybe with future edition turn it into forbid (based on people's reaction to warning)

old cargo tree flags: --all, no-dev-dependencies, --no-indent, --prefix-depth, --all-targets

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/bin/cargo/commands/tree.rs#L144-L146

• Warn since: 1.44.0 (2020-06-04)
• may become a hard error? ✅ for all; NO for others
• Risk: Have alternatives. Easy to fix.
• https://github.com/rust-lang/cargo/pull/8115
• Next step (proposed):
  • Downgrade to consistent deprecation (no point removing one when others would be kept)

path override modifying dependency graph

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/registry.rs#L535-L538

• Warn since: Merged on 2016-10-05 (1.14 or so)
• may become a hard error? ✅ (was a bug)
• Risk: Assuming people seldom use it?
• https://github.com/rust-lang/cargo/pull/3136
• Next step (proposed):
  • Turn into error because it was a bug with buggy behavior and people using this went into it knowing its bad (since they likely started post-1.14), and we've not been getting necro-posts for people saying they need this (like depending on bins)

rustc-cdylib-link-arg used in non-cdylib target

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/compiler/custom_build.rs#L850-L856

• Warn since: 1.54.0 (2021-07-29)
• may become a hard error? ✅ (may become)
• Risk: crates might depends on this heavily; might need a way to toggle like https://github.com/rust-lang/cargo/issues/9094 or Pre-RFC for mutually-exclusive, global features
• https://github.com/rust-lang/cargo/pull/9563
• Next step (proposed):
  • Hard error, independent of edition, because this was never intended, we warning for a while, and no has brought up a concrete case of the warning firing when they need it

user-defined alias is shadowing an external subcommand found

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/bin/cargo/cli.rs#L321-L323

• Warn since: 1.58.0 (2022-01-13)
• may become a hard error? ✅
• Risk: Custom workflow might fail. cargo clippy and cargo fmt are what we concerned.
• #10049
• https://github.com/rust-lang/cargo/pull/10082
• Next step (proposed):
  • Turn into hard error. Aliases are generally for user interaction, rather than automation (except for things like xtasks) so the impact is low

output artifact name collisions

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/compiler/build_runner/mod.rs#L472-L474

• Warn since: 1.32.0 (2019-01-17)
• may become a hard error? ✅
• Risk: Workaround could be quite complicated.
• https://github.com/rust-lang/cargo/pull/6308
• Next step (proposed):
  • Maybe in a future Edition, switch to forbid by default?
  • Or just warn because this is implementation-defined for when a collision may occur and new collisions may come up in the future

Bail out when trying to link to a library that is not linkable

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/compiler/mod.rs#L1427-L1430

• Warn since: 1.24.0 (2018-02-15)
• may become a hard error? ✅
• Risk: People depend on this in a quirky way.
• https://github.com/rust-lang/cargo/pull/4797
• Next step (proposed):
  • Needs investigation into replacement feature for those relying on it
  • Likely should instead be hard error conditioned on Edition

Ambiguous package name in git dependency

https://github.com/rust-lang/cargo/blob/bd1cf584af2c356eeb3980c3c9bb0fea190ed633/src/cargo/ops/cargo_read_manifest.rs#L225-L234

• Warn since: 1.63
• may become a hard error? NO
• Risk: too many false positives, see #10752
• #10701, #10767
• Next step (proposed):
  • Address #10752
  • Turn into error on edition

No further steps

deprecate --all (alias to --workspace)

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/command_prelude.rs#L54

• Warn since: 1.39.0 (2019-11-07)
• may become a hard error? NO
• Risk: Automations might still rely on it. Some users use it exclusively due to brevity (see also #11554)
• https://github.com/rust-lang/cargo/pull/7241
• Next step (proposed):
  • CLI, so no further steps
  • Not doing runtime warning because of pervasive use by people who really like it for brevity

Deprecate .cargo/config

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/context/mod.rs#L1563-L1567

• Warn since: 1.78 (2024-05-02)
• may become a hard error? NO
• Risk: Way too new.
• https://github.com/rust-lang/cargo/pull/13349
• Next step (proposed):
  • No further steps

Review the listed Cargo entry points, including src/cargo/util/toml/mod.rs, src/bin/cargo/commands/read_manifest.rs, and the referenced Cargo linting pull request. First determine which deprecations still need decisions or implementation; done means a scoped, agreed next step for one or more entries, with relevant tests identified.