Erroneous version change when updating overriden package version
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Reproduce the issue using the patch-buggy-version-change branch, then work from artifact/Cargo.toml and the generated artifact/Cargo.lock. Run cargo +nightly update -p serde_json and inspect the lockfile diff. Done means updating serde_json does not change the serde version selected for ipnetwork.
Written by the indexing model from the issue text.
Description
In a crate graph with:
- two different versions of the same crate A1 & A2
- a dependency B with a version specification that allows both versions A1 and A2, currently locked at A2
- a dependency C that has a dependency on A2
If I add a patch override for dependency C which changes the version of C and use cargo update -p C, the version that B depends on gets changed to A1.
You can see it in action in https://github.com/jethrogb/cargo/tree/patch-buggy-version-change
# Clone test repository
git clone --single-branch https://github.com/jethrogb/cargo -b patch-buggy-version-change
cd cargo/artifact
# Introduce [patch.crates-io.serde_json]
sed -i '15s/#//' Cargo.toml
# Update serde_json
cargo +nightly update -p serde_json
# Observe serde version change in ipnetwork
git diff Cargo.lock
You can see this changes the version of serde that ipnetwork depends on:
diff --git a/artifact/Cargo.lock b/artifact/Cargo.lock
index 6be3a00..b2c5754 100644
--- a/artifact/Cargo.lock
+++ b/artifact/Cargo.lock
@@ -15,22 +15,10 @@ version = "0.16.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b8eca9f51da27bc908ef3dd85c21e1bbba794edaf94d7841e37356275b82d31e"
dependencies = [
- "serde 1.0.114",
+ "serde 0.8.23",
]
I'm using cargo update -p to update only a specific package version. This should leave the dependency of ipnetwork unchanged.
- Dominant language
- Rust
- Stars
- 15.5k
- Forks
- 3k
- Avg merge
- 23h 30m
- Merged PRs (30d)
- 51
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rust-lang/cargo
-
C-bug S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
A-completions C-bug S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
C-bug S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Command-fix
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
cargo remove prints "Removing X" for dependencies that never get removed when the command fails OpenC-bug Command-remove S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100