rust-lang / rust-lang/cargo

Cargo update ignores --precise in some cases when using `[patch]`

Open
#9,470 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-patch C-bug Command-update S-triage
Dominant language
Rust
Stars
15.5k
Forks
3k
Avg merge
23h 30m
Merged PRs (30d)
51

Description

Problem
When [patch]ing a crate foo of version x.y.z (where x.y.z is not the most up-to-date version), running cargo update -p foo --precise x.y.z twice causes foo to be updated to the latest version (rather than x.y.z).

Steps

  1. Clone libc to /tmp and downgrade to an old version (let's take 0.2.93) using: git checkout tags/0.2.93
  2. cargo new foo
  3. Modify foo/Cargo.toml:
[package]
name = "foo"
version = "0.1.0"
edition = "2018"

[dependencies]
libc = "0.2"

[patch.crates-io]
libc = { path = "/tmp/libc" } # Path to our 0.2.93 version of libc
  1. Run:
$ cargo update -p libc --precise 0.2.93
    Updating crates.io index
warning: Patch `libc v0.2.93 (/tmp/libc)` was not used in the crate graph.
Check that the patched package version and available features are compatible
with the dependency requirements. If the patch has a different version from
what is locked in the Cargo.lock file, run `cargo update` to use the new
version. This may also occur with an optional dependency that is not enabled.
      Adding libc v0.2.93 (/tmp/libc)
    Removing libc v0.2.94
  1. Run again:
$ cargo update -p libc --precise 0.2.93
    Updating crates.io index
warning: Patch `libc v0.2.93 (/tmp/libc)` was not used in the crate graph.
Check that the patched package version and available features are compatible
with the dependency requirements. If the patch has a different version from
what is locked in the Cargo.lock file, run `cargo update` to use the new
version. This may also occur with an optional dependency that is not enabled.
    Removing libc v0.2.93 (/tmp/libc)
      Adding libc v0.2.94

Note that the last two lines of output are different in steps 4 and 5.

Notes

Output of cargo version:

cargo 1.53.0-nightly (65d57e6f3 2021-04-04)

It appears that without [patch] everything behaves as expected - running the same update more than once has no effect.

This may seem like an odd set of circumstances. I would be happy to explain why we run into this situation if it helps.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the /tmp/libc checkout, the [patch.crates-io] entry in foo/Cargo.toml, and two successive cargo update -p libc --precise 0.2.93 commands. Trace Cargo's update and dependency-resolution path for patched crates, then verify that the second command keeps libc at 0.2.93 instead of restoring the latest version.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.