Commit the Cargo.lock file to build with known working versions of dependencies #1720
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…pendencies This offloads _some_ care to consumers, as by default they might now pull in transitive dependencies that break UniFFI's MSRV. What they will need to do is `cargo update -p $dep --precise $ver` where `$ver` is a version that is MSRV-compatible (and is probably the one uniffi's Cargo.lock file contains)
|
For more background and analysis on this change in advice, see rust-lang/cargo#12382 and the issue it closed. |
mhammond
approved these changes
Aug 25, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This offloads some care to consumers, as by default they might now pull in transitive dependencies that break UniFFI's MSRV. What they will need to do is
cargo update -p $dep --precise $verwhere$veris a version that is MSRV-compatible (and is probably the one uniffi's Cargo.lock file contains)Alternative to the pinning in #1719
Briefly discussed with Mark in chat.
cargo is changing recommendations around that: https://doc.rust-lang.org/nightly/cargo/faq.html#why-have-cargolock-in-version-control
I certainly had confusion in the past due to different versions use locally than in CI until I realized a mismatch in dependencies.
I'm fairly confident this is fine getting pulled into m-c. The lock file will be ignored and only m-c's lockfile counts. m-c will need to ensure transitive dependencies are within MSRV.
Yes, that offloads that responsibility to other places.
But other consumers with higher MSRVs can use those updated transitive dependencies.