-
Notifications
You must be signed in to change notification settings - Fork 2.9k
Warn when new duplicate dependencies are introduced #13899
Copy link
Copy link
Open
Labels
A-new-lintArea: new lintArea: new lintC-feature-requestCategory: proposal for a feature. Before PR, ping rust-lang/cargo if this is not `Feature accepted`Category: proposal for a feature. Before PR, ping rust-lang/cargo if this is not `Feature accepted`S-needs-designStatus: Needs someone to work further on the design for the feature or fix. NOT YET accepted.Status: Needs someone to work further on the design for the feature or fix. NOT YET accepted.
Metadata
Metadata
Assignees
Labels
A-new-lintArea: new lintArea: new lintC-feature-requestCategory: proposal for a feature. Before PR, ping rust-lang/cargo if this is not `Feature accepted`Category: proposal for a feature. Before PR, ping rust-lang/cargo if this is not `Feature accepted`S-needs-designStatus: Needs someone to work further on the design for the feature or fix. NOT YET accepted.Status: Needs someone to work further on the design for the feature or fix. NOT YET accepted.
Type
Fields
Give feedbackNo fields configured for issues without a type.
Problem
There are situations in Rust when dependencies used by multiple crates should have the same semver-compatible versions (when they export traits or types shared across crates).
The problem is that
cargo updateor other lock file-rebuilding commands can change a project with no (unwanted) duplicates into a project with duplicates.Duplicate dependencies are sometimes necessary or even desirable, but they can also happen by accident without users being aware of the problem.
Currently Cargo reports "Added dep-name 1.x", but that log message doesn't get any special treatment when the dependency is another version of a dependency that has remained on previous version.
Duplicate crates can cause compilation errors that rustc can't present nicely, because rustc doesn't know crate versions and doesn't know what caused them to be added to the project.
Proposed Solution
Cargo printing a warning along the lines of "Added duplicate dep-name 1.x, because other-dep requires ^1. Another dep-name version is 0.y, because different-dep requires 0.*" (or even print the whole "path" of dependency requirements up to the root)
This could help users spot the problem earlier, with more precise root cause information. Currently investigation requires running
cargo tree -dandcargo tree -i, which uses may not know about, and looking up this info manually is more laborious than having it presented automatically when dupes happen.Even when dupes don't cause compilation errors, they can slow down builds and bloat executables, so it is in users interest to avoid having duplicate dependencies when it's not necessary.