News for hackers. Stuff that matters.
Re:Backdooring Rust crates for fun and profit by epage on Thursday November 18, 2021 @12:22PM (#29267935)
> 2. No multiple package versions. If there is a version conflict between transitive dependencies of a package because of semver, you should not be able to install that package.

I am grateful Rust allows this unlike C++ or Python. While I ideally minimize repeat dependencies, it is a big help to not be constrained to only on version. We've already had cases in Rust where some people were overly restrictive on dependency declarations (since Rust does block some versions as too similar) and it has caused a bit of pain.

There are no comments on this comment yet.