Re:The Rust community's crate host
by steveklabnik on Thursday November 20, 2014 @03:46PM
(#8638030)
Small nits about the way this works:
> By specifying the exact version you require,
This is only half true. It comes in two steps: you specify a _kind_ of version that you require, like
foo = "^1.2.0"
and then, during the build step, it resolves all of the dependencies and their dependencies (etc) and writes the exact version out to a file. So you do end up with specific ones, but you won't neccesarily end up with multiple versions.
This also matters because...
> maintainers may neglect the tedious task of keeping their projects' dependencies up-to-date,
You just run 'cargo update' and it will re-calculate that dependency graph, and re-write out the lock file. You're as up to date as you can be. Of course, if that fix is only available in a range outside you've specified, that's different.
> By specifying the exact version you require,
This is only half true. It comes in two steps: you specify a _kind_ of version that you require, like
and then, during the build step, it resolves all of the dependencies and their dependencies (etc) and writes the exact version out to a file. So you do end up with specific ones, but you won't neccesarily end up with multiple versions.This also matters because...
> maintainers may neglect the tedious task of keeping their projects' dependencies up-to-date,
You just run 'cargo update' and it will re-calculate that dependency graph, and re-write out the lock file. You're as up to date as you can be. Of course, if that fix is only available in a range outside you've specified, that's different.