> Now good luck to get that with most lock-file based package managers like npm, cargo or pip with ~1000 packages in your dependency tree that hardcode their de

> Now good luck to get that with most lock-file based package managers like npm, cargo or pip with ~1000 packages in your dependency tree that hardcode their dependency number... I don't know about spack or Guix, but nixpkgs has buildRustCrate, which builds each Rust crate dependency as a Nix derivation (it does not use Cargo). In this kind of setup it is possible to override specific crate versions across all packages that use a specific crate. Unfortunately, currently most Rust-based packages in nixpkgs use buildRustPackage, which does not follow this approach [1]. [1] https://github.com/NixOS/nixpkgs/issues/89563 https://github.com/NixOS/nixpkgs/issues/89563