3 ms·
> How to protect? > By pinning an exact version of a dependency, tokio = "=1.0.0" for example, but then you lose the bug fixes. Surely no one uses version ran
by zelos 5y ago
> How to protect?
> By pinning an exact version of a dependency, tokio = "=1.0.0" for example, but then you lose the bug fixes.
Surely no one uses version ranges in production? Is the default really not to use an exact version for crates?
- steveklabnik 5y agoThe default is to declare ranges, but then you get a lockfile after an initial build, and Cargo will use those exact versions until you ask for changes.
- Macha 5y agoThe default is to use ^x.y.z so it'll pull in patch versions.