3 ms·

Until `-Zminimal-versions` gets stabilized this problem will never go away. The ecosystem is too big to be able to get everyone to coordinate unless the tooling

Until `-Zminimal-versions` gets stabilized this problem will never go away. The ecosystem is too big to be able to get everyone to coordinate unless the tooling enforces it. I'm in the `serde = "1"` camp myself, even though I know that I "ought" to be doing `serde = "1.0.whatever-versions-docs-I'm-reading-right-now"`, but I don't because that's not right either. If I start a new project today, open the docs of serde and see that it's at v1.0.100, sure I could write `serde = "1.0.100"`. But then when I open the docs the next day to look up another function to use, and serde is at v1.0.101 now, does that mean I have to defensively bump it to 1.0.101 now? If that was the case then every code commit will involve bumping every dependency constantly. The only way this can work is if my local build / CI compiles with `-Zminimal-versions` and actually tells me a certain version is wrong. (Note that even for nightly users, `-Zminimal-versions` is unusable because it also applies to transitive dependencies too, so you're at the mercy of your dependencies specifying their dependencies correctly, which none of them do.)

pornel 5y ago
Crates don't add new APIs every day, but if you allow a revert to a 5-year-old version, there will definitely be an API difference. I know that without testing you don't know which version exactly is the right one, but it's safer to err on the latest side, than the oldest side. Serde specifically had an issue with exposing and renaming some APIs that were meant to be private and got used in other crates (let's not even get into how that relates to semver, and whose fault was that), so IIRC serde 1.0.123 is the lowest version you can safely allow these days.
epage 5y ago
I've traditionally done the same out of laziness. `cargo add` being merged into cargo (soon) will remove some of that laziness. This does make me interested in adjusting `-Z minimal-versions` to get it useful. The biggest problem is depending on all your dependencies to be good citizens and test it (some refuse) or patching your deps (I'm too lazy). There is an idea floating around to make it only apply to your direct dependencies.
gspr 5y ago
At least the Rust documentation system makes it very easy to just switch to reading the 1.0.100 docs also in the future.

pornel 5y ago

Crates don't add new APIs every day, but if you allow a revert to a 5-year-old version, there will definitely be an API difference. I know that without testing you don't know which version exactly is the right one, but it's safer to err on the latest side, than the oldest side. Serde specifically had an issue with exposing and renaming some APIs that were meant to be private and got used in other crates (let's not even get into how that relates to semver, and whose fault was that), so IIRC serde 1.0.123 is the lowest version you can safely allow these days.

epage 5y ago

I've traditionally done the same out of laziness. `cargo add` being merged into cargo (soon) will remove some of that laziness. This does make me interested in adjusting `-Z minimal-versions` to get it useful. The biggest problem is depending on all your dependencies to be good citizens and test it (some refuse) or patching your deps (I'm too lazy). There is an idea floating around to make it only apply to your direct dependencies.

gspr 5y ago

At least the Rust documentation system makes it very easy to just switch to reading the 1.0.100 docs also in the future.