3 ms·
I see no reason why library authors should be expected to document this when the actual source of truth — the Cargo.toml file — is sitting right there and will
by pohl 5y ago
I see no reason why library authors should be expected to document this when the actual source of truth — the Cargo.toml file — is sitting right there and will never be wrong. If you want to see the transitive dependencies, all you need is to run "cargo tree".
Both crates.io and lib.rs surface this automatically right there on the crate's page.
The rust "culture" on transitive dependencies is actually laudably transparent: it's built right into the tools.
- pjmlp 5y agoSame can be told about npm, and I hardly see anyone jump of joy regarding it.
- jrockway 5y agoI mean, the number of dependencies a node project uses doesn't really affect me. If they have 1 or if they have 1 million, it's the same "npm install" command. I personally like to keep third-party dependencies as minimal as possible, mostly to avoid getting 8 emails a day from dependabot telling me that a dependency of a dependency of a dependency has a regex denial of service attack and some dependency in the middle has a massive breaking change that prevents another dependency from being upgraded to include the fix. (Nevermind that I'm using it on the frontend, so if a user picks a bad regex they will slow down their own browser and nobody else's.)
- gspr 5y ago> If they have 1 or if they have 1 million, it's the same "npm install" command. Only if you accept one single, unflexible way of installing the software.