4 ms·
shrug I guess we have different experiences. Any even small sized rust application I've come across rivals nodejs for amount of deps it pulls in. Sure, just ve
by cyberpunk 5mo ago
shrug I guess we have different experiences. Any even small sized rust application I've come across rivals nodejs for amount of deps it pulls in.
Sure, just vendor them in, simples, right?
- IshKebab 5mo agoYou could do (it is simple), but all the code is stored on crates.io so there's no real need. An exception is for crates that wrap C code which might get the code from elsewhere but those are quite rare.
- cyberpunk 5mo agoAnd they’re immutable, forever? No one can pull a leftpad?
- cdirkx 5mo agoYes, they are immutable. It's only possible to "yank" a specific version, which will prevent new dependencies, but it will still be available for download for existing dependencies. https://doc.rust-lang.org/cargo/commands/cargo-yank.html https://doc.rust-lang.org/cargo/commands/cargo-yank.html
- dwattttt 5mo agoTo elaborate on "prevent new dependencies", dependency resolution will never choose a yanked version. However the yanked version remains hosted.