What version should we default to within a workspace?

[epage]

Currently, we default to the highest version in the workspace. What if that isn't the direct dependency but is a transitive dependency?

Options

• Pick highest
• Prioritize the parent directories package
• Prioritize if its a direct dependency of any workspace member

[Rustin170506]

• Prioritize the parent directories package

What do you mean by this?
Does it depend on the directory where the command is executed?

[epage]

Just like cargo does discovery of a manifest for cargo check, select that manifest for cargo info and if the user-specified package is a direct dependency, use that version.

[Rustin170506]

I think we already did this, right?

For example:

ahash is a transitive dep of cargo-information.

If you run ahash under cargo-information dir:

ahash #hash #hasher #hashmap #aes #no-std
A non-cryptographic hash function using AES-NI for high performance
version: 0.8.8 (latest 0.8.9)
license: MIT OR Apache-2.0
rust-version: 1.72.0
documentation: https://docs.rs/ahash
repository: https://github.com/tkaitchuck/ahash
features:
  default          = [std, runtime-rng]
  std              = []
  runtime-rng      = [getrandom]
  getrandom        = [dep:getrandom]
  atomic-polyfill  = [dep:atomic-polyfill, once_cell/atomic-polyfill]
  compile-time-rng = [const-random]
  const-random     = [dep:const-random]
  nightly-arm-aes  = []
  no-rng           = []
  serde            = [dep:serde]
dependencies:
  atomic-polyfill@1.0.1
  cfg-if@1.0
  const-random@0.1.17
  getrandom@0.2.7
  serde@1.0.117
  zerocopy@0.7.31
  once_cell@1.18.0
build-dependencies:
  version_check@0.9.4
owners:
  tkaitchuck (Tom Kaitchuck)
note: to see how you depend on ahash, run `cargo tree --invert --package ahash@0.8.8`

[Rustin170506]

Or I misunderstood transitive dependency?

[epage]

Say my dependency graph looks like

member1

• ahash v1
• dep1
  • ahash v3
    member2
• ahash v2
• dep2
  • ahash v1
    member3
• dep2
  • ahash v1
• dep4
  • dep1
    • ahash v3

Which ahash should we select?

• v3 because we pick the highest
• v2 because it is the highest version among the most shallow
• v1 because I'm in member3 and that is the highest version among the most shallow set of ahash