Suggest that users use cargo add command to add Bevy

[alice-i-cecile]

Merged PR for the feature.

This spares users from having to reason about the Cargo.toml directly, and makes sure they're always using the latest release.

We should probably wait a bit to make sure that this lands.

[epage]

Yes, it'll be a couple of Rust release before this hits stable. As precedence for changing the book, we hope to update crates.io as well to provide cargo add snippets.

Just wanted to call out that more than

$ cargo add bevy

(like on quick start)

You can also do

$ cargo add bevy -F dynamic

(like on setup)

[IceSentry]

This isn't blocked anymore, but there was some pushback on discord based on some people not liking the higher risk of typo squatting related to using cargo add. I don't necessarily agree, but it's worth considering before merging anything.

[alice-i-cecile]

I agree; I don't think that's a particularly important concern here. Users will be running this on their home machine, and I trust the cargo team's judgement on the relative security costs.

[epage]

I have not heard of any concerns before for typo squatting (nor can I think of it being any different than editing Cargo.toml).

Could you point people with those concerns to our typo squatting issues so we can keep their concerns in mind when prioritizing them?

• Help catch typo squatting when adding dependencies rust-lang/cargo#10655
• Help catch internal-crate squatting attacks when adding a dependency rust-lang/cargo#10656

We can then also keep it in mind with my request to put cargo-add snippets on crates.io: rust-lang/crates.io#4980