Relax dependency pinning from patch to minor level only #153
Conversation
|
I thought that even if you specify the minor verison in |
True, but the default caret requirements syntax allows semver compatible updates. If you specify |
|
Re-reading my initial message it looks like I worded the rational quite poorly, sorry for the confusion. The idea is to allow minor version bumps and only block major versions that are expected to be breaking. |
One of the things I've found frustrating trying to update dependencies in my own projects (and 3rd party ones) is keeping the dependency tree free of duplicate copies of the same crate at different pinned versions. This is a notable problem for this crate in particular because it has been a number of deepnesses pinned to exact patch versions and is frequently found in conjunction with other crates that do the same. An example of this is Typst (which uses rustybuzz directly) where it depends on resvg, which in turn depends on RustyBuzz and ttf-parser as well.
I propose relaxing the main manifest to only define dependencies at the minor version level. This will make downstream dependency trees quite a bit easier to manage and allow more frequent version bumps for some projects without bloating the build tree.
In the mean time we still have a tracked lock manifest with exact patch versions for what we have most recently tested and released.
Any feelings on this guys?