Downgrade transitive deps to match minimal direct deps#1640
Merged
Conversation
Collaborator
Coverage Report for CI Build 27574458706Coverage remained the same at 85.188%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
benalleng
changed the title
benalleng
force-pushed
the
minimal-versions
branch
from
2d2cdde to
20b7bde
Compare
benalleng
force-pushed
the
minimal-versions
branch
2 times, most recently
from
02093c7 to
5672c69
Compare
benalleng
force-pushed
the
minimal-versions
branch
from
5672c69 to
e7f51fd
Compare
benalleng
force-pushed
the
minimal-versions
branch
from
e7f51fd to
367ce44
Compare
DanGould
approved these changes
Jun 16, 2026
DanGould
left a comment
DanGould
left a comment
Member
There was a problem hiding this comment.
LGTM
My understanding is that without this change, transitive deps could still drift to newer versions whenever lock files are regenerated.
Comment on lines
-38
to
+39
| uniffi-bindgen-cs = { git = "https://github.com/chavic/uniffi-bindgen-cs.git", rev = "878a3d269eacce64beadcd336ade0b7c8da09824", optional = true } | ||
| uniffi-dart = { git = "https://github.com/Uniffi-Dart/uniffi-dart.git", rev = "b0157aa", optional = true } | ||
| uniffi-bindgen-cs = { git = "https://github.com/benalleng/uniffi-bindgen-cs.git", rev = "71d6556aa60c29b487d931de47053f26ee8a1af1", optional = true } | ||
| uniffi-dart = { git = "https://github.com/benalleng/uniffi-dart.git", rev = "ce97870a934cd6046eef059c5805359ac0d59964", optional = true } |
Member
There was a problem hiding this comment.
Since these dependencies are already pointing at commit hashes, I don't think this PR needs to be blocked. I do think getting a timeline on when these will be versioned is now appropriate @chavic
DanGould
reviewed
Jun 16, 2026
| tracing-subscriber = { version = "0.3.19", features = ["env-filter"] } | ||
|
|
||
| # time is a transient dependency, but needs to be specified explicitly to pin the version for MSRV | ||
| # time and tar are transient dependencies, but needs to be specified explicitly to pin the version for MSRV |
Member
There was a problem hiding this comment.
Nit: consider removing "time and tar are" so the comment doesn't go stale, and repeating the uniform comment to all other Cargo.toml files that define package.metadata.cargo-machete for the same reason.
2 tasks
This was referenced Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an enhancement on-top of #1612. That only forced direct dependencies to be locked but transitive dependencies can still be updated and drift..
rust-bitcoin/rust-bitcoin#4898 demonstrates that they use
minimal-versionsas the final lockfile write command to copy intoCargo-minimal.lockThis commands includes both direct and transitive dependenciesThis requires 2 forks due to inconsistent toml deps in the uniffi crates.
Pull Request Checklist
Please confirm the following before requesting review:
AI
in the body of this PR.