Comment by Hizonner | Hacker News Reader

Comment by Hizonner | Hacker News Reader

Parent Full thread

OK, so suppose I depend on anarchy, which wants shades >=1.0.1, and chaos, which wants shades >=1.0.2. The author of shades releases 1.0.3 because of a bad security hole in all prior versions. My project will still get 1.0.2, so it will still have the security hole. For that matter, it may ALSO break because anarchy is broken by a change made between shades 1.0.1 and 1.0.2... which is why the maintainer of anarchy hasn't updated their dependency.

On the whole, I think I'd prefer a solver that gave me 1.0.3 by default (but maybe would NOT give me 2.0.0 by default, depending on what the version numbers mean in this particular system). But the bottom line is that there is NO solver that can be SURE that what I eventually get will really work.

That's an interesting fact about Rust, and I didn't know it. On the whole, it sounds like it at least needs some serious tooling so you can make sure you're not dragging in a bunch of old versions that both bloat your code and open you to abuse. Can I ask for a warning if I'm getting two different versions linked into the same binary? If something depends on "=1.0", and the maintainer issues 1.1 with a flag that says "I really, really don't think think you should be using 1.0 any more", will that throw an error? And what happens if both versions get pulled in, but the package in question uses an external data file whose format changed between 1.0 and 1.1?

Edited to change "<=" to ">="...

Oh, and another Rust question, if you don't mind. If I have both versions 1.0 and 1.1 of package X in my binary, and X defines a data type called foo, and one of my dependencies constructs a foo using X 1.0, is that value of a different type than a foo constructed by X 1.1? Or can version 1.0 foos wind their way through the code and up being processed by version 1.1 code?

> My project will still get 1.0.2, so it will still have the security hole.

Right. To mitigate that you would regularly run `npm audit` or even just `npm upgrade` – and test afterwards of course.

I'm not completely sold, but I do think it's a very interesting idea.

> Can I ask for a warning if I'm getting two different versions linked into the same binary?

Yes. That was the lint I linked in my last post. Alternatively, you can run `cargo tree --duplicates`.

> "I really, really don't think think you should be using 1.0 any more"

That's called "yanking". Personally I think it has limited usefulness, but it exists.

https://doc.rust-lang.org/cargo/commands/cargo-yank.html

> And what happens if both versions get pulled in, but the package in question uses an external data file whose format changed between 1.0 and 1.1?

If it uses something like `include!`, both copies will be compiled in (and maybe optimized later by the linker). If it's truly "external" like hosted on some website outside the package manager, then it just means the author broke their package. Maybe I misunderstood your question.

> one of my dependencies constructs a foo using X 1.0, is that value of a different type than a foo constructed by X 1.1?

I believe they are always different types. Cargo encourages but doesn't enforce semver, so anything can change between versions, including private fields or enum variants behind non_exhaustive, etc. So they're treated as different and you need to convert between them. Although this might only be true for major versions; I don't know off the top of my head.

To work around it you can convert the types at crate boundaries, or the package author can use the so-called "semver trick" [1]

[1]: https://github.com/dtolnay/semver-trick

By an "external data file", I mean that the package keeps a runtime database in a disk file or something, and will end up getting confused if two versions are reading and writing that file concurrently. The same would apply if the two versions had any way to end up sharing an in-memory data structure as well.

If the version varies even a little bit, they are treated as different types by Rust.

> is that value of a different type than a foo constructed by X 1.1

I encountered this case once, and they are considered to be different types (in my case the issue was that using v1.0::foo with v1.1::foo traits wouldn't compile), so either keep them separated or pick one. Error messages can be confusing though, if you don't suspect using two versions.

Reply on news.ycombinator.com