Provide a way to warn if the latest version of a package isn't selected

[ekmett]

Whenever I built a package and the constraints force me to an older version of a package than is currently released it is typically an error on my part, where I failed to notice that one of my dozens of dependencies has had a new release.

Is there or can there be a way to get cabal to warn me when it doesn't use the latest version of a given dependency?

I'm happy to pass it a flag.

As it is I usually have to wait 24-48 hours for @snoyberg to ping me about me breaking stackage before I find out about the problem. ;)

[byorgey]

+1 from me. I routinely do a --dry-run and pipe the output to my highlight-versions tool, but in reality it would be much nicer if I could just pass a flag to cabal to get this behavior.

[snoyberg]

+1 from me as well, this would be a great feature.

In the meanwhile, it doesn't do everything, but the packdeps command line tool will tell you if you have restrictive upper bounds on your current package. It won't check transitive dependencies, but it's a good start.

[gbaz]

perhaps could be integrated into #7500 ?

[gbaz]

also note that cabal outdated could be extended to do this -- it warns on explicit outdated bounds, but not solver-derived outdated bounds afaik

https://cabal.readthedocs.io/en/latest/cabal-package.html?highlight=outdated#listing-outdated-dependency-version-bounds

[patrickdoc]

I think the requested functionality already exists. It just requires 2 commands instead of 1.

Outdated explicit bounds

cabal/Cabal-syntax $ cabal outdated
Outdated dependencies:
binary >=0.7 && <0.9 (latest: 0.10.0.0)
time >=1.4.0.1 && <1.13 (latest: 1.13)
transformers >=0.3 && <0.4 || >=0.4.1.0 && <0.6 (latest: 0.6.0.3)

Outdated solver results

cabal/Cabal-syntax $ cabal freeze
Resolving dependencies...
Wrote freeze file: ..../cabal/cabal.project.freeze

cabal/Cabal-syntax $ cabal outdated --v2-freeze-file ../cabal.project.freeze
Outdated dependencies:
aeson ==1.5.6.0 (latest: 2.0.3.0)
base ==4.14.3.0 (latest: 4.16.0.0)
binary ==0.8.8.0 (latest: 0.10.0.0)
bytestring ==0.10.12.0 (latest: 0.11.2.0)
deepseq ==1.4.4.0 (latest: 1.4.6.1)
directory ==1.3.6.0 (latest: 1.3.7.0)
filepath ==1.4.2.1 (latest: 1.4.2.2)
ghc-prim ==0.6.1 (latest: 0.8.0)
happy ==1.20.0 (latest: 1.21.0)
hashable ==1.3.5.0 (latest: 1.4.0.2)
network-uri ==2.6.3.0 (latest: 2.7.0.0)
optparse-applicative ==0.16.1.0 (latest: 0.17.0.0)
parsec ==3.1.14.0 (latest: 3.1.15.0)
statistics ==0.15.2.0 (latest: 0.16.0.1)
stm ==2.5.0.1 (latest: 2.5.0.2)
template-haskell ==2.16.0.0 (latest: 2.18.0.0)
text ==1.2.4.1 (latest: 2.0)
time ==1.9.3 (latest: 1.13)
transformers ==0.5.6.2 (latest: 0.6.0.3)

[gbaz]

Good looking out! It might be nice to make a single flag to outdated that bypasses the need to use two steps.

[hasufell]

Some related issues:

1. mustache-2.4.0 failed to build in Stackage Nightly JustusAdam/mustache#58
2. Fail to build with cabal-install commercialhaskell/stack#5298

Here cabal had two options and picked the one that resulted in a build failure. It didn't take long to figure out what package combination is causing it, but I bet an ergonomic version of cabal outdated that e.g. hides the list of boot packages might be helpful.