dependency downgrade on cargo update

[debris]

cargo 1.26.0 (0e7c5a931 2018-04-06)

---

I run cargo update -p snappy on parity project - rev bca100cdb047906e73d6733f43df73c7603897dd.

cargo output was ok:

    Updating git repository `https://github.com/paritytech/rust-snappy`
    Updating git repository `https://github.com/paritytech/ring`
    Updating registry `https://github.com/rust-lang/crates.io-index`
      Adding cmake v0.1.31
    Updating snappy v0.1.0 (https://github.com/paritytech/rust-snappy#40ac9a0d) -> #798408ff
    Updating snappy-sys v0.1.0 (https://github.com/paritytech/rust-snappy#40ac9a0d) -> #798408ff

but to my surprise, one of my dependencies has been downgraded with no apparent reason

diff --git a/Cargo.lock b/Cargo.lock
index c791ae4..d69a4c7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -246,6 +246,14 @@ dependencies = [
 ]
 
 [[package]]
+name = "cmake"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "cc 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
+[[package]]
 name = "common-types"
 version = "0.1.0"
 dependencies = [
@@ -1969,7 +1977,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 dependencies = [
  "num-integer 0.1.36 (registry+https://github.com/rust-lang/crates.io-index)",
  "num-traits 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)",
- "rand 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.3.20 (registry+https://github.com/rust-lang/crates.io-index)",
  "rustc-serialize 0.3.24 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
@@ -2765,7 +2773,7 @@ dependencies = [
  "lazy_static 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "libc 0.2.36 (registry+https://github.com/rust-lang/crates.io-index)",
  "num_cpus 1.8.0 (registry+https://github.com/rust-lang/crates.io-index)",
- "rand 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.3.20 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
 [[package]]
@@ -3118,7 +3126,7 @@ dependencies = [
 [[package]]
 name = "snappy"
 version = "0.1.0"
-source = "git+https://github.com/paritytech/rust-snappy#40ac9a0d9fd613e7f38df800a11a589b7296da73"
+source = "git+https://github.com/paritytech/rust-snappy#798408ffef8f86dd51481673aca10f5348d7491b"
 dependencies = [
  "libc 0.2.36 (registry+https://github.com/rust-lang/crates.io-index)",
  "snappy-sys 0.1.0 (git+https://github.com/paritytech/rust-snappy)",
@@ -3127,9 +3135,9 @@ dependencies = [
 [[package]]
 name = "snappy-sys"
 version = "0.1.0"
-source = "git+https://github.com/paritytech/rust-snappy#40ac9a0d9fd613e7f38df800a11a589b7296da73"
+source = "git+https://github.com/paritytech/rust-snappy#798408ffef8f86dd51481673aca10f5348d7491b"
 dependencies = [
- "cc 1.0.17 (registry+https://github.com/rust-lang/crates.io-index)",
+ "cmake 0.1.31 (registry+https://github.com/rust-lang/crates.io-index)",
  "libc 0.2.36 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
@@ -3942,6 +3950,7 @@ dependencies = [
 "checksum chrono 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)" = "1cce36c92cb605414e9b824f866f5babe0a0368e39ea07393b9b63cf3844c0e6"
 "checksum cid 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)" = "d85ee025368e69063c420cbb2ed9f852cb03a5e69b73be021e65726ce03585b6"
 "checksum clap 2.29.1 (registry+https://github.com/rust-lang/crates.io-index)" = "8f4a2b3bb7ef3c672d7c13d15613211d5a6976b6892c598b0fcb5d40765f19c2"
+"checksum cmake 0.1.31 (registry+https://github.com/rust-lang/crates.io-index)" = "95470235c31c726d72bf2e1f421adc1e65b9d561bf5529612cbe1a72da1467b3"
 "checksum conv 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)" = "78ff10625fd0ac447827aa30ea8b861fead473bb60aeb73af6c1c58caf0d1299"
 "checksum crc 1.7.0 (registry+https://github.com/rust-lang/crates.io-index)" = "bd5d02c0aac6bd68393ed69e00bbc2457f3e89075c6349db7189618dc4ddc1d7"
 "checksum crossbeam 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)" = "24ce9782d4d5c53674646a6a4c1863a21a8fc0cb649b3c94dfc16e45071dea19"

---

rand crate has been downgraded for num-bigint and rayon-core which require rand >= 0.3, < 0.5

[alexcrichton]

Thanks for the report! This is definitely a bug in the output of cargo update at least in that it should inform you what's happening. Otherwise though this is a result of Cargo's crate graph resolution where it will pick the first crate graph that works (rather than optimizing for fewer crate versions). In that sense this is expected behavior in that this can happen, but further invocations of cargo update -p ... can help fix the issue.

cc @Eh2406, you might find this interesting as well!

[ehuss]

I ran into the same thing with rand, see #5529.

[Eh2406]

This is definitely a bug in the output of cargo update at least in that it should inform you what's happening.

Specifically #5530 with a WIP PR at #5634

[staktrace]

Similar issue: If you check out mozilla-central at 6f86cc3479f80ace97f62634e2c82a483d1ede40 and run cargo update -p webrender_api -p webrender in the root dir, it will downgrade the log 0.4.2 dependency of rsdparsa to log 0.3.9 for no apparent reason. The webrender dependency tree is completely independent of rsdparsa so it's not obvious to me why cargo update is changing the dependencies of rsdparsa at all. Note also that subsequently running cargo update -p gkrust reverts the log dependency back. gkrust is the root of the dependency tree.

[dwijnand]

Note there was an attempt to fix this in #5718, that needs a bit more work.

[5chdn]

further invocations of cargo update -p ... can help fix the issue.

that's not solving the issue unfortunately.