Set specific version of the dependency of a project's dependency in Cargo.toml or Cargo.lock

Question

Let\'s say my project A depends on library B that depends on library C.

Library B sets the dependency version to \"*\" (any) so cargo will download the latest versio

Answer 1

Current idea

I think you are going to have to check out Iron, modify Cargo.toml to specify versions (as you have already done). Then you need to repeat the process, checking out url, modify its Cargo.toml, then make sure you are using your version of url in Iron's Cargo.toml. Rinse and repeat. This all sounds terrible :-(

First idea

From the Cargo docs:

Similar to before, let’s say you’re working on a project, uuid, which depends on rand. This time you're the one who finds a bug in rand, and you want to write a patch and be able to test out your patch by using your version of rand in uuid.

A path override is communicated to Cargo through the .cargo/config configuration mechanism. If Cargo finds this configuration when building your package, it will use the override on your local machine instead of the source specified in your Cargo.toml.

Inside that file, put this:

paths = ["/path/to/project/rand"]

Second idea

Note This probably won't work. A thing someone told me when I was first starting Rust is that you can have multiple versions of the same library compiled into one binary. That would mean that there's no one place you can specify a version that applies all over, like you could with a Gemfile.

You might be able to simply specify versions (or SHA hashes?) for each dependency that you know works with your Rust version. Cargo should be able to resolve the transitive dependencies and simply lock you to a previous version (if there is one that fits all the requirements).

Answer 2

Since the anwser provided, Cargo has added the [patch] section to the manifest which allows you to do this use case.

overriding-dependencies