cargo publish forces non-compatible semver updates for version ranges in dependencies

[abonander]

I'm trying to publish a new version of multipart-nickel to update its multipart dependency, which is now using a version range for hyper = ">=0.9.0, < 0.11". However, multipart-nickel requires hyper = "0.9.18" because Nickel is still on that version.

This works fine for cargo build and cargo test, the dependency solver works this out just fine and uses hyper = 0.9.18 for multipart. However, when I go to publish multipart-nickel, the publish test run forces a non-compatible upgrade to hyper = 0.10.9 (second Cargo.lock is target/package/multipart-nickel-0.3.0/Cargo.lock): https://gist.github.com/abonander/332fa65592fd0e593e767834d09eb96f#file-multipart-nickel-0-3-0-cargo-lock-L99

This, obviously, causes the publish to fail because the version of Hyper that it is trying to use is incompatible with the one that Nickel is using and the library fails to compile. This is a really unintuitive discrepancy that doesn't really make sense in practice. I spent [longer than I'd like to admit] trying to make this work because I thought I'd declared the wrong version somewhere, but I didn't know that cargo publish uses its own Cargo.lock.

[alexcrichton]

This sounds like it's boiling down to #2064, but do you think this is a separate issue?

[abonander]

It sounds like it has a simpler solution than #2064, as it's mainly about the discrepancy in dependency solving between cargo publish and the other commands, but fixing #2064 may well fix this.

[alexcrichton]

Ok, in that case I'm going to close this in #2064. What I believe you're seeing here is nondeterminism in graph resolution. Some invocations of Cargo will pick everything as 0.9 whereas others will have the 0.9 / 0.10 split. With #2064 Cargo will have a hard constraint which guarantees 0.9 everywhere.

[carols10cents]

I think I'm running into this too... I don't understand why cargo publish is resolving dependencies again, I have a Cargo.lock, shouldn't it just use that?

[carols10cents]

Oh wait, just found #2263, I think that's my real problem