Specifying an exact version of cc in Cargo.toml causes collisions when using other crates

[reuvenpo]

The blake3 crate requires using exactly version 1.0.48 of the cc crate. This causes conflicts when trying to use it with packages that require different versions of cc, such as secp256k1 (because of this issue).

Is this an intentional limitation, or can the dependency be loosened to any of the 1.* versions of cc? (even setting a minimum version of 1.0.41 or lower will be acceptable for this use-case)

[oconnor663]

Note that in Cargo.toml, 1.0.48 is not an exact version requirement. It's actually equivalent to ^1.0.48, see https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#specifying-dependencies-from-cratesio.

[reuvenpo]

Oh, that's cool :)
Still, can a lower version be sufficient for the purposes of this crate?

[oconnor663]

Sorry for the partial answer above :) I think the answer is yes, we could lower the version of cc we ask for, but I want to understand the underlying issue better. First, I thought Cargo was willing to compile multiple versions of a crate if necessary. Second, it looks like the reason for needing an older version of cc is for a low Minimum Supported Rust Version, but this crate doesn't do any testing on compiler versions older than current stable.

[oconnor663]

Ah here's some more detail about my first question. Apparently Cargo only allows multiple versions of a crate if the two versions in question aren't semver-compatible with each other: rust-lang/cargo#6584 (comment)

[reuvenpo]

To be fair, from this crate's perspective there's nothing that needs to be done, since even if you set your minimum version really low, cargo will still always fetch the newest version it can. That way even if it's not actually supported, you won't see an issue with CI. I think that's a wider issue that I'm not sure how to handle. This is only a problem because of compatibility with other crates that have stricter supported versions.

You sent the above as i was writing that i have no ides why the collision was happening, thanks for finding that out, i didn't know about that :D

[oconnor663]

I've just pushed the commit above, which lowers our required version of cc to 1.0.4. I tested by hand and found that that's the oldest version that actually works. Do you need me tag a new release?

There's no downside to making this change, like you said, so I'm happy to do it if it solves the problem. But I also want to be clear that blake3 doesn't have a "minimum supported Rust version" other than latest stable. If you use it in an environment that's pinned to an old compiler, there are likely to be other issues.

[reuvenpo]

Thankfully, my project does not have a minimum supported compiler version either, and we're using recent nightlies for all our builds :) We also don't mind using github dependencies (and are forced to with some dependencies) so there's no need for an urgent release :) The issue as far as we're concerned is secp256k1's strict (and old) MSRV, not the high minimum version that was specified here, which is why i said that "from this crate's perspective there's nothing that needs to be done".

Thank you for the rapid response and fix! 😄

[oconnor663]

Very welcome, always happy to have real world users :) I'll close this for now, but feel free to reopen it if something breaks.