Next step for deprecations in Cargo

[weihanglo]

2024 Deprecations

Problem

Cargo has been emitting a bunch deprecation message for a (long?) while. Since edition 2024 is approaching (1.82.0 anticipated), and a Cargo linting system is on the way (https://github.com/rust-lang/cargo/pull/13621), we might want to take advantage of this timing to evaluate whether this deprecations could be turned into a hard error.

The main risk here is CI automation might fail. Unlike rustc and clippy lints, people hardly noticed Cargo warnings becuase because there was no way to set -D on them.

Deprecations

2024 Edition

These are being tracked in rust-lang/rust#123754

### `dev_dependencies`/`build_dependencies`/`default_features`/`crate_types`/`proc_macro` https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/mod.rs#L198-L199 * Warn since: 1.61 (2022-05-19) but only when conflicting with dash ones * may become a hard error? NO * Risk: Old crates fail to compile. Might need an edition boundary. * * Next step: * Error on 2024 edition ### good old `[project]` (replaced with `[package]`) https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/mod.rs#L497-L498 * Warn since: 1.66 (2022-12-15) * may become a hard error? ✅ * Risk: Old crates fail to compile. Require an edition boundary. * * Next step: * Error on 2024 edition ### `default-features` in inherited dependencies https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/mod.rs#L1801-L1803 * Warn since: 1.69.0 (2023-04-29) * may become a hard error? ✅ * Risk: Build failures. Easy to fix. * * Next step: * Error in 2024 Edition

Independent of Edition

Approved changes

• [x] plugin support
  • see #13902
• [x] dependency without path, version, git, workspace specified
  • see #13775
• [x] license-file and readme pointing to a non-existent file
  • see #13921
• [x] --release is ignored when paired with --profile
  • see #13971
• [ ] cargo read-manifest

Proposed changes

• [ ] [replace] is deprecated
• [ ] old cargo tree flags
• [ ] path override modifying dependency graph
• [ ] rustc-cdylib-link-arg used in non-cdylib target
• [ ] user-defined alias is shadowing an external subcommand found
• [ ] output artifact name collisions
• [ ] Bail out when trying to link to a library that is not linkable
• [ ] Ambiguous package name in git dependency

plugin support

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/util/toml/targets.rs#L211-L216

• Warn since: 1.77.0 (2024-03-21)
• may become a hard error? ✅ (stop supporting plugin)
• Risk: Too new.
• https://github.com/rust-lang/cargo/pull/13248
• Next step:
  • Remove key, making it an "unused key" warning

dependency without path, version, git, workspace specified

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/toml/mod.rs#L1914-L1918

• Warn since: Merged on 2016-01-20
• May become a hard error? ✅
  • Was this a bug?
    • Yes
    • https://github.com/rust-lang/cargo/issues2147#issuecomment-156879677
• Risk: Old crates and deps fail to build. See https://github.com/rust-lang/cargo/issues/9885
• https://github.com/rust-lang/cargo/pull/2270
• Next step:
  • Hard error, see #13775

Note:

• this affects [dependencies] as well as [patch], [replace], including in virtual workspaces and config where Editions don't apply
• hard error makes the format more future proof for adding additional sources (otherwise old cargos would do wildly bad things)

license-file and readme pointing to a non-existent file

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/ops/cargo_package.rs#L416-L418

• Warn since: 1.43.0 (2020-04-23) for license-file; 1.71.0 (2023-08-03) for readme
• may become a hard error? ✅ )
• Risk: Publish might fail. Easy to fix in normal cases.
• https://github.com/rust-lang/cargo/pull/7905
• https://github.com/rust-lang/cargo/pull/12036
• Next step:
  • Hard error, even for empty string

--release is ignored when paired with --profile

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/command_prelude.rs#L570-L573

• Warn since: 1.57.0 (2021-12-02)
• may become a hard error? ✅
• Risk: Break people's build. Easy to fix by themselves.
• https://github.com/rust-lang/cargo/pull/9943
• Next step:
  • Hard error

cargo read-manifest

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/bin/cargo/commands/read_manifest.rs#L9

• Warn since: Merged on 2016-10-03.
• Become a hard error? NO
• Risk: Automations might still rely on it. cargo metadata --no-deps should cover its use cases.
• https://github.com/rust-lang/cargo/pull/3150
• Next step:
  • Needs further investigation (unclear why this was deprecated and if it still fills a unique niche)

[replace] is deprecated

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/doc/src/reference/overriding-dependencies.md?plain=1#L300-L301

• Warn since: 1.42.0 (2020-03-12)
• may become a hard error? NO
• Risk: Can we patch [patch] to fully replace [repalce]?
• https://github.com/rust-lang/cargo/pull/7733
• Next step (proposed)
  • Deprecation warning using lint system (since restricted Carog.toml)
  • Maybe with future edition turn it into forbid (based on people's reaction to warning)

old cargo tree flags: --all, no-dev-dependencies, --no-indent, --prefix-depth, --all-targets

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/bin/cargo/commands/tree.rs#L144-L146

• Warn since: 1.44.0 (2020-06-04)
• may become a hard error? ✅ for all; NO for others
• Risk: Have alternatives. Easy to fix.
• https://github.com/rust-lang/cargo/pull/8115
• Next step (proposed):
  • Downgrade to consistent deprecation (no point removing one when others would be kept)

path override modifying dependency graph

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/registry.rs#L535-L538

• Warn since: Merged on 2016-10-05 (1.14 or so)
• may become a hard error? ✅ (was a bug)
• Risk: Assuming people seldom use it?
• https://github.com/rust-lang/cargo/pull/3136
• Next step (proposed):
  • Turn into error because it was a bug with buggy behavior and people using this went into it knowing its bad (since they likely started post-1.14), and we've not been getting necro-posts for people saying they need this (like depending on bins)

rustc-cdylib-link-arg used in non-cdylib target

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/compiler/custom_build.rs#L850-L856

• Warn since: 1.54.0 (2021-07-29)
• may become a hard error? ✅ (may become)
• Risk: crates might depends on this heavily; might need a way to toggle like https://github.com/rust-lang/cargo/issues/9094 or Pre-RFC for mutually-exclusive, global features
• https://github.com/rust-lang/cargo/pull/9563
• Next step (proposed):
  • Hard error, independent of edition, because this was never intended, we warning for a while, and no has brought up a concrete case of the warning firing when they need it

user-defined alias is shadowing an external subcommand found

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/bin/cargo/cli.rs#L321-L323

• Warn since: 1.58.0 (2022-01-13)
• may become a hard error? ✅
• Risk: Custom workflow might fail. cargo clippy and cargo fmt are what we concerned.

• 10049

• https://github.com/rust-lang/cargo/pull/10082
• Next step (proposed):
  • Turn into hard error. Aliases are generally for user interaction, rather than automation (except for things like xtasks) so the impact is low

output artifact name collisions

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/compiler/build_runner/mod.rs#L472-L474

• Warn since: 1.32.0 (2019-01-17)
• may become a hard error? ✅
• Risk: Workaround could be quite complicated.
• https://github.com/rust-lang/cargo/pull/6308
• Next step (proposed):
  • Maybe in a future Edition, switch to forbid by default?
  • Or just warn because this is implementation-defined for when a collision may occur and new collisions may come up in the future

Bail out when trying to link to a library that is not linkable

https://github.com/rust-lang/cargo/blob/f0ae76519127d16d87362c6d88416d92cba86c6a/src/cargo/core/compiler/mod.rs#L1427-L1430

• Warn since: 1.24.0 (2018-02-15)
• may become a hard error? ✅
• Risk: People depend on this in a quirky way.
• https://github.com/rust-lang/cargo/pull/4797
• Next step (proposed):
  • Needs investigation into replacement feature for those relying on it
  • Likely should instead be hard error conditioned on Edition

Ambiguous package name in git dependency

https://github.com/rust-lang/cargo/blob/bd1cf584af2c356eeb3980c3c9bb0fea190ed633/src/cargo/ops/cargo_read_manifest.rs#L225-L234

• Warn since: 1.63
• may become a hard error? NO
• Risk: too many false positives, see #10752

• 10701, #10767

• Next step (proposed):
  • Address #10752
  • Turn into error on edition

No further steps

deprecate --all (alias to --workspace)

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/command_prelude.rs#L54

• Warn since: 1.39.0 (2019-11-07)
• may become a hard error? NO
• Risk: Automations might still rely on it. Some users use it exclusively due to brevity (see also #11554)
• https://github.com/rust-lang/cargo/pull/7241
• Next step (proposed):
  • CLI, so no further steps
  • Not doing runtime warning because of pervasive use by people who really like it for brevity

Deprecate .cargo/config

https://github.com/rust-lang/cargo/blob/8bcecfeed464c990733ff680e0b4546a73fbed44/src/cargo/util/context/mod.rs#L1563-L1567

• Warn since: 1.78 (2024-05-02)
• may become a hard error? NO
• Risk: Way too new.
• https://github.com/rust-lang/cargo/pull/13349
• Next step (proposed):
  • No further steps

[epage]

dependency without path, version, git, workspace specified

While it says it may transition to a hard error, the fact that issues seemed to exist where we broke people previously for this makes me cautious about doing it.

I'm at least for making this an error on the next Edition.

cargo read-manifest

As this is a command, I don't think there are further next steps.

At most, we could check the Edition and hard error but that seems unnecessary.

We could hide it in cargo --list but its good for people to know what built-ins exist because of how conflicts work with commands.

path override modifying dependency graph

I don't have a good feel for this for turning

Bail out when trying to link to a library that is not linkable

I feel like this is blocked on issues like #7825

output artifact name collisions

Is this blocked on #8794?

deprecate --all (alias to --workspace)

We should remove this from -h.

Otherwise, as a CLI, there isn't much more we should do.

[replace] is deprecated

Being config, I'm not sure there is much we should do.

license-file and readme pointing to a non-existent file

At one point, this was an error. I wonder if we were too aggressive in making this a warning.

Maybe if the fields are empty, we allow it but otherwise go ahead and error?

old cargo tree flags: --all, no-dev-dependencies, --no-indent, --prefix-depth, --all-targets

Being a CLI, is there much we should do?

rustc-cdylib-link-arg used in non-cdylib target

I'm for a hard error. The message says this wasn't originally allowed and that it was a bug that it was allowed.

--release is ignored when paired with --profile

Despite being in the CLI, I'm somewhat tempted to allow this to error.

user-defined alias is shadowing an external subcommand found:

Despite being a mixture of CLI and config, I'm game for this. Generally aliases are for users and not automation. xtasks are an exception but a well structured pattern of it.

dev_dependencies/build_dependencies/default_features/crate_types/proc_macro

Error on next edition

good old [project] (replaced with [package])

Without more historical context for why it should unconditionally error, I'd say error on next edition

default-features in inherited dependencies

Error on next edition

plugin support

Remove

Deprecate .cargo/config

Keep as-is (deprecated). Being config, we can't use Editions. Its also likely something tied to automation, so we can't remove either.

[epage]

We discussed some of these in today's team meeting and updated the next steps for those items. For things that weren't discussed I noted that the "Next Steps" are "proposed".