The Cargo.lock file in the 0.3.0 release sources is not in sync with the Cargo.toml file. This makes it impossible to build with cargo --locked or --frozen option, which is very useful for distro packages because it makes it possible to generate reproducible builds as well as make package bug tracking easier and other advantages. Of course users can work around this by using unpinned dependencies at build time, but then your software may or may not continue to build. As soon as some dependencies introduces a breaking change then this will start blowing back on you.
I request you make a 0.3.1 release with the lock file updated in sync with the project toml config with a known-good set of exact dependency versions so distros can freeze them and users will be able to go on building it ever after upstream projects change things.
I also suggest adding CI checks to make sure releases don't get tagged with out of sync lock files in the first place.
The Cargo.lock file in the 0.3.0 release sources is not in sync with the Cargo.toml file. This makes it impossible to build with
cargo --locked
or--frozen
option, which is very useful for distro packages because it makes it possible to generate reproducible builds as well as make package bug tracking easier and other advantages. Of course users can work around this by using unpinned dependencies at build time, but then your software may or may not continue to build. As soon as some dependencies introduces a breaking change then this will start blowing back on you.I request you make a 0.3.1 release with the lock file updated in sync with the project toml config with a known-good set of exact dependency versions so distros can freeze them and users will be able to go on building it ever after upstream projects change things.
I also suggest adding CI checks to make sure releases don't get tagged with out of sync lock files in the first place.