{"action":"created","issue":{"url":"https://api.github.com/repos/rust-lang/rfcs/issues/1241","labels_url":"https://api.github.com/repos/rust-lang/rfcs/issues/1241/labels{/name}","comments_url":"https://api.github.com/repos/rust-lang/rfcs/issues/1241/comments","events_url":"https://api.github.com/repos/rust-lang/rfcs/issues/1241/events","html_url":"https://github.com/rust-lang/rfcs/pull/1241","id":99581966,"number":1241,"title":"Forbid wildcard dependencies on crates.io","user":{"login":"sfackler","id":1455697,"avatar_url":"https://avatars.githubusercontent.com/u/1455697?v=3","gravatar_id":"","url":"https://api.github.com/users/sfackler","html_url":"https://github.com/sfackler","followers_url":"https://api.github.com/users/sfackler/followers","following_url":"https://api.github.com/users/sfackler/following{/other_user}","gists_url":"https://api.github.com/users/sfackler/gists{/gist_id}","starred_url":"https://api.github.com/users/sfackler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sfackler/subscriptions","organizations_url":"https://api.github.com/users/sfackler/orgs","repos_url":"https://api.github.com/users/sfackler/repos","events_url":"https://api.github.com/users/sfackler/events{/privacy}","received_events_url":"https://api.github.com/users/sfackler/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rust-lang/rfcs/labels/final-comment-period","name":"final-comment-period","color":"207de5"},{"url":"https://api.github.com/repos/rust-lang/rfcs/labels/T-libs","name":"T-libs","color":"bfd4f2"},{"url":"https://api.github.com/repos/rust-lang/rfcs/labels/T-tools","name":"T-tools","color":"bfd4f2"}],"state":"open","locked":false,"assignee":{"login":"sfackler","id":1455697,"avatar_url":"https://avatars.githubusercontent.com/u/1455697?v=3","gravatar_id":"","url":"https://api.github.com/users/sfackler","html_url":"https://github.com/sfackler","followers_url":"https://api.github.com/users/sfackler/followers","following_url":"https://api.github.com/users/sfackler/following{/other_user}","gists_url":"https://api.github.com/users/sfackler/gists{/gist_id}","starred_url":"https://api.github.com/users/sfackler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sfackler/subscriptions","organizations_url":"https://api.github.com/users/sfackler/orgs","repos_url":"https://api.github.com/users/sfackler/repos","events_url":"https://api.github.com/users/sfackler/events{/privacy}","received_events_url":"https://api.github.com/users/sfackler/received_events","type":"User","site_admin":false},"milestone":null,"comments":51,"created_at":"2015-08-07T05:12:43Z","updated_at":"2015-09-08T17:34:32Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rust-lang/rfcs/pulls/1241","html_url":"https://github.com/rust-lang/rfcs/pull/1241","diff_url":"https://github.com/rust-lang/rfcs/pull/1241.diff","patch_url":"https://github.com/rust-lang/rfcs/pull/1241.patch"},"body":"[Rendered](https://github.com/sfackler/rfcs/blob/no-wildcard-deps/text/0000-no-wildcard-deps.md)"},"comment":{"url":"https://api.github.com/repos/rust-lang/rfcs/issues/comments/138643318","html_url":"https://github.com/rust-lang/rfcs/pull/1241#issuecomment-138643318","issue_url":"https://api.github.com/repos/rust-lang/rfcs/issues/1241","id":138643318,"user":{"login":"sfackler","id":1455697,"avatar_url":"https://avatars.githubusercontent.com/u/1455697?v=3","gravatar_id":"","url":"https://api.github.com/users/sfackler","html_url":"https://github.com/sfackler","followers_url":"https://api.github.com/users/sfackler/followers","following_url":"https://api.github.com/users/sfackler/following{/other_user}","gists_url":"https://api.github.com/users/sfackler/gists{/gist_id}","starred_url":"https://api.github.com/users/sfackler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sfackler/subscriptions","organizations_url":"https://api.github.com/users/sfackler/orgs","repos_url":"https://api.github.com/users/sfackler/repos","events_url":"https://api.github.com/users/sfackler/events{/privacy}","received_events_url":"https://api.github.com/users/sfackler/received_events","type":"User","site_admin":false},"created_at":"2015-09-08T17:34:32Z","updated_at":"2015-09-08T17:34:32Z","body":"@erikjohnston \r\n\r\n> It seems odd to me to suggest that library authors not pin versions of dependencies - presumably so that multiple crates depending on the same crate are more likely to be compatible - and yet suggest we force specifying an upper bound. Specifying an upper bound does not guarantee that the library is going to work with all versions anyway, so this seems like a) an arbitrary line in the sand and b) that this is a more generic problem.\r\n\r\nIt's not about guarantees - it's about finding a middle ground between being completely inflexible to the point of too-frequent breakage in dependency resolution and being completely flexible to the point of too-frequent breakage in compilation. Semver is the norm for crates.io packages - if an author breaks back-compat within the same major version, you can expect that people will be filing bugs on the project to get the release yanked, but there's no such norm for major version bumps.\r\n\r\nThe appropriate constraint depends on the dependency. For a library whose author provides strong guarantees about breaking change patterns, you can extend your version constraints much further than you'd be able to for a library with no such guarantees.\r\n\r\n------\r\n\r\nThanks for the comments, everyone! I still feel that unbounded-from-above dependencies are a bit sketchy, but there are clearly compelling arguments that they work out in practice. How about we adjust the RFC to prohibit only true wildcard (`*`) dependencies. This will make library authors think to at least some degree about what versions of things they need and see how that goes. If we see the need to go further in the future, we'll probably want to pair the restriction with the addition of some tools to help with it, such as the ability to loosen constraints of published crates and the ability to force versions out of their constraint bounds on the consumer side."}}