fix(release): drop version requirements from intra-workspace path deps - #6
2 findings
Reviewed 6 files; 3 findings. The code index for this repository is cold, so this review saw the diff alone.
| Finding | Where | |
|---|---|---|
 |
Restore version requirement on the tinymemory-api path dependency | Cargo.toml:58 |
|
Restore version requirements on path dependencies | core/Cargo.toml:18 |
 Restore version requirement on the tinymemory-api path dependency
Cargo.toml:58
[RULE] Dependencies should be pinned with a caret range; path dependencies intended for publishing need a version requirement.
The original entry pinned the dependency with version = "0.1.1" (a caret range). Removing the version field means the dependency is no longer pinned with a caret range, contrary to the repository rule. More importantly, if this crate is published to crates.io, Cargo requires every path dependency to specify a version requirement (unless it is a workspace member); without one, cargo publish will fail. The surrounding comment indicates the crate is meant for external consumption, so publishing is a real path.
 Restore version requirements on path dependencies
core/Cargo.toml:18
[RULE] Keep path dependencies publishable
These path dependencies dropped their version fields. Cargo requires every path dependency to have a version requirement when publishing to crates.io; without it cargo publish errors with "path dependency ... does not have a version requirement." The dev-dependency entry for tinymemory-api is affected the same way. If this crate (or anything that depends on it for publishing) is released to crates.io, this change breaks publication. Confidence is moderate because the diff alone does not show whether these crates are actually published; if this workspace is purely local-only, the removal is safe.
