Update Rust crate guppy to 0.19

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
guppy	dependencies	minor	0.17 → 0.19

---

Release Notes

guppy-rs/guppy (guppy)

v0.19.1: guppy 0.19.1

Compare Source

Added

• New features:

  • custom-platforms: Add support for custom platforms specified as JSON.
  • custom-cfg-platforms: Add support for custom platforms specified as rustc --print=cfg output.

  These features forward to target-spec's custom and custom-cfg features, respectively.

  Thanks UebelAndre for your contribution!

v0.19.0: guppy 0.19.0

Compare Source

Added

• ConditionalLink::declarations, which returns a new LinkDeclarations
  enum: whether the link's platform statuses were derived from every
  declaration of the dependency (Unsplit), only the ones without
  optional = true (Required), or only the ones with it (Optional).
  LinkDeclarations::includes_required and includes_optional answer whether
  a link covers a given kind of declaration.

Changed

• ConditionalLink::package_link is replaced by package_links, an iterator
  over every PackageLink the conditional link was derived from. This is
  usually one link, but one dependency name can resolve to several packages,
  either through a package = "..." rename or through different versions of
  one package declared for different targets. For example, consider this
  Cargo.toml:

  [package]
  name = "main"
  
  [dependencies]
  serde = { package = "serde_core", version = "1", optional = true }
  
  [target.'cfg(any())'.dependencies]
  serde = { version = "1", optional = true }
  
  [features]
  serde = ["dep:serde", "serde/std"]

  The package graph has two links out of main, main -> serde_core and
  main -> serde, both with the dependency name serde. The feature serde
  produces three conditional links:

  • main/serde -> main/dep:serde, from dep:serde. This activates the
    dependency name, so package_links returns both main -> serde_core and
    main -> serde.
  • main/serde -> serde_core/std, from serde/std. package_links returns
    only main -> serde_core.
  • main/serde -> serde/std, also from serde/std. package_links returns
    only main -> serde.

• FeatureQuery::resolve_with and resolve_with_fn now visit a weak dependency
  feature (dep?/feature) once for each kind of declaration of dep, not once
  for the whole edge. Consider:

  [dependencies]
  foo = { version = "1" }
  
  [build-dependencies]
  foo = { version = "1", optional = true }
  
  [features]
  weak = ["foo?/std"]

  The visitor sees weak -> foo/std as a Required link covering
  [dependencies]. If dep:foo is activated, it sees the same endpoints again
  as an Optional link covering [build-dependencies]. The edge is followed if
  the visitor accepts either link. Use ConditionalLink::declarations to tell
  the two apart. FeatureSet::conditional_links is unchanged: it returns one
  Unsplit link for the edge.

  This is part of the fix to weak dependency features described below.

Fixed

• Features that refer to a dependency name shared by several packages now take
  all of those packages into account (#​682).

  One dependency name can resolve to several packages, either through a
  package = "..." rename or through different versions of one package
  declared for different targets. For example, semver 1.0.28 does something
  like this:

  [dependencies]
  serde = { version = "1", package = "serde_core", optional = true }
  
  [target.'cfg(any())'.dependencies]
  serde = { version = "1", optional = true }
  
  [features]
  serde = ["dep:serde"]

  The name serde resolves to both serde_core and serde. Previously, the
  feature graph kept only one of the packages under each name. For semver,
  that was serde, which cfg(any()) never builds, so enabling the serde
  feature left serde_core out of guppy's feature resolution, and therefore
  out of CargoSet results.

  Now, matching Cargo:

  • dep:serde is activated wherever any declaration of serde applies.
  • serde/feature turns on feature in each package, under that package's
    own platform conditions. It also activates dep:serde wherever an
    optional declaration of any of the packages applies.
  • serde?/feature turns on feature in each package that is otherwise
    activated, again under that package's own platform conditions.

  As a result, if only some of the packages under a name have a feature that
  name/feature or name?/feature refers to, the feature graph now reports a
  missing-feature warning for the others. (Cargo itself rejects such a
  manifest, so this only happens with metadata that didn't come from Cargo.)

  Thanks UebelAndre for your first
  contribution!

• With the version 2 and 3 feature resolvers, an optional build dependency
  activated only through its own package's features was never built (#​699):

  [build-dependencies]
  cc = { version = "1", optional = true }
  
  [features]
  bundled = ["dep:cc"]

  Enabling bundled now builds cc on the host, as Cargo does. cc/feature
  entries and the version 1 resolver were not affected.

• Fixed a number of more contrived cases in guppy's simulation of Cargo's
  feature resolution:

  • Several bugs with weak dependency features (dep?/feature). guppy tracked
    whether dep was activated at all, whereas Cargo resolves each declaration
    of dep on its own. Consider:

    [dependencies]
    foo = { version = "1" }
    bar = { version = "1", optional = true }
    
    [build-dependencies]
    foo = { version = "1", optional = true }
    bar = { version = "1" }
    helper = { version = "1" }  # helper depends on foo itself
    
    [features]
    weak = ["foo?/std", "bar?/std"]

    Previously, enabling weak:

    • activated dep:foo, so foo was also built on the host. It no longer
      does, and the feature graph no longer has an edge from weak to
      dep:foo. A dependency required on one platform and optional on another
      had dep:foo added the same way.
    • enabled std on the foo that helper builds on the host, even though
      nothing had activated foo's optional build declaration. Now only the foo
      built on the target gets std.
    • activated dep:bar in the same way, so bar was also built on the
      target. Now bar only gets std on the host, where it is required, and
      is not built on the target.

    Of these, the second did not affect the version 1 resolver, which unifies
    features across the host and the target.

    As part of this fix, FeatureQuery::resolve_with and resolve_with_fn
    visit a weak dependency feature once for each kind of declaration. See the
    entry under "Changed" above.

  • Reverse feature queries with FeatureQuery::resolve_with or
    resolve_with_fn could leave out weak dependency features, depending on
    which features the query started from. For example, regex-automata has:

    [dependencies]
    aho-corasick = { version = "1", optional = true }
    
    [features]
    logging = ["aho-corasick?/logging"]

    A reverse query from aho-corasick/logging did not return
    regex-automata/logging.

    Reverse queries now offer both links of a weak dependency feature as soon as
    it is reached. With a visitor that accepts every link, a reverse query
    returns the same set as FeatureQuery::resolve. Forward queries are
    unchanged.

  • A foo/std entry could also turn on a feature named foo in the same
    package, in cases where Cargo doesn't. For example:

    [package]
    name = "main"
    
    [dependencies]
    bar = { version = "1" }
    
    [target.'cfg(unix)'.dependencies]
    foo = { version = "1" }
    
    [target.'cfg(windows)'.dependencies]
    foo = { version = "1", optional = true }
    
    [features]
    foo-std = ["foo/std"]
    bar = []
    bar-std = ["bar/std"]

    On Unix:

    • Enabling foo-std turns on foo's std feature. It doesn't turn on
      main's foo feature, because foo is only optional on Windows.
    • Enabling bar-std turns on bar's std feature. It doesn't turn on
      main's bar feature, because bar is never optional.

    Previously, guppy also turned on:

    • main's foo feature on Unix.
    • main's bar feature on all platforms.

    guppy now matches Cargo:

    • foo/std only turns on main's foo feature if an optional declaration
      of foo applies to the platform. Here, that is true only on Windows.
    • bar has no optional declarations, so bar/std never turns on main's
      bar feature.

    As part of this change, ConditionalLink::declarations returns Optional,
    not Unsplit, for the links from foo-std to dep:foo and to foo.

v0.18.0: guppy 0.18.0

Compare Source

Added

• PlatformSpec::Platforms, a new variant holding a list of platforms
  (#​438, #​630), and PlatformSpec::platforms, a constructor that accepts
  any iterator of Platform or Arc<Platform>. A query against Platforms is
  enabled if it is enabled on at least one of the platforms. Platforms([]) is
  the union of no platforms: nothing is enabled on it, not even unconditional
  dependencies.

  Per-platform results are combined with the same Kleene K3
  OR
  that guppy already uses to combine a dependency's target specs for a single
  platform: Enabled wins, then Unknown, then Disabled.

Changed

• Queries and link visitors:
  • PackageQuery and FeatureQuery are now represented as a set of initial
    nodes plus a direction, sharing their internal bitset representation with
    PackageSet and FeatureSet (#​609, #​610).
    • PackageQuery::initials now returns a &PackageSet, and
      FeatureQuery::initials a &FeatureSet, rather than iterators over
      metadatas. To obtain the old iterators, use
      initials().packages(direction) and initials().features(direction).
    • PackageQuery::starts_from and FeatureQuery::starts_from are removed.
      Use initials().contains(id) instead, which returns the same
      Result<bool, Error>.
    • The Debug output of both query types now goes through the set types'
      Debug impls. PackageQuery's Debug no longer dumps the entire
      package graph, and FeatureQuery's now prints its initial packages with
      their features.
  • The package and feature "resolver" traits are renamed and now receive an
    opaque context (#​497, #​601, #​602, #​604):
    • PackageResolver is now PackageLinkVisitor, and FeatureResolver is
      now FeatureLinkVisitor. The "resolver" name was easily confused with
      the Cargo feature resolver, and the trait visits links rather than
      packages or features.
    • accept is now visit_link on both traits.
    • visit_link (and the closures passed to PackageQuery::resolve_with_fn
      and FeatureQuery::resolve_with_fn) takes a &PackageLinkContext or
      &FeatureLinkContext instead of a &PackageQuery or &FeatureQuery.
      The query is available via query(); the context also provides
      direction() and starts_from_initial(&link).
    • CargoSet::with_package_resolver is now
      CargoSet::with_cargo_link_visitor and takes a new CargoLinkVisitor
      trait (in guppy::graph::cargo). Its CargoLinkContext exposes which
      pass the link is being evaluated for (build_platform()), the platform
      specs in effect (platform_spec() and build_dep_platform_spec()), and
      whether dev and build dependencies are under consideration for the link
      (considers_dev_deps and considers_build_deps respectively).
    • With the proptest1 feature, Prop010Resolver is now
      Prop010LinkVisitor and PackageGraph::proptest1_resolver_strategy is
      now proptest1_link_visitor_strategy.
• Cargo sets and their inputs:
  • CargoOptions::new now defaults to version 3 of the Cargo feature
    resolver
    rather than version 1 (#​624). To restore the old behavior, call
    set_resolver(CargoResolverVersion::V1).
  • A new CargoSetInputs struct in guppy::graph::cargo combines
    CargoOptions and the features-only set, and CargoSet now keeps a copy
    of the inputs it was built with, available via CargoSet::inputs
    (#​627). CargoSet::features_only is removed; use
    inputs().features_only instead.
  • With the summaries feature, CargoOptionsSummary is renamed to
    CargoSetInputsSummary, and CargoSet::to_summary uses the inputs the
    set was built with (#​625). Each features-only entry now records
    whether the package's base feature is enabled, writing base = false when
    it isn't (#​626). The field defaults to true, so existing summaries
    continue to work.
• Platform specs:
  • PlatformSpec::Platform is removed in favor of PlatformSpec::Platforms
    (see above). With the summaries feature, PlatformSpecSummary::Platform
    is likewise replaced by
    PlatformSpecSummary::Platforms(Vec<PlatformSummary>) (#​630).
  • A single platform is still serialized as-is, so existing serialized data
    continues to work. Zero or several platforms are serialized as an array
    (target-platform = [] or [[target-platform]]), which older versions of
    guppy cannot read.
  • With the summaries feature, PlatformSpecSummary::to_platform_spec now
    returns PlatformSpecSummaryError, which names the platform that could not
    be converted, instead of a bare TargetSpecError (#​628). The error also
    records the position of the failing platform within a list, available via
    its index and count methods. Both its Display output and
    Error::InvalidPlatformSpecSummary's name the triple and, for a list, the
    position.
  • Malformed platform specs now produce errors that name the offending
    element or key, rather than serde's "data did not match any variant"
    message (#​629). The following are rejected: "always" and "any" inside
    a list; spec alongside any platform key such as triple or
    target-features; unknown keys in a platform table; empty triples; and
    spec values other than "always" or "any". (Previously,
    spec = "<triple>" was silently treated as that platform.)
• PackageMetadata::minimum_rust_version is renamed to
  PackageMetadata::rust_version, replacing the deprecated method of that
  name (#​616). As a result, rust_version now returns Option<&Version>
  rather than Option<&VersionReq>.
  • Code that calls .matches(version) on the old return value will fail to
    compile; use version >= *rust_version instead.
  • For code that displays or serializes these versions, the output will
    change from a requirement such as >=1.65.0 to a plain version such as
    1.65.0.
• With the summaries feature, toml is updated to 1.1.4 (#​600).
  Error::TomlSerializeError now wraps toml 1.x's ser::Error, a breaking
  change for code that names that type. Summaries are parsed strictly
  according to the TOML 1.1 specification; documents that the lenient toml
  0.5 parser accepted but that are not valid TOML are now rejected.
• MSRV updated to Rust 1.91, as required by dependencies.

Removed

The following deprecated APIs are removed (#​616):

• PackageMetadata::rust_version's old form, deprecated since 0.17.1, which
  returned an Option<&VersionReq> with a single >=X.Y.Z comparator
  synthesized from the rust-version field. See the rename above for the
  replacement.
• BuildTarget::doc_tests, deprecated since 0.17.16. Use
  BuildTarget::doctest_by_default instead.
• PlatformSpec::current, deprecated since 0.17.13. Use
  PlatformSpec::build_target instead.
• The hidden re-export of the debug_ignore crate at the root of guppy.
  Depend on debug-ignore directly if
  you need it.

Fixed

• FeatureSet::union, intersection, difference and symmetric_difference
  now panic, as documented, if the two sets were built from different package
  graphs (#​608). Previously the check compared self's graph against itself
  and could never fire, so mismatched sets silently produced an invalid result.
  (The corresponding PackageSet operations already checked this correctly.)
• With the summaries feature, rebuilding Cargo set inputs from a summary no
  longer silently drops the features-only set (#​625).

v0.17.26: guppy 0.17.26

Compare Source

Fixed

A node with a self-loop edge -- typically a package with a path
dev-dependency on its own crate, or a feature node like base/[base]
arising from one -- was treated inconsistently by several APIs. The root
cause was that self-edges were counted as incoming edges in the SCC and
topological-sort machinery, which transitively confused everything built
on top:

• Sccs::externals / forward roots. Previously, a package whose only
  incoming edge was its own self-loop was excluded from the set of forward
  roots, so callers iterating over
  query_workspace().resolve().root_ids(_) did not see it, and forward
  link enumeration on it was broken. Now, self-loop edges no longer
  disqualify a node from being a forward root: a single-node SCC is
  external iff it has no incoming edges from outside its own SCC.
  (#​586)
• Topological sort. Previously, TopoWithCycles::new filtered
  self-looping nodes out of its root set for the same reason, dropping
  them from the DFS and then placing them and their descendants at the
  end of the topological order via a best-effort fallback. Now, the
  root-set predicate accepts a node whose only incoming edge is its own
  self-loop, so such nodes are visited in DFS order alongside other
  roots. (#​589)
• Cycles::is_cyclic and feature::Cycles::is_cyclic. Previously,
  these were reflexively true for every package or feature, regardless
  of actual cycle membership. Now, they return true only when the
  argument lies on a directed cycle: either in a multi-node SCC, or in a
  single-node SCC with a self-loop edge. This is a behavior change, but
  in the context of the rest of this release is being treated as a
  bugfix. (#​590)
• Cycles::all_cycles and feature::Cycles::all_cycles. Previously,
  these reported only SCCs of two or more elements. Now, they also yield
  single-node SCCs whose node has a self-loop edge, in topological order
  alongside multi-node SCCs. This makes all_cycles() and
  is_cyclic(x, x) agree on what counts as a cycle. (#​590)
• FeatureGraphWarning::SelfLoop. Previously, this warning was
  emitted for every self-loop edge in the feature graph, including
  legitimate ones such as a path dev-dependency on the package's own
  crate. Now, it is restricted to named-feature self-loops like
  [features] a = ["a"], which really are user errors. (#​592)

Documentation

• PackageGraph::directly_depends_on and
  FeatureGraph::directly_depends_on. Previously, both documented
  themselves as returning false when the two IDs were equal. The
  implementation has always called dep_graph.contains_edge(a, b),
  which correctly returns true for self-loop edges, so the
  documentation contradicted the behavior. The documentation has now
  been corrected to match.
• FeatureGraph::directly_depends_on. Previously, the docstring
  read "returns true if feature_a is a direct dependency of
  feature_b," with the operands inverted relative to the actual
  implementation. Now the docstring reflects the implementation:
  returns true if feature_b is a direct dependency of feature_a.
  (#​591)
• [Cycles] type-level documentation. Previously, the long-form
  documentation talked exclusively about multi-node cycles (like
  serde and serde_derive). It now also acknowledges single-node
  self-loop cycles as a case.

v0.17.25: guppy 0.17.25

Compare Source

Added

Cargo metadata generated on Windows is now parseable on Unix. Windows paths are always normalized to forward slashes on Unix, which allows operations like .parent() to work. (Cross-platform parsing is not fully tested yet so you might run into issues. Please file a bug if you do.)

v0.17.24: guppy 0.17.24

Compare Source

Added

• Workspace::build_directory() returns the build directory for intermediate build artifacts (requires Cargo 1.91+).
• Workspace::default_members() and Workspace::default_member_ids() iterate over workspace default members (requires Cargo 1.71+; returns empty iterator for older Cargo versions).
• PackageLink::registry() returns the registry URL for a dependency, if it uses a non-default registry.
• PackageLink::path() returns the file system path for path dependencies.

v0.17.23: guppy 0.17.23

Compare Source

Changed

• Internal dependency update: cargo_metadata updated to 0.23.0.

v0.17.22: guppy 0.17.22

Compare Source

Fixed

Replaced obsolete doc_auto_cfg with doc_cfg, to fix Rust nightly builds with the doc_cfg flag enabled.

v0.17.21: guppy 0.17.21

Compare Source

Changed

• Internal dependency update: cargo_metadata updated to 0.22.0.

v0.17.20: guppy 0.17.20

Compare Source

Changed

• Internal dependency update: cargo_metadata updated to 0.21.0.
  • As part of this update, restored compatibility with the unstable bindeps feature -- see this commit.
• MSRV updated to Rust 1.86, as required by dependencies.

v0.17.19: guppy 0.17.19

Compare Source

Changed

• Internal dependency update: cargo_metadata updated to 0.20.0.
• Some older versions of Cargo, when the unstable bindeps feature is enabled, generate JSON output that is no longer supported by cargo_metadata. If you run into an error, please update your nightly toolchain. Nightly versions from at least 2024-07 do not appear to produce invalid metadata.
• MSRV updated to Rust 1.82.

v0.17.18: guppy 0.17.18

Compare Source

Added

• CargoSet::with_package_resolver supports passing in a PackageResolver for additional dynamic filtering of dependency edges.
• CargoSet::target_links and host_links return the set of PackageLink instances followed on the target and host platforms, respectively.

Thanks to anforowicz for these contributions!

v0.17.17: guppy 0.17.17

Compare Source

Added

• Add PlatformEval::target_specs to obtain the list of TargetSpec instances backing a platform evaluator. Thanks to anforowicz for the contribution!

v0.17.16: guppy 0.17.16

Compare Source

Added

• BuildTarget::test_by_default returns true if tests are run for a build target by default.
• BuildTarget::doc_by_default returns true if documentation is enabled for a build target, respectively.

Changed

• BuildTarget::doc_tests is now BuildTarget::doctest_by_default. The old name has been deprecated, but is kept around for compatibility.

v0.17.15: guppy 0.17.15

Compare Source

Added

• BuildTarget::tests_enabled and BuildTarget::docs_enabled return true if tests and documentation is enabled for a build target, respectively.

Changed

• BuildTarget::doc_tests is now BuildTarget::doc_tests_enabled. The old name has been deprecated, but is kept around for compatibility.

v0.17.14: guppy 0.17.14

Compare Source

Added

• MetadataCommand::env adds environment variables to the cargo metadata command.

  Thanks to anforowicz for your first contribution!

v0.17.13: guppy 0.17.13

Compare Source

Changed

• Renamed PlatformSpec::current to PlatformSpec::build_target to indicate that it is determined at build time, not at runtime. The old method is still available but has been marked deprecated.

v0.17.12: guppy 0.17.12

Compare Source

Added

Added support for custom sparse registries (sparse+https://...). Thanks to jonhoo for your first contribution!

v0.17.11: guppy 0.17.11

Compare Source

Added

Added support for the upcoming Cargo resolver version
3:
within guppy, CargoResolverVersion::V3. Resolver version 3 enables MSRV-aware
version resolution in Cargo.

The portion of dependency resolution that guppy works with (package and feature
resolution) happens after dependency versions have been resolved and
Cargo.lock is refreshed. This means that from guppy's perspective, resolver
version 3 is the same as version 2, and CargoResolverVersion::V3 acts as an
alias for CargoResolverVersion::V2.

v0.17.10: guppy 0.17.10

Compare Source

Changed

• Internal dependency update: cargo_metadata updated to 0.19.1.
• MSRV updated to Rust 1.78.

v0.17.9: guppy 0.17.9

Compare Source

Fixed

• Graphs can now be generated even if the workspace Cargo.toml is within a subdirectory of one
  of its members. (This is an uncommon situation, but one that is supported by Cargo.)

Changed

• Internal dependency update: cargo_metadata updated to 0.19.0.

v0.17.8: guppy 0.17.8

Compare Source

Fixed

• Fixed a case of dependency matching with renamed packages (#​317).

Changed

• Update target-spec to 3.2.2.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.