How do I fix mismatching dependencies in my Cargo

Question

I'm setting up a Rust server with Rocket and I'm trying to use it with a JWT library. They use different versions of the *ring* crate and I get an error during cargo build:

error: multiple packages link to native library `ring-asm`, but a native library can be linked only once

package `ring v0.12.1`
    ... which is depended on by `jsonwebtoken v4.0.1`
    ... which is depended on by `auther v0.1.0 (file:///home/drpytho/x/downloadble/auther)`
links to native library `ring-asm`

package `ring v0.11.0`
    ... which is depended on by `cookie v0.9.2`
    ... which is depended on by `rocket v0.3.6`
    ... which is depended on by `rocket_codegen v0.3.6`
    ... which is depended on by `auther v0.1.0 (file:///home/drpytho/x/downloadble/auther)`
also links to native library `ring-asm`

My Cargo.toml

[package]
name = "auther"
version = "0.1.0"
authors = ["Name <[e-mail]>"]

[dependencies]
rocket = "0.3.6"
rocket_codegen = "0.3.6"
jsonwebtoken = "4"
serde_derive = "1"
serde = "1"

I read that you are supposed to fix the mismatching dependencies in your Cargo file, but I can't figure out how to do it.

Answer 1

You have to fix this by not transitively depending on different versions of crates that link to a native library.

There's no newer version of rocket available that depends on version 0.10 of cookie, which depends on ring 0.12, so you'll need to downgrade jsonwebtoken to 2.0.3.

You can work this out by checking the crates.io pages for the crates in question (like with jsonwebtoken), going back through older versions, and looking to see what dependencies it needs.