Set specific version of the dependency of a projec

Question

Let's say my project A depends on library B that depends on library C.

Library B sets the dependency version to "*" (any) so cargo will download the latest version of C.

How can I instruct cargo to build library B to using a specific version of library C?

---

Currently I'm trying to build iron.

The current build is failing, but I can see the last successful build in https://travis-ci.org/iron/iron/builds/45254195, including rust version and cargo package versions.

So I downloaded the specific rust nightly used in the build, and I've set the the direct dependencies of iron to the ones used in that build, by editing Cargo.toml:

(...)
[dependencies]
hyper = "0.0.18"
typemap = "0.0.5"
url = "0.2.9"
(...)

But rust-serialized, which is a dependency of the "url" and "time" packages is downloaded in the latest version which doesn't compile with my specific rust version.

If I used the version used in the Travis build above I'm sure it will compile successfully.

Answer 1

Current idea

I think you are going to have to check out Iron, modify Cargo.toml to specify versions (as you have already done). Then you need to repeat the process, checking out url, modify its Cargo.toml, then make sure you are using your version of url in Iron's Cargo.toml. Rinse and repeat. This all sounds terrible :-(

First idea

From the Cargo docs:

Similar to before, let’s say you’re working on a project, uuid, which depends on rand. This time you're the one who finds a bug in rand, and you want to write a patch and be able to test out your patch by using your version of rand in uuid.

A path override is communicated to Cargo through the .cargo/config configuration mechanism. If Cargo finds this configuration when building your package, it will use the override on your local machine instead of the source specified in your Cargo.toml.

Inside that file, put this:

paths = ["/path/to/project/rand"]

Second idea

Note This probably won't work. A thing someone told me when I was first starting Rust is that you can have multiple versions of the same library compiled into one binary. That would mean that there's no one place you can specify a version that applies all over, like you could with a Gemfile.

You might be able to simply specify versions (or SHA hashes?) for each dependency that you know works with your Rust version. Cargo should be able to resolve the transitive dependencies and simply lock you to a previous version (if there is one that fits all the requirements).