proper way to resolve dependency version conflicts of rust crates?

[Wilko Meyer <w@wmeyer.eu>]

Hi Guix,

What's the right way to resolve version dependency conflicts for rust
crates that (in semver notation) depend on the same dependency
MAJOR.MINOR version but want a different PATCH version (e.g. 0.13.1 and
0.13.2)?

As far as I'm aware for rust crates we keep:

- all 0.MINOR versions, e.g. rust-foo-0.1,rust-foo-0.42 etc.
- as soon as a crate hits v1 we keep one package per major version >1
- (e.g. rust-foo-1, rust-foo-2).

So building packages that depend on a different PATCH-Version may under
some circumstances fail with a error similar to:

#+BEGIN_SRC
error: failed to select a version for the requirement `hashbrown = "=0.13.1"`
candidate versions found which didn't match: 0.14.3, 0.13.2, 0.12.3, ...
...
perhaps a crate was updated and forgotten to be re-vendored?
#+END_SRC

Right now I see three possible solutions to this:

1. Sent a patch to the upstream of the crate as well as to guix updating
  all crate dependencies to most-recent.
2. Define a package variant of said dependency, let's say foo-0.13-1 for
  v0.13.1 of foo.
3. Substitute the required version in Cargo.toml of a affected crate to
  match the package-version of said dependency we've packaged in Guix.

If I had to guess 3. would be the most appropriate way forward on this?

-- 
Kind regards,

Wilko Meyer
w@wmeyer.eu