`cargo search` returns prerelease versions

tools and infrastructure cargo
1

The output of cargo search currently returns prerelease versions, for example:

$ cargo search rand
rand = "0.9.0-alpha.2"      # Random number generators and other randomness functionality. 
...

On the other hand, crates.io shows 0.8.5 as the current version, since that's the latest stable release.

This does not seem like it should be the default behavior of cargo search.

I've looked into what would be required to change this:

  • The registry API does return a field max_stable_version, which could be used. For some reason, it is not documented, but gets returned e.g. with:

    curl "https://crates.io/api/v1/crates?q=rand" | jq

  • In their simplest form, the code changes required affect just two lines of production code, which need to be changed from max_version to max_stable_version, and a couple unit tests that need to be adjusted accordingly.

  • Theoretically, someone might depend on prerelease versions being returned by cargo search, so maybe should be mentioned in the changelog.

Thoughts on this?
I might be able to contribute a PR.

1 Like
2

There is a difference between the official registry API specification and what extensions registries, like crates.io, make. So this isn't just a two line change but Cargo adding more requirements to what a registry is expected to do. There are things to do, like considering the field to be optional, but I hope its clear this is more than just a two line change.

3

Makes sense. I've done a bit of brainstorming for alternative solutions:

  1. Make max_stable_version an optional field in the registry API, falling back to max_version otherwise.

    • The field being optional is reasonable, since crates may not have any stable releases.
    • Would work with current crates.io API.
    • No breaking API change necessary, but should document this field being used.

  2. Introduce (or wait for) a v2 of the registry API.

    • Might allow for more distinct naming, e.g. max_stable_version and max_prerelease_version.

  3. Change API of crates.io by populating max_version with the latest stable version instead.

    • Since the search API only provides one version field, the stable version makes sense for most use-cases.
    • Would need to introduce a new field max_prerelease_version with the latest prerelease version.
      Alternatively, crates.io already populates a field newest_version with what appear to be prerelease versions.

  4. Make use of the registry index, like cargo add does.

    • Would need to download the index before searching.
    • Would not help outside consumers of the search API, as they'd need code to parse the index.
1 Like