Discussion: Allowing Unsafe to Bypass Visibility

Making [patch] dependencies easier to maintain could indeed be a solution.

In Node, Yarn has a nice feature called yarn patch. It extracts a copy of the dependency that you can edit freely. When you're done editing it, it computes a diff and attaches it to your project. When someone else clones your project and installs the dependencies, the patches are automatically applied. (It's obviously local and only affects the project with the patches). Instead of forking a whole repo, this let's you maintain only a tiny diff. And since it's handled by the package manager, the intention is clear and it does not mess with encapsulation.

An example where it could have been useful is with the time crate breakage. If stuck on the old version for some reason, you could instruct cargo to apply a patch at install time instead of replacing the whole crate.

9 Likes