# Warning: dependencies!

**URL:** <https://internals.rust-lang.org/t/warning-dependencies/13077>\
**Category:** language design\
**Created:** [September 16, 2020, 10:21am UTC](https://internals.rust-lang.org/t/warning-dependencies/13077 "2020-09-16T10:21:13Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![gilescope](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/gilescope/32/2798_2.png) [@gilescope](https://internals.rust-lang.org/u/gilescope)\
**Post date:** [September 16, 2020, 10:21am UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/1 "2020-09-16T10:21:13Z")

</div>

We currently hide all the warnings that the dependent crates have. If you cargo build -vvv you can see them all in glorious technicolour.

One way to nudge people into thinking more about their dependencies might be to output a count as standard of how many compiler warnings there are in your dependencies.

pinned dependencies will get older and as you upgrade your rustc version (which people invariably do do), that count of warnings would increase reminding them that maybe they should cargo update.

To me this all feels win win and we would trend to an ecosystem with less warnings in over time.

Thoughts?

---

<div class="post-metadata">

**Author:** ![scottmcm](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/scottmcm/32/2355_2.png) [@scottmcm](https://internals.rust-lang.org/u/scottmcm)\
**Post date:** [September 16, 2020, 6:41pm UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/2 "2020-09-16T18:41:11Z")

</div>

Maybe it could make sense to be level-sensitive for this? A crate with an intentionally-low MSRV may get warnings on newer compilers that are fully expected and not an issue. But if there's anything severe enough that it's actually deny-by-default in rustc, then maybe it'd be worth a warning in the cargo output...

---

<div class="post-metadata">

**Author:** ![jhpratt](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/jhpratt/32/11640_2.png) [@jhpratt](https://internals.rust-lang.org/u/jhpratt)\
**Post date:** [September 16, 2020, 8:49pm UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/3 "2020-09-16T20:49:55Z")

</div>

If this is the case, whose lint settings do we take? The crate, the end user, or the defaults?

I typically have very strict linting on code that I write, but certainly don't want to force it on anyone that just happens to use my code. Some warnings happen solely because of compiler upgrades and changes in clippy, but nothing is actually different about the code itself.

---

<div class="post-metadata">

**Author:** ![bill\_myers](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/bill_myers/32/4085_2.png) [@bill\_myers](https://internals.rust-lang.org/u/bill_myers)\
**Post date:** [September 18, 2020, 2:21pm UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/4 "2020-09-18T14:21:28Z")

</div>

Maybe just output it per-crate, so you know what the poorly-maintained crates are?

With output like this:

```rust
Compiling foo...<pause> done with 37 warnings.
Compiling bar...<pause> done.
Compiling bar...

```

---

<div class="post-metadata">

**Author:** ![tesuji](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/tesuji/32/12790_2.png) [@tesuji](https://internals.rust-lang.org/u/tesuji)\
**Post date:** [September 18, 2020, 3:08pm UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/5 "2020-09-18T15:08:44Z")

</div>

Sounds like what node already does. And I like it.

---

<div class="post-metadata">

**Author:** ![withoutboats](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/withoutboats/32/4560_2.png) [@withoutboats](https://internals.rust-lang.org/u/withoutboats)\
**Post date:** [September 18, 2020, 3:32pm UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/6 "2020-09-18T15:32:20Z")

</div>

I'd rather not show users this information by default (when they specifically request it, sure), because its often very inactionable. I worry about a situation of information overload in which more actionable information gets lost in a sea of warnings the users are not well positioned to react to.

---

<div class="post-metadata">

**Author:** ![scottmcm](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/scottmcm/32/2355_2.png) [@scottmcm](https://internals.rust-lang.org/u/scottmcm)\
**Post date:** [September 18, 2020, 7:55pm UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/7 "2020-09-18T19:55:16Z")

</div>

> [@withoutboats](#):
>
> often very inactionable

That's a good point. There's not even an obvious place to put a "yes, I've looked at those and don't mind" marker.

---

<div class="post-metadata">

**Author:** ![RalfJung](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/ralfjung/32/2415_2.png) [@RalfJung](https://internals.rust-lang.org/u/RalfJung)\
**Post date:** [September 19, 2020, 8:16am UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/8 "2020-09-19T08:16:15Z")

</div>

AFAIK there are also plans to show future incompatibility warnings of dependencies, as those indicate that the dependency might stop working in the future:

> <https://github.com/rust-lang/rust/issues/71249>
>
> This is a tracking issue for the RFC "Cargo report future-incompat" (rust-lang/rfcs#2834).
> There is no feature gate for the issue (the changes...

---

<div class="post-metadata">

**Author:** ![gilescope](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/gilescope/32/2798_2.png) [@gilescope](https://internals.rust-lang.org/u/gilescope)\
**Post date:** [September 19, 2020, 9:36am UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/9 "2020-09-19T09:36:11Z")

</div>

The status-quo is that I am blissfully unaware that any of my dependenices have warnings. (I do like the idea of being able to filter the warnings based off a MSRV - that seems a helpful feature that could stand on its own two feet.)

We have other outlets for showing warning counts maybe - I guess we can't include them in rust doc as it doesn't really do a compile? If the info was at [crates.io](http://crates.io) it would be actionable info - but I can see that's fraught with difficulties.

Maybe throw it in with -Z timeings or cargo tree if we don't want to show it by default? Idk, but at the moment the info seems pretty hidden.

---

<div class="post-metadata">

**Author:** ![system](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/system/32/14092_2.png) [@system](https://internals.rust-lang.org/u/system)\
**Post date:** [December 18, 2020, 9:36am UTC](https://internals.rust-lang.org/t/warning-dependencies/13077/10 "2020-12-18T09:36:25Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.
