guppy

Fixed

A node with a self-loop edge -- typically a package with a path
dev-dependency on its own crate, or a feature node like base/[base]
arising from one -- was treated inconsistently by several APIs. The root
cause was that self-edges were counted as incoming edges in the SCC and
topological-sort machinery, which transitively confused everything built
on top:

• Sccs::externals / forward roots. Previously, a package whose only
  incoming edge was its own self-loop was excluded from the set of forward
  roots, so callers iterating over
  query_workspace().resolve().root_ids(_) did not see it, and forward
  link enumeration on it was broken. Now, self-loop edges no longer
  disqualify a node from being a forward root: a single-node SCC is
  external iff it has no incoming edges from outside its own SCC.
  (#586)
• Topological sort. Previously, TopoWithCycles::new filtered
  self-looping nodes out of its root set for the same reason, dropping
  them from the DFS and then placing them and their descendants at the
  end of the topological order via a best-effort fallback. Now, the
  root-set predicate accepts a node whose only incoming edge is its own
  self-loop, so such nodes are visited in DFS order alongside other
  roots. (#589)
• Cycles::is_cyclic and feature::Cycles::is_cyclic. Previously,
  these were reflexively true for every package or feature, regardless
  of actual cycle membership. Now, they return true only when the
  argument lies on a directed cycle: either in a multi-node SCC, or in a
  single-node SCC with a self-loop edge. This is a behavior change, but
  in the context of the rest of this release is being treated as a
  bugfix. (#590)
• Cycles::all_cycles and feature::Cycles::all_cycles. Previously,
  these reported only SCCs of two or more elements. Now, they also yield
  single-node SCCs whose node has a self-loop edge, in topological order
  alongside multi-node SCCs. This makes all_cycles() and
  is_cyclic(x, x) agree on what counts as a cycle. (#590)
• FeatureGraphWarning::SelfLoop. Previously, this warning was
  emitted for every self-loop edge in the feature graph, including
  legitimate ones such as a path dev-dependency on the package's own
  crate. Now, it is restricted to named-feature self-loops like
  [features] a = ["a"], which really are user errors. (#592)

Documentation

• PackageGraph::directly_depends_on and
  FeatureGraph::directly_depends_on. Previously, both documented
  themselves as returning false when the two IDs were equal. The
  implementation has always called dep_graph.contains_edge(a, b),
  which correctly returns true for self-loop edges, so the
  documentation contradicted the behavior. The documentation has now
  been corrected to match.
• FeatureGraph::directly_depends_on. Previously, the docstring
  read "returns true if feature_a is a direct dependency of
  feature_b," with the operands inverted relative to the actual
  implementation. Now the docstring reflects the implementation:
  returns true if feature_b is a direct dependency of feature_a.
  (#591)
• [Cycles] type-level documentation. Previously, the long-form
  documentation talked exclusively about multi-node cycles (like
  serde and serde_derive). It now also acknowledges single-node
  self-loop cycles as a case.

Fixed

A node with a self-loop edge -- typically a package with a path dev-dependency on its own crate, or a feature node like base/[base] arising from one -- was treated inconsistently by several APIs. The root cause was that self-edges were counted as incoming edges in the SCC and topological-sort machinery, which transitively confused everything built on top:

• Sccs::externals / forward roots. Previously, a package whose only incoming edge was its own self-loop was excluded from the set of forward roots, so callers iterating over query_workspace().resolve().root_ids(_) did not see it, and forward link enumeration on it was broken. Now, self-loop edges no longer disqualify a node from being a forward root: a single-node SCC is external iff it has no incoming edges from outside its own SCC. (#586)
• Topological sort. Previously, TopoWithCycles::new filtered self-looping nodes out of its root set for the same reason, dropping them from the DFS and then placing them and their descendants at the end of the topological order via a best-effort fallback. Now, the root-set predicate accepts a node whose only incoming edge is its own self-loop, so such nodes are visited in DFS order alongside other roots. (#589)
• Cycles::is_cyclic and feature::Cycles::is_cyclic. Previously, these were reflexively true for every package or feature, regardless of actual cycle membership. Now, they return true only when the argument lies on a directed cycle: either in a multi-node SCC, or in a single-node SCC with a self-loop edge. This is a behavior change, but in the context of the rest of this release is being treated as a bugfix. (#590)
• Cycles::all_cycles and feature::Cycles::all_cycles. Previously, these reported only SCCs of two or more elements. Now, they also yield single-node SCCs whose node has a self-loop edge, in topological order alongside multi-node SCCs. This makes all_cycles() and is_cyclic(x, x) agree on what counts as a cycle. (#590)
• FeatureGraphWarning::SelfLoop. Previously, this warning was emitted for every self-loop edge in the feature graph, including legitimate ones such as a path dev-dependency on the package's own crate. Now, it is restricted to named-feature self-loops like [features] a = ["a"], which really are user errors. (#592)

Documentation

• PackageGraph::directly_depends_on and FeatureGraph::directly_depends_on. Previously, both documented themselves as returning false when the two IDs were equal. The implementation has always called dep_graph.contains_edge(a, b), which correctly returns true for self-loop edges, so the documentation contradicted the behavior. The documentation has now been corrected to match.
• FeatureGraph::directly_depends_on. Previously, the docstring read "returns true if feature_a is a direct dependency of feature_b," with the operands inverted relative to the actual implementation. Now the docstring reflects the implementation: returns true if feature_b is a direct dependency of feature_a. (#591)
• [Cycles] type-level documentation. Previously, the long-form documentation talked exclusively about multi-node cycles (like serde and serde_derive). It now also acknowledges single-node self-loop cycles as a case.

Added

Cargo metadata generated on Windows is now parseable on Unix. Windows paths are always normalized to forward slashes on Unix, which allows operations like .parent() to work. (Cross-platform parsing is not fully tested yet so you might run into issues. Please file a bug if you do.)

Added

Cargo metadata generated on Windows is now parseable on Unix. Windows paths are always normalized to forward slashes on Unix, which allows operations like .parent() to work. (Cross-platform parsing is not fully tested yet so you might run into issues. Please file a bug if you do.)

Added

• Workspace::build_directory() returns the build directory for intermediate build artifacts (requires Cargo 1.91+).
• Workspace::default_members() and Workspace::default_member_ids() iterate over workspace default members (requires Cargo 1.71+; returns empty iterator for older Cargo versions).
• PackageLink::registry() returns the registry URL for a dependency, if it uses a non-default registry.
• PackageLink::path() returns the file system path for path dependencies.

Changed

• Internal dependency update: cargo_metadata updated to 0.23.0.

Fixed

Replaced obsolete doc_auto_cfg with doc_cfg, to fix Rust nightly builds with the doc_cfg flag enabled.

Changed

• Internal dependency update: cargo_metadata updated to 0.22.0.

Changed

• Internal dependency update: cargo_metadata updated to 0.21.0.
  • As part of this update, restored compatibility with the unstable bindeps feature -- see this commit.
• MSRV updated to Rust 1.86, as required by dependencies.

Changed

• Internal dependency update: cargo_metadata updated to 0.20.0.
• Some older versions of Cargo, when the unstable bindeps feature is enabled, generate JSON output that is no longer supported by cargo_metadata. If you run into an error, please update your nightly toolchain. Nightly versions from at least 2024-07 do not appear to produce invalid metadata.
• MSRV updated to Rust 1.82.

Added

• CargoSet::with_package_resolver supports passing in a PackageResolver for additional dynamic filtering of dependency edges.
• CargoSet::target_links and host_links return the set of PackageLink instances followed on the target and host platforms, respectively.

Thanks to anforowicz for these contributions!

Added

• Add PlatformEval::target_specs to obtain the list of TargetSpec instances backing a platform evaluator. Thanks to anforowicz for the contribution!

Added

• BuildTarget::test_by_default returns true if tests are run for a build target by default.
• BuildTarget::doc_by_default returns true if documentation is enabled for a build target, respectively.

Changed

• BuildTarget::doc_tests is now BuildTarget::doctest_by_default. The old name has been deprecated, but is kept around for compatibility.

(This version was yanked due to incorrect documentation.)

Added

• MetadataCommand::env adds environment variables to the cargo metadata command.

  Thanks to anforowicz for your first contribution!

Changed

• Renamed PlatformSpec::current to PlatformSpec::build_target to indicate that it is determined at build time, not at runtime. The old method is still available but has been marked deprecated.

Added

Added support for custom sparse registries (sparse+https://...). Thanks to jonhoo for your first contribution!

Added

Added support for the upcoming Cargo resolver version 3: within guppy, CargoResolverVersion::V3. Resolver version 3 enables MSRV-aware version resolution in Cargo.

The portion of dependency resolution that guppy works with (package and feature resolution) happens after dependency versions have been resolved and Cargo.lock is refreshed. This means that from guppy's perspective, resolver version 3 is the same as version 2, and CargoResolverVersion::V3 acts as an alias for CargoResolverVersion::V2.

Changed

• Internal dependency update: cargo_metadata updated to 0.19.1.
• MSRV updated to Rust 1.82.

Fixed

• Graphs can now be generated even if the workspace Cargo.toml is within a subdirectory of one of its members. (This is an uncommon situation, but one that is supported by Cargo.)

Changed

• Internal dependency update: cargo_metadata updated to 0.19.0.

Fixed

• Fixed a case of dependency matching with renamed packages (#317).

Changed

• Update target-spec to 3.2.2.

Changed

• Update target-spec to 3.2.1.

Changed

• MSRV updated to Rust 1.75.

Fixed

• Fixed feature graph construction accidentally inserting self-loops in some cases (#292). This was causing cargo-hakari to crash in some workspaces.
• Fixed a small bug in Cargo resolution where packages were incorrectly being marked as activated on the host platform (8666ebc).

Changed

• The Debug impl for FeatureSet is now more useful. (PRs welcome to make the Debug impls for types like PackageSet more useful as well.)
• MSRV updated to Rust 1.73.

Fixed

• Cargo build simulations now consider dev-dependencies of proc-macro crates. Previously, we weren't doing so.

Fixed

• Attempted to address PackageGraph creation with artifact dependencies as supported by nightly Rust (#174). Note that this is not a complete fix, as documented at #174.

Fixed

• Fixed a PackageGraph creation edge case (#158).

Fixed

• Improve PackageGraph creation algorithm to address issues like nextest-rs/nextest#1090.

Changed

• MSRV updated to Rust 1.70.

Added

• PackageMetadata::minimum_rust_version provides the rust-version field of a package as a Version.
• PackageMetadata::rust_version has been deprecated because it returns a VersionReq even though it actually should be a Version. In the next major release of guppy, the current definition of rust_version will go away and be replaced with minimum_rust_version.

Changed

• target-spec updated to version 3.

Fixed

• Proptest strategy creator names updated from prop010_ to proptest1_.

Changed

• target-spec updated to version 2.
• MSRV updated to Rust 1.66.

Added

• PackageMetadata::to_feature_set converts a single package to a FeatureSet.

Changed

• MSRV updated to Rust 1.62.

Added

• Detailed documentation about dependency cycles in Cargo, as part of the Cycles struct. Thanks Aria for writing it!

Changed

• guppy::Error::UnknownRegistryName now boxes the internal summary and is smaller as a result.

Changed

• Internal dependency update: cargo_metadata updated to 0.15.1.

Changed

• Repository location update.
• MSRV updated to Rust 1.58.

Thanks to Carol Nichols for her contributions to this release!

Fixed

• On Windows, guppy now behaves correctly when a path dependency is on a different drive from the workspace (#642).

Changed

• Internal dependency updates.

Added

• Workspace::target_directory returns the target directory provided in the Cargo metadata.
• Workspace::metadata_table returns the freeform workspace.metadata table.

Added

Support for weak dependencies and namespaced features:

• Cargo build simulations now take into account weak dependencies and namespaced features.
• Optional dependencies ("dep:foo") and namespaced features ("foo") are now represented as separate nodes in a FeatureGraph, even with Rust versions prior to 1.60.
• Feature names are now represented as a new FeatureLabel enum.

Changed

• MSRV updated to Rust 1.56.

Added

• doc_cfg-based feature labels to rustdoc.
• MetadataCommand::cargo_command returns the underlying std::process::Command instance.

Changed

• guppy::graph::feature::CrossLink renamed to ConditionalLink, and now covers some same-package features. For more, see the documentation for ConditionalLink.
• Public dependency bump: target-spec updated to version 1.

Fixed

• A small fix to Cargo build simulations (#596).

Added

• PackageMetadata::homepage, documentation and default_run, exposed by newer versions of Cargo.

Added

• guppy now supports a "light" mode if --no-deps is passed in. This mode doesn't provide any information about third-party packages or dependency edges, but is much faster if the only information needed is workspace lookups.

• Reverted change in 0.12.3 because of #524.

• Internal dependency guppy-workspace-hack updated to workspace-hack.

Added

• PackageMetadata::link_between, link_from and link_to look up a direct link from one package to another.

Changed

• The toml crate is now built with the preserve_order feature.
  • This feature ensures that the key ordering in metadata is preserved.

This is a minor breaking change that should not affect most consumers.

Fixed

• Summaries generated by old versions of guppy can now be parsed by this version, even if the metadata is in a different format.

Changed

• Relative paths are now stored and presented with forward slashes on all platforms, including Windows.
• guppy-summaries updated to 0.6.0.

Added

• PackageMetadata::rust_version returns the package.rust-version field, if specified. Thanks @foresterre!

Added

• Rudimentary support for alternate registries. This is a temporary workaround until Cargo issue #9052 is resolved.
  • This is currently only hooked up to hakari.

Added

• A new abstraction PlatformSpec can represent the union of all platforms, the intersection of all platforms, or a single platform.
  • Methods like EnabledStatus::required_on and EnabledStatus::enabled_on have been switched to accepting a &PlatformSpec rather than a &Platform.
  • CargoOptions::set_platform and related methods now accept either a Platform or a PlatformSpec.
  • EnabledStatus::enabled_on_any is now EnabledStatus::enabled_on(&PlatformSpec::Any).
• Omitted packages are now easier to describe while deserializing: they now take a workspace-members list of names, and a third-party list of specifiers such as { name = "serde", version = "1" }.
  • The resolver will now also fail if any specifiers are unmatched.

Changed

• Platform-related types have been moved into the new platform module at the top level.
• In Cargo options summaries, version = "v1" and version = "v2" have been renamed to resolver = "1" and resolver = "2" respectively, to align with Cargo.
  • The old specifiers will continue to work.
• Because of the changes to how omitted packages are represented, old-style CargoOptionsSummary instances may no longer parse correctly.
• MSRV updated to Rust 1.53.

(This release was incorrectly made and was yanked.)

Changed

• Public dependency version bumps:
  • target-spec updated to 0.8.0.
    • As a result, Platform no longer has a lifetime parameter.
  • guppy-summaries updated to 0.5.0.
  • semver updated to 1.0.
• MSRV updated to Rust 1.51.

(This release was yanked because guppy-summaries needed to be upgraded as well.)

Added

• DependencyKind::VALUES lists out all the values of DependencyKind.
• DependencyReq::no_default_features() returns the enabled status for a dependency when default-features = false.

Changed

• PackageMetadata::publish now returns a new, more descriptive PackagePublish enum (#320).
• PackageMetadata::readme now returns &Utf8Path rather than &Path.
• BuildTarget::path now returns &Utf8Path rather than &Path.

Changed

• guppy now uses camino Utf8Path and Utf8PathBuf wrappers. These wrappers provide type-level assertions that returned paths are valid UTF-8.
• Public dependency version bumps:
  • proptest updated to version 1 and the corresponding feature renamed to proptest1.

Fixed

• Restored compatibility with Rust 1.48. (1.48 is the MSRV, and is now tested in CI.)

Changed

• Packages within a cycle are now returned in non-dev order. When the direction is forward, if package Foo has a dependency on Bar, and Bar has a cyclic dev-dependency on Foo, then Foo is returned before Bar. (This is not a breaking change because it is an additional constraint on guppy itself, not on its consumers.)

Added

• PackageSource now has support for parsing external sources through a new parse_external method.
• Cargo simulations have some new features:
  • New CargoOptions::set_initials_platform method can be used to simulate builds on exclusively the host platform.
  • CargoSet::new accepts an additional argument, features_only, which represents additional inputs that are only used for feature unification. This may be used to simulate, e.g. cargo build --package foo --package bar, when you only care about the results of foo but specifying bar influences the build.
  • New enum graph::cargo::BuildPlatform represents either the target platform or the host. New methods CargoSet::platform_features and CargoSet::platform_direct_deps accept the BuildPlatform enum.
• FeatureSet::contains_package returns true if a feature set has at least one feature in the given package.
• semver::VersionReq is now exposed in guppy.
• FeatureGraph::resolve_ids resolves feature IDs into a FeatureSet.

Changed

• Feature filters all_filter, default_filter and none_filter have been combined into a single enum StandardFeatures.
• Cargo builds are now done through FeatureSet instances, not FeatureQuery. This is because Cargo builds always happen in the forward direction.
  • FeatureQuery::resolve_cargo has been renamed to FeatureSet::into_cargo_set.
• CargoOptions::with_ methods have been renamed to begin with either set_ or add_.
• Obs is now a type rather than a trait.
• CargoOptions::set_proc_macros_on_target was replaced with InitialsPlatform::ProcMacrosOnTarget.
• Public dependency version bumps:
  • semver updated to 0.11.
  • target-spec updated to 0.6.

Fixed

• Fix an unintentional use of serde's private exports.

Fixed

• FeatureGraph::is_default_feature no longer follows cross-package links.

  Cyclic dev-dependencies can enable non-default features (such as testing-only features), and previously is_default_feature would have returned true for such features. With this change, is_default_feature returns false for such features.

  The default_filter feature filter, which uses is_default_feature, has been fixed as well.

This includes all the changes from version 0.6.0, plus a minor fix:

Fixed

• Removed "Usage" section from the README, the version number there keeps falling out of sync.

This includes the changes in version 0.5.0-rc.1, plus:

Added

• Support for writing out build summaries for CargoSet instances through the optional summaries feature.

Changed

• target-spec has been upgraded to 0.4.

Fixed

• MetadataCommand::exec and build_graph are now &self, not &mut self.

Added

• PackageGraph::query_workspace_paths and resolve_workspace_paths provide convenient ways to create queries and package sets given a list of workspace paths.
• PackageMetadata::source provides the source of a package (a local path, crates.io, a git repository or a custom registry).
• PackageQuery::initials returns the initial set of packages specified in a package query.
• FeatureQuery::initials returns the initial set of features specified in a feature query.
• FeatureQuery::initial_packages returns the initial set of packages specified in a feature query.
• Improvements to Cargo resolution:
  • CargoSet now carries with it the original query and information about direct third-party dependencies.
  • A number of bug fixes around edge cases.
• Workspace::members_by_paths and Workspace::members_by_names look up a list of workspace members by path or name, respectively.
• FeatureGraph::all_features_for returns a list of all known features for a specified package.

Changed

• Lookup methods like PackageGraph::metadata now return Results with errors instead of Options.
• target-spec has been upgraded to 0.3.
• proptest has been upgraded to 0.10. The feature has accordingly been renamed to proptest010.
• Workspace::members is now Workspace::iter_by_path, and Workspace::members_by_name is now Workspace::iter_by_name.

Fixed

• In FeatureQuery<'g> and FeatureSet<'g>, the lifetime parameter 'g is now covariant. Compile-time assertions ensure that all lifetime parameters in guppy are covariant.

Upcoming

• Support for build summaries is currently in an experimental state.