Libp2p dependency Hell.

[DougAnderson444]

Right now, because each crate has it's own version, and those crate are all in a workspace, it can be difficult to use certain versions of rust-libp2p.

A story to illustrate:

Let's say I want to use Beetswap (a bitswap impl) over webrtc.

Beetswap uses libp2p-core v0.42.0

Which means that any time you want to use Beetswap, you'll need core v0.42.0.

Oh, you want to use WebRTC though? That's fine.

Well, you'll need libp2p-webrtc-websys version 0.4.0 because anything before that breaks because __Nonexhaustive
was switched to __Invalid in wasm-bindgen.

What's that you say? libp2p-webrtc-websys version 0.4.0 depends on libp2p-core ^0.43.0, which means beetswap won't work, so you'll need to fork that, create a branch that depends on core 0.42.0.

THEN there's the fact that the commit for libp2p-core v0.42.0 depends on libp2p-webrtc-utils v0.2.1,
but you'll need libp2p-webrtc-utils v0.3.0 in order for libp2p-webrtc 0.8.0-alpha to be compatible with it.

But there is no git tag for libp2p-webrtc-utils-v0.3.0, so you cannot reference a commit for it. So you need ANOTHER
branch with core 0.42 + utils 0.3 combined in order to use those.

That's just to get all the versions to be compatible with each other. Otherwise, the dependency tree breaks.

EOF

What can we do?

I'd love to hear some ideas, because the real life story above works... but is crazy.

Can we start maybe using the equivalent of "Minimum Supported Rust Version" but with libp2p deps?

Minimum Supported Libp2p Version ?

Is there any way around this in the Cargo workspace model where workspace members can use a minimum version of other workspace members?

[jxs]

Hi Doug!
I am sorry that you are suffering with this. Currently there's #3271 and we plan to spend some time to try and question its existence and how can we improve the release process.
Meanwhile I am curious about your use case, why not address what to me feels is the the main problem that is Beetswap not updating to the latest libp2p-core 0.43.0 instead?
Meanwhile I pushed the libp2p-webrtc-utils-v0.3.0 tag, hope it helps!

Can we start maybe using the equivalent of "Minimum Supported Rust Version" but with libp2p deps?

Minimum Supported Libp2p Version ?

Is there any way around this in the Cargo workspace model where workspace members can use a minimum version of other workspace >members?

what would that be in practice?

[DougAnderson444]

Thanks for weighing in João! ❤️

Yes you are 100% correct about bumping beetswap, but I just use it as an example for dependencies outside of our direct control that use older versions. Sometimes (esp when the API has a breaking change) bumping dependencies is non-trivial and cannot be completed right away. Or perhaps in a different repo the maintainers are not very active, etc. etc.

I appreciate the tag! I definitely am interested in the bigger dependency tree issue though. If there's a way around locked version deps, I think that'll pay dividends down the road for problems like these.

[DougAnderson444]

what would that be in practice?

I'm not 100% sure what would work best honestly.

In the workspace, could we do something like this?

[dependencies]
other_member = { path = "../other_member", version = "^0.1" }

Where the "^" indicates minimum version?

If that doesn't work in practice, could we switch from workspace deps to crates.io deps with the minimum caret?