Consider version in Cargo.lock file

[beeb]

Hey, thanks a lot for this project! I just started using it in Helix as a replacement for Dependi in VSCode.

I quickly glanced at the codebase here and couldn't find a reference to reading the Cargo.lock file. Does that mean that it will report a dependency as being outdated if the version in the Cargo.toml is not the latest?

As you probably know, if you run cargo update, the version is the Cargo.toml is not changed, but the one in the Cargo.lock is. Is that something you plan to support in the future?

As a sidenote, I was a bit surprised to see you rolling your own TOML parser for the manifest ^^. Out of curiosity, why didn't you use something like toml_edit or toml?

[saecki]

Hey, not the maintainer, just lurking. But I maintain a neovim plugin that does pretty much the same thing. The problem with the toml crate is, that it doesn't return any information, as soon as there is even just one error inside the file.

For that reason I've actually been working on a toml parser for a while that is lenient (can recover from errors) and focuses on good error messages. The original goal was to just use it as a toml parsing library for the plugin, but for a while now I think the best thing would be to build a language server around it.

[beeb]

Hey @saecki . I would argue that if the TOML has an error in it, cargo will not compile my project anyway, so that's maybe a bigger problem to solve first compared to updating dependencies. But I see your point, and diversity is never a bad thing!

[MathiasPius]

@saecki is exactly right. The use case is for when you're writing the TOML file in the first place. For instance, if you want to add serde as a dependency, you might write serde = " and expect a suggestion for which version to pick. With any existing TOML crate, that's not gonna work at all :)

[MathiasPius]

As for the Cargo.lock comparison, I could see it making sense to differentiate between:

1. Cargo.toml version does not cover latest (high priority)
2. Cargo.toml version covers latest, and Cargo.lock is not up to date (medium periority)
3. Cargo.toml version covers latest, but Cargo.lock is up to date (low priority)

[beeb]

Ah yes, I didn't think of the autocomplete where you need to parse invalid TOML input, makes total sense!

[beeb]

Hey @MathiasPius , I see this is closed as completed. Does that mean a feature was added to check if the Cargo.lock file is up-to-date?

[MathiasPius]

@beeb My bad, I stumbled upon and misremembered the outcome and figured it was resolved! I'll reopen it, but I unfortunately don't have any time to implement it at the moment.