Builds failing due to semver violation in Zip

[ddimaria]

Issue in Zip: zip-rs/zip2#332

The workaround is to fix calamine to version 2.5.0 of Zip in Cargo.toml.

[itaysmalia]

@ddimaria is there any workaround if I have a dependancy that uses calamine? how can I pin the version of zip? the [replace] section in Cargo.toml does not work:

[replace]
"zip:2.6.0" = { git = "https://github.com/zip-rs/zip2", rev = "v2.5.0" }

leads to:

error: failed to get `zip` as a dependency of package `calamine v0.26.1`
    ... which satisfies dependency `calamine = "^0.26.1"` (locked to 0.26.1) of package `nu-command v0.103.0`
    ... which satisfies dependency `nu-command = "^0.103.0"` (locked to 0.103.0) of package `XXX v0.1.0 (XXX)`

sorry if this is out of scope... asking that because of your workaround suggestion

[ddimaria]

@itaysmalia maybe try replacing the version number with the commit hash: 77cde6a. We're working on a fix and will post here when we have it.

[itaysmalia]

@itaysmalia maybe try replacing the version number with the commit hash: 77cde6a. We're working on a fix and will post here when we have it.

@ddimaria thanks!
I temporarily solved it using local git clone, steps here.

[ddimaria]

Fix if anyone needs it: zip-rs/zip2#332 (comment)

[prophittcorey]

@tafia I opened a PR for the fix here: #497

[iam888]

any progress?

[Stigmatized]

an other easier fix than cloning would be to just

cargo update -p zip --precise 2.5.0

[simnalamburt]

For those who might be experiencing build issues, here’s a summary of possible workarounds:

1. Temporary solution

For now, doing the following fixes it:

$ cargo update -p zip --precise 2.5.0

But it'll break again if you run cargo update later.

2. Patch dependency version

# Cargo.toml
[patch.crates-io]
zip = { git = "https://github.com/zip-rs/zip2", tag = "v2.5.0" }

Due to a limitation in Cargo (rust-lang/cargo#5478), we unfortunately can’t use the crates.io index when changing dependency versions. As a result, we had to use the git protocol.

3. Patch dependency version (registry)

For those who prefer not to use the git:// protocol:

# Cargo.toml
[patch.crates-io]
zip = { version = "=2.5.0", registry = "crates-io-2" }

# .cargo/config.toml
[registries]
crates-io-2 = { index = "sparse+https://index.crates.io/" }
# Required due to https://github.com/rust-lang/cargo/issues/5478

This can lead to the same sub-dependency being downloaded from both crates-io and crates-io-2. It’s not a major issue to download the same dependency twice, but just be aware of it.

[iam888]

Is this project no longer maintained?