Analysis of crates compiled in multiple versions across the workspace.
Run with: cargo tree --duplicates
TL;DR — All 13 conflicts are purely transitive. The workspace itself uses modern versions throughout. No workspace Cargo.toml changes can fix these; they require upstream crate updates.
pam is pinned at rev = daf26ae in agama-server. The crate and its dependencies are
effectively frozen, dragging in several old versions:
| Duplicate | Old version (pam chain) | New version (rest of workspace) |
|---|---|---|
bindgen |
0.69.5 (via pam-sys) |
0.72.1 (via zypp-agama-sys, suseconnect-agama-sys) |
syn |
1.0.109 (via pam-macros) |
2.0.117 (via every modern proc-macro) |
itertools |
0.12.1 (via bindgen 0.69.5) |
0.14.0 (via ratatui), 0.13.0 (via bindgen 0.72.1) |
rustc-hash |
1.1.0 (via bindgen 0.69.5) |
2.1.1 (via bindgen 0.72.1) |
nom |
7.1.3 (via cexpr → bindgen) |
8.0.0 (via libsystemd) |
The bindgen 0.69.5 build-dep in agama-server is an intentional workaround to keep pam-sys
working by forcing the runtime feature through Cargo's feature unification.
Fix: only possible by replacing or substantially updating the pam dependency.
config 0.15.x pulls in several old transitive deps via its yaml-rust2 and ordered-multimap
sub-trees:
| Duplicate | Old version (config chain) | New version (rest of workspace) |
|---|---|---|
convert_case |
0.6.0 (via config) |
0.10.0 (via derive_more → crossterm) |
hashbrown |
0.14.5 (via ordered-multimap) |
0.16.1 (via indexmap, zbus, etc.) |
hashbrown |
0.15.5 (via yaml-rust2 → hashlink) |
0.16.1 (same) |
foldhash |
0.1.5 (via hashbrown 0.15.5) |
0.2.0 (via hashbrown 0.16.1) |
getrandom |
0.2.17 (via const-random → dlv-list → ordered-multimap) |
0.4.1 (via uuid, tempfile) |
Fix: upgrade config when a new release updates these transitive deps.
jsonschema 0.30.x uses referencing which depends on fluent-uri 0.3.2, while the
workspace itself uses fluent-uri 0.4.1 directly.
| Duplicate | Old version (jsonschema chain) | New version (workspace) |
|---|---|---|
fluent-uri |
0.3.2 (via referencing → jsonschema) |
0.4.1 (agama-utils, agama-cli, agama-autoinstall) |
getrandom |
0.3.4 (via ahash → jsonschema) |
0.4.1 (via uuid, tempfile) |
Fix: upgrade jsonschema when it updates referencing to use fluent-uri 0.4.x.
These come from different crates at different stages of major-version upgrades. Nothing in the workspace controls them.
| Duplicate | Versions | Who pulls each |
|---|---|---|
rustix |
0.38.44 vs 1.1.4 | pulled by different transitive deps |
linux-raw-sys |
0.4.15 vs 0.12.1 | follows rustix versions |
openssl-probe |
0.1.6 vs 0.2.1 | curl (0.1.6) vs native-tls (0.2.1) |
| Root cause | Duplicates introduced | Fixable by workspace? |
|---|---|---|
pam pinned unmaintained git rev |
5 | No — requires replacing pam |
config 0.15.x old sub-deps |
5 | No — requires config upstream update |
jsonschema 0.30.x via referencing |
2 | No — requires jsonschema upstream update |
| Ecosystem version transition | 3 | No — resolves as upstreams catch up |