cargo update --offline can downgrade dependencies

[saethlin]

Problem

I want to use cargo update --offline instead of cargo update because I know that my local registry is update to date, and it should be faster. It is faster, but when I tried it, I got a package downgrade.

Steps

Here is what I did:

$ cargo download -x serde_json
INFO: cargo-download v0.1.2
INFO: Latest version of crate serde_json=* is 1.0.79
INFO: Crate `serde_json==1.0.79` downloaded successfully
INFO: Crate content extracted to ./serde_json-1.0.79/
$ cd serde_json-1.0.79/
$ cargo update
    Updating crates.io index
$ cargo update --offline
    Updating psm v0.1.18 -> v0.1.17

Possible Solution(s)

No response

Notes

No response

Version

Reproduces on latest stable and nightly

cargo 1.62.0-nightly (edffc4a 2022-04-19)
release: 1.62.0-nightly
commit-hash: edffc4ada3d77799e5a04eeafd9b2f843d29fc23
commit-date: 2022-04-19
host: x86_64-unknown-linux-gnu
libgit2: 1.4.2 (sys:0.14.2 vendored)
libcurl: 7.80.0-DEV (sys:0.4.51+curl-7.80.0 vendored ssl:OpenSSL/1.1.1m)
os: Arch Linux Rolling Release [64-bit]

cargo 1.60.0 (d1fd9fe 2022-03-01)
release: 1.60.0
commit-hash: d1fd9fe2c40a1a56af9132b5c92ab963ac7ae422
commit-date: 2022-03-01
host: x86_64-unknown-linux-gnu
libgit2: 1.3.0 (sys:0.13.23 vendored)
libcurl: 7.80.0-DEV (sys:0.4.51+curl-7.80.0 vendored ssl:OpenSSL/1.1.1m)
os: Arch Linux Rolling Release [64-bit]

[epage]

What happens if you do a build between cargo update and cargo update --offline? I'm wondering if --offline is taking into account what .crate files are already downloaded which is what is forcing the downgrade.

[saethlin]

Yup, no downgrade after a build. ARGH. I suppose this is actually desirable if you're trying to use cargo offline, instead of me who's just trying to generate thousands of lockfiles.

[Eh2406]

Yes, --offline looks at whether you have everything for the build to work. If you just want to skip the git fetch then you want -Zno-index-update.

[saethlin]

Appreciate the advice, hopefully my misunderstanding helps others who come across this behavior too :)