bstr pulls in serde when serde feature is not specified

[lopopolo]

With this Cargo.toml:

[package]
name = "bstr-serde-feature-test"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
bstr = { version = "1.0.0", default-features = false, features = ["std"] }

I get this lockfile:

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3

[[package]]
name = "bstr"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "11aee792a41973cf54c837d6f344e35a03076328831b01ef30a14d965d47bfbc"
dependencies = [
 "memchr",
 "serde",
]

[[package]]
name = "bstr-serde-feature-test"
version = "0.1.0"
dependencies = [
 "bstr",
]

[[package]]
name = "memchr"
version = "2.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"

[[package]]
name = "serde"
version = "1.0.144"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0f747710de3dcd43b88c9168773254e809d8ddbdf9653b84e2554ab219f17860"

However cargo tree doesn't show serde in the dep tree at all:

$ cargo tree -e all
bstr-serde-feature-test v0.1.0 (/Users/lopopolo/Downloads/bstr-serde)
└── bstr feature "std"
    ├── bstr v1.0.0
    │   └── memchr v2.5.0
    ├── bstr feature "alloc"
    │   └── bstr v1.0.0 (*)
    └── memchr feature "std"
        └── memchr v2.5.0

Meta

$ rustc -Vv
rustc 1.63.0 (4b91a6ea7 2022-08-08)
binary: rustc
commit-hash: 4b91a6ea7258a947e59c6522cd5898e7c0a6a88f
commit-date: 2022-08-08
host: x86_64-apple-darwin
release: 1.63.0
LLVM version: 14.0.5
$ cargo version -v
cargo 1.63.0 (fd9c4297c 2022-07-01)
release: 1.63.0
commit-hash: fd9c4297ccbee36d39e9a79067edab0b614edb5a
commit-date: 2022-07-01
host: x86_64-apple-darwin
libgit2: 1.4.2 (sys:0.14.2 vendored)
libcurl: 7.79.1 (sys:0.4.55+curl-7.83.1 system ssl:(SecureTransport) LibreSSL/3.3.6)
os: Mac OS 12.5.1 [64-bit]

[lopopolo]

I tried this patch to bstr and still got the same result:

diff --git i/Cargo.toml w/Cargo.toml
index b926066..aef244e 100644
--- i/Cargo.toml
+++ w/Cargo.toml
@@ -26,7 +26,6 @@ default = ["std", "unicode"]
 std = ["alloc", "memchr/std", "serde?/std"]
 alloc = ["serde?/alloc"]
 unicode = ["dep:once_cell", "dep:regex-automata"]
-serde = ["dep:serde"]

 [dependencies]
 memchr = { version = "2.4.0", default-features = false }

I wonder if this is an underspecified part of cargo's implementation of https://rust-lang.github.io/rfcs/3143-cargo-weak-namespaced-features.html where a weak feature appears at multiple levels of nested features.

[lopopolo]

Hmm I tried with only features = ["alloc"]:

[package]
name = "bstr-serde-feature-test"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
bstr = { version = "1.0.0", default-features = false, features = ["alloc"] }

And serde still shows up in the lockfile:

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 3

[[package]]
name = "bstr"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "11aee792a41973cf54c837d6f344e35a03076328831b01ef30a14d965d47bfbc"
dependencies = [
 "memchr",
 "serde",
]

[[package]]
name = "bstr-serde-feature-test"
version = "0.1.0"
dependencies = [
 "bstr",
]

[[package]]
name = "memchr"
version = "2.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"

[[package]]
name = "serde"
version = "1.0.144"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0f747710de3dcd43b88c9168773254e809d8ddbdf9653b84e2554ab219f17860"

[lopopolo]

tbh I'm not sure this is even a bug, I just found it unexpected that entries appear in the lockfile that don't appear in cargo tree.

[lopopolo]

Ok this might be rust-lang/cargo#10801.

[BurntSushi]

cc @epage

[BurntSushi]

Yeah this looks pretty unfortunate, but also definitely looks like a Cargo problem. (Maybe it's be design? I do kind of hope not to be honest. But I'm not sure.)

I can at least say that when I use your Cargo.toml and run cargo build, Cargo does not build serde. So it might be in the lockfile, but it is not part of the build.

I'm going to close this because it looks like it's definitively a Cargo thing. Thanks for flagging this!