Why do dependencies have upper bounds?

[adamchalmers]

Hi! I'm wondering why your bytes dependency is locked to <1.2 -- it's causing some problems for my project which uses hyperx. Would you be open to broadening this to include up to bytes 1.4?

[kevincox]

The upper bounds are definitely causing issues. I'm having trouble upgrading percent-encoding in my project even though it is compatible. The upper bounds should definitely be stripped. We have to rely on those dependencies to maintain compatibility.

[kpcyrd]

This crate is breaking dependency resolution for me, I can't add www-authenticate to my project because it depends on hyperx which requires percent-encoding = ">=2.1.0, <2.2" but my project already contains form_urlencoded which depends on percent-encoding = "^2.2.0".

[chantra]

@dekellum is there any chances you could merge something like https://github.com/dekellum/hyperx/pull/40 so people can still use this crate without having dependency issues? Thanks

[chantra]

#41 is heavily based on #40, but using a few more relaxed dependency rules and bumped them when possible (for instance using http 1.X vs0.X)

[matt-phylum]

Explanation of the problem: https://github.com/rust-lang/cargo/issues/6584#issuecomment-457245362

Cargo strongly discourages usage of any version requirement other than ^ unless you're really sure you know what you're doing

[adamchalmers]

I suggest just using chantra's branch (https://github.com/chantra/hyperx/tree/semver) instead of the crates.io version. That's what https://github.com/oxidecomputer/third-party-api-clients is doing.