future-incompatibilities should tell you where the dependency comes from

[thenorili]

Code

When testing eyre on main with cargo test on stable or nightly I get error message 1 stating that nom and pyo3 are the root of the problem, but the string 'nom' isn't in my repo. Clearly it's a nested dependency -- but what dependency is the root of this problem?

Current output

error 1 from `cargo test`
`
warning: the following packages contain code that will be rejected by a future version of Rust: nom v4.2.3, pyo3 v0.13.2
note: to see what the problems were, use the option `--future-incompat-report`, or run `cargo report future-incompatibilities --id 1`
`

error 2 from `~/dev/eyre : cargo report future-incompatibilities --id 2 --package nom@4.2.3`

`
The following warnings were discovered during the build. These warnings are an
indication that the packages contain code that will become an error in a
future release of Rust. These warnings typically cover changes to close
soundness problems, unintended or undocumented behavior, or critical problems
that cannot be fixed in a backwards-compatible fashion, and are not expected
to be in wide use.

Each warning should contain a link for more information on what the warning
means and how to resolve it.


To solve this problem, you can try the following approaches:


- Some affected dependencies have newer versions available.
You may want to consider updating them to a newer version to see if the issue has been fixed.

nom v4.2.3 has the following newer versions available: 5.0.0-alpha1, 5.0.0-alpha2, 5.0.0-beta1, 5.0.0-beta2, 5.0.0-beta3, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 6.0.0-alpha1, 6.0.0-alpha2, 6.0.0-alpha3, 6.0.0-beta1, 6.0.0-beta2, 6.0.0-beta3, 6.0.0-beta4, 6.0.0-beta5, 6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.2.2, 7.0.0-alpha1, 7.0.0-alpha2, 7.0.0-alpha3, 7.0.0, 7.1.0, 7.1.1, 7.1.2, 7.1.3


- If the issue is not solved by updating the dependencies, a fix has to be
implemented by those dependencies. You can help with that by notifying the
maintainers of this problem (e.g. by creating a bug report) or by proposing a
fix to the maintainers (e.g. by creating a pull request):

  - nom@4.2.3
  - Repository: https://github.com/Geal/nom
  - Detailed warning command: `cargo report future-incompatibilities --id 2 --package nom@4.2.3`

- If waiting for an upstream fix is not an option, you can use the `[patch]`
section in `Cargo.toml` to use your own version of the dependency. For more
information, see:
https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html#the-patch-section
`

Desired output

`
warning: the following packages contain code that will be rejected by a future version of Rust: nom v4.2.3 [via MY_DEPENDENCY v0.0.0], pyo3 v0.13.2
note: to see what the problems were, use the option `--future-incompat-report`, or run `cargo report future-incompatibilities --id 1`
`

in the detailed message, you could then print the newer versions of the actual dependency you include.

Rationale and extra context

Finding pyo3 and updating it is trivial, just grep for it.

nom doesn't show up in a grep. How do you find its source?

I went for the detailed output in hopes that would tell me where it comes from, but that didn't help. See error 2.

Other cases

No response

Anything else?

No response

[thenorili]

note: even just suggesting cargo-tree would be a start :D

[jyn514]

this seems like a good change, but the issue should be moved to the cargo repo, it's the one printing 'packages contain code that will be rejected'

[ehuss]

Transferred to rust-lang/cargo.

Note that this can be difficult to show in the message, because the inverted dependency tree can be very deep, and have multiple paths through the tree that resolve to the root. Recommending cargo-tree could be helpful, however, there are complications like you can't run that with cargo install.