Pulls in two versions of the rustls-webpki crate (v0.102 and v0.103)
The amqprs crate, when the `tls` feature flag is enabled, pulls in two different major versions of the rustls-webpki crate.
While this doesn't have any apparent negative effects (other than a small code size or built time effect), for efficiency and clarity it seems like there should only be one version pulled in.
## Crate versions being included
- rustls-webpki v0.102 is a direct dependency by amqprs
- rustls-webpki v0.103 is a transitive dependency by way of amqprs -> tokio-rustls v0.26.2 -> rustls v0.23 -> rustls-webpki v0.103.
Affected versions: amqprs <= v2.1.2.
## Steps to identify
With a shell in the amqprs source tree, run these commands to identify the rustls-webpki dependencies:
```text
# dependency paths to the two crate versions:
❯ cargo tree -e normal -p amqprs -F tls -i rustls-webpki@0.102
rustls-webpki v0.102.8
└── amqprs v2.1.2
❯ cargo tree -e normal -p amqprs -F tls -i rustls-webpki@0.103
rustls-webpki v0.103.1
└── rustls v0.23.25
└── tokio-rustls v0.26.2
└── amqprs v2.1.2
# abbreviated dependency tree showing them:
❯ cargo tree -e normal -p amqprs -F tls | rg '^amqprs|tokio-rustls| rustls v|rustls-webpki'
amqprs v2.1.2 (/Users/cdb/Code/amqprs/amqprs)
├── rustls-webpki v0.102.8
├── tokio-rustls v0.26.2
│ ├── rustls v0.23.25
│ │ ├── rustls-webpki v0.103.1
# as of commit aafa2088fcd4a20d1c60b50c97f63ba11d2d5a87 v2.1.2
```
1 条评论