<story><title>Cargo: predictable dependency management</title><url>http://blog.rust-lang.org/2016/05/05/cargo-pillars.html</url></story><parent_chain><item><author>lilyball</author><text>Something that I&amp;#x27;m surprised this page doesn&amp;#x27;t talk about, and which is very important considering the recent hubbub over left-pad, is that any dependency you get on Cargo can be relied upon to continue to exist forever (well, as long as the crates.io site still exists, but if that goes away so does the Cargo index). The reason is because you can&amp;#x27;t ever remove a published version of your crate from crates.io. You can yank a version, which tells Cargo not to allow any projects to form new dependencies on that version, but the version isn&amp;#x27;t actually deleted and any projects that have existing dependencies on that version will continue to be allowed to use it. This is documented at &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;doc.crates.io&amp;#x2F;crates-io.html#cargo-yank&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;doc.crates.io&amp;#x2F;crates-io.html#cargo-yank&lt;/a&gt;.</text></item></parent_chain><comment><author>incepted</author><text>&amp;gt; Something that I&amp;#x27;m surprised this page doesn&amp;#x27;t talk about, and which is very important considering the recent hubbub over left-pad, is that any dependency you get on Cargo can be relied upon to continue to exist forever&lt;p&gt;Maybe the reason why it&amp;#x27;s hardly talked about is because it&amp;#x27;s common sense and pretty much all dependency managers support it?&lt;p&gt;Except node of course, because they have no idea what they&amp;#x27;re doing.</text></comment>
<story><title>Cargo: predictable dependency management</title><url>http://blog.rust-lang.org/2016/05/05/cargo-pillars.html</url></story><parent_chain><item><author>lilyball</author><text>Something that I&amp;#x27;m surprised this page doesn&amp;#x27;t talk about, and which is very important considering the recent hubbub over left-pad, is that any dependency you get on Cargo can be relied upon to continue to exist forever (well, as long as the crates.io site still exists, but if that goes away so does the Cargo index). The reason is because you can&amp;#x27;t ever remove a published version of your crate from crates.io. You can yank a version, which tells Cargo not to allow any projects to form new dependencies on that version, but the version isn&amp;#x27;t actually deleted and any projects that have existing dependencies on that version will continue to be allowed to use it. This is documented at &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;doc.crates.io&amp;#x2F;crates-io.html#cargo-yank&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;doc.crates.io&amp;#x2F;crates-io.html#cargo-yank&lt;/a&gt;.</text></item></parent_chain><comment><author>kibwen</author><text>&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;gt; if that goes away so does the Cargo index
&lt;/code&gt;&lt;/pre&gt;
Not so, the location of the index is independent of crates.io. Currently the index itself is just hosted on Github, whereas all of crates.io is hosted on S3. Which is actually kind of a pain sometimes, since if Github goes down it means that Cargo won&amp;#x27;t be able to find the index and I don&amp;#x27;t know if there&amp;#x27;s an easy way to override the index check. In the future I expect Cargo will gracefully continue if the index can&amp;#x27;t be updated due to connection failure, though I&amp;#x27;d think it would prompt the user to make sure they&amp;#x27;re aware that their local copy of the index might be out of date.</text></comment>