Rustc does not take version requirements into account with deprecation warnings

[rom1v]

Problem

My project uses quinn with version =0.11.8, and calls the method with_platform_verifier() which has been deprecated in 0.11.9.

Yet, cargo clippy reports an error, and suggests to call try_with_platform_verifier() which does not exist in quinn 0.11.8:

warning: use of deprecated associated function `quinn::ClientConfig::with_platform_verifier`: use `try_with_platform_verifier()` instead
 --> src/main.rs:2:34
  |
2 |     let _ = quinn::ClientConfig::with_platform_verifier();
  |                                  ^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: `#[warn(deprecated)]` on by default

warning: `clippybug` (bin "clippybug") generated 1 warning
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.04s

Steps

Create a new project clippybug, with:

Cargo.toml:

[package]
name = "clippybug"
version = "0.1.0"
edition = "2024"

[dependencies]
quinn = "=0.11.8"

src/main.rs:

fn main() {
    let _ = quinn::ClientConfig::with_platform_verifier();
}

And run cargo clippy.

Possible Solution(s)

No response

Notes

No response

Version

cargo 1.88.0 (873a06493 2025-05-10)
release: 1.88.0
commit-hash: 873a0649350c486caf67be772828a4f36bb4734c
commit-date: 2025-05-10
host: x86_64-unknown-linux-gnu
libgit2: 1.9.0 (sys:0.20.0 vendored)
libcurl: 8.12.1-DEV (sys:0.4.80+curl-8.12.1 vendored ssl:OpenSSL/3.4.1)
ssl: OpenSSL 3.4.1 11 Feb 2025
os: Debian n/a (forky) [64-bit]

[ehuss]

When you pin a dependency like quinn, it only pins that one package. It does not pin any of its dependencies. quinn re-exports ClientConfig from quin-proto (https://docs.rs/quinn/0.11.8/src/quinn/lib.rs.html#63), which in your example is on the latest version (0.11.13) which has the deprecation warning. try_with_platform_verifier should exist via the re-export, and the following should compile fine:

fn main() {
    let _ = quinn::ClientConfig::try_with_platform_verifier();
}

Can you say if that is not working for you?

[epage]

FYI this is a rustc warning and rustc is not aware of dependency versions to compare with since. Currently the since field is just for documentation purposes.

I'd love for the warning to only be shown when relevant. This would be a cross rustc/cargo effort.

I'm assuming cargo would report to rustc the smallest version compatible with the version requirement, whether actual or theoretical.

I assume if since is not a semver version that it would always be considered applicable.

[epage]

Hmm, one complication is re-exports (much like auto_cfg)

[rom1v]

When you pin a dependency like quinn, it only pins that one package. It does not pin any of its dependencies. quinn re-exports ClientConfig from quinn-proto (https://docs.rs/quinn/0.11.8/src/quinn/lib.rs.html#63), which in your example is on the latest version (0.11.13) which has the deprecation warning.

Well spotted!

Indeed, if I force quinn-proto to 0.11.12 (the minimal requirement for quinn 0.11.8), cargo clippy does not report any warning.

[package]
name = "clippybug"
version = "0.1.0"
edition = "2024"

[dependencies]
quinn = "=0.11.8"
quinn-proto = "=0.11.12"