Code change:
[[package]] name = "phf" <del> version = "0.7.22" </del> <ins> version = "0.7.24" </ins> source = "registry+https://github.com/rust-lang/crates.io-index" dependencies = [ <del> "phf_shared 0.7.22 (registry+https://github.com/rust-lang/crates.io-index)", </del> <ins> "phf_shared 0.7.24 (registry+https://github.com/rust-lang/crates.io-index)", </ins> ] [[package]] name = "phf_codegen" <del> version = "0.7.22" </del> <ins> version = "0.7.24" </ins> source = "registry+https://github.com/rust-lang/crates.io-index" dependencies = [ <del> "phf_generator 0.7.22 (registry+https://github.com/rust-lang/crates.io-index)", "phf_shared 0.7.22 (registry+https://github.com/rust-lang/crates.io-index)", </del> <ins> "phf_generator 0.7.24 (registry+https://github.com/rust-lang/crates.io-index)", "phf_shared 0.7.24 (registry+https://github.com/rust-lang/crates.io-index)", </ins> ] [[package]] name = "phf_generator" <del> version = "0.7.22" </del> <ins> version = "0.7.24" </ins> source = "registry+https://github.com/rust-lang/crates.io-index" dependencies = [ <del> "phf_shared 0.7.22 (registry+https://github.com/rust-lang/crates.io-index)", "rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)", </del> <ins> "phf_shared 0.7.24 (registry+https://github.com/rust-lang/crates.io-index)", "rand 0.6.1 (registry+https://github.com/rust-lang/crates.io-index)", </ins> ] [[package]] name = "phf_shared" <del> version = "0.7.22" </del> <ins> version = "0.7.24" </ins> source = "registry+https://github.com/rust-lang/crates.io-index" dependencies = [ "siphasher 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)",

Related discussion:
text: That wouldn't show up in here at all, if rustc-rayon follows suit.
So the latest versions are and , but is used in this repository. They come from . Maybe those dependencies should be updated or made optional?
It looks like this was fixed in PR and merged by bors. Should this issue be closed now?
There are still 3 versions of rand in use:
will remove rand 0.5, I can get rid of 0.4 anytime but there are many PRs modifying right now.
Update: is used by , and (via ).
That's with -- only uses as a dev-dependency.
I didn't check now, but at some point was using an old version of a custom fork of .
has rebased since then, so it already reflects that dependency change.
I tried to fix a part of this in , but it didn't come out as planned. There is dependency and license whitelist that needs to be updated. I think just running leaves only one usage of via and (which can be updated). But then there is the licensing story, and it's not very clear to me which dependencies are used by the tools, and which by the compiler.
Last time I checked and were the only thing preventing of , otherwise I'd fix it already. We are working on removing it but it's blocked on releasing new version of .
I think goes away after a , so that one might be easy to fix. I don't know how dependencies are updated across the repository. Is it just that most of them are for the tools, not for and ? Does somebody run from time to time? And why does the license check fail on bors on my PR, but not on Travis or on my computer?
So released new version since. Correct, dependencies of everything that is created by are tracked by single . Dependencies are often updated separately as needed because upgrading everything at once is likely to break something and it's easier to find what is wrong when you change like 5 dependencies instead of 50. I think it should error when you run .
Also you can run the same image that found the error ( in this case) by using these steps