Ignored network errors lead to incorrectly reporting "latest" dependencies

[kornelski]

[workspace]
members = ["wscrate"]

[workspace.dependencies]
rand = "0.7"

wscrate/Cargo.toml:

[package]
name = "wscrate"
edition = "2024"

[dependencies]
rand.workspace = true

cargo upgrade -i

Prints:

 latest: rand

With --verbose it does hint why "warning: ignoring rand, source is workspace", but I didn't run it with --verbose, because reporting "latest" was falsely reassuring that the dependency was found correctly and the version has been checked.

It'd be better to report something like:

workspace dependencies are not supported: rand

or even better, actually upgrade [workspace.dependencies].

---

cargo-edit-upgrade 0.13.1

[epage]

I recreated the workspace and I'm not seeing output like yours.

Here is what I get:

$ git reset --hard && cargo upgrade -i
HEAD is now at fc15a77 Initial
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.06s
     Running `/home/epage/src/personal/cargo-edit/target/debug/cargo-upgrade upgrade -i`
    Checking virtual workspace's dependencies
name old req compatible latest new req
==== ======= ========== ====== =======
rand 0.7     0.7.3      0.9.0  0.9
    Checking wscrate's dependencies
   Upgrading recursive dependencies
warning: virtual workspace defaulting to `resolver = "1"` despite one or more workspace members being on edition 2024 which implies `resolver = "3"`
note: to keep the current resolver, specify `workspace.resolver = "1"` in the workspace root's manifest
note: to use the edition 2024 resolver, specify `workspace.resolver = "3"` in the workspace root's manifest
note: for more details see https://doc.rust-lang.org/cargo/reference/resolver.html#resolver-versions
     Locking 0 packages to latest Rust 1.85.0 compatible versions

If I add -v

$ git reset --hard && cargo upgrade -i
HEAD is now at fc15a77 Initial
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.06s
     Running `/home/epage/src/personal/cargo-edit/target/debug/cargo-upgrade upgrade -i`
    Checking virtual workspace's dependencies
name old req compatible latest new req
==== ======= ========== ====== =======
rand 0.7     0.7.3      0.9.0  0.9
    Checking wscrate's dependencies
   Upgrading recursive dependencies
warning: virtual workspace defaulting to `resolver = "1"` despite one or more workspace members being on edition 2024 which implies `resolver = "3"`
note: to keep the current resolver, specify `workspace.resolver = "1"` in the workspace root's manifest
note: to use the edition 2024 resolver, specify `workspace.resolver = "3"` in the workspace root's manifest
note: for more details see https://doc.rust-lang.org/cargo/reference/resolver.html#resolver-versions
     Locking 0 packages to latest Rust 1.85.0 compatible versions

[kornelski]

Ok, I've found it — the .ok() silently swallows all network errors:

cargo-edit/src/bin/upgrade/upgrade.rs

Lines 296 to 302 in 6369443

	get_compatible_dependency(
	&dependency.name,
	&old_version_req,
	rust_version,
	index,
	)
	.ok()

I have cursed CA certificates with signature algorithms that ring doesn't support, which causes of all of its HTTPS requests to fail.
cargo-edit can't get anything from the registry, and reports that everything is up to date, because there are no newer versions, because there's no registry data at all.

[kornelski]

Thank you