How to pin wasm-bindgen to a specific version for CI/CD?

[allsey87]

I am working on a library that has a dependency on wasm-bindgen and needs to run some tests in Github Actions. In my Github workflow for CI, I install wasm-bindgen-cli via cargo binstall --no-confirm [email protected].

I have two crates in my workspace, a proc_macro crate and a library crate. The library crate has a dependency on wasm-bindgen = "0.2.89" which I would have thought, given there are no transitive dependencies requiring a newer version, should be the version used. However, referring to this run, wasm-bindgen, web-sys, js-sys etc are still being updated to the latest versions. What are my options for solving this problem?

• I don't think specifying the dependency as wasm-bindgen = "=0.2.89" is correct since the version should be upgradable to any patch version greater than 0.2.89 in downstream crates, i.e., outside of CI
• I don't think checking in a Cargo.lock file is correct since this should only be done for binary crates to the best of my knowledge
• I have tried to put wasm-bindgen = "=0.2.89" in the dev-dependencies section which seems flaky. It worked once in CI, but then failed after I changed the keywords in Cargo.toml, although I suspect the caching from actions-rust-lang/setup-rust-toolchain@v1 might have something to do with this

What is the correct way to solve this problem?

[daxpedda]

My understanding is that if you don't have a Cargo.lock file present, Cargo will just get you the newest dependencies allowed.
To specify a specific version, you can use cargo update -p wasm-bindgen --precise 0.2.89.

You might receive better answers in a more general Rust community though, this is probably the wrong place to ask about Cargo-specific things.

That said, please let me know if my suggestion doesn't work out for you!

[allsey87]

It is indeed more of a Cargo-related question, although this unusual requirement is a consequence of the requirement that the wasm-bindgen-cli version exactly matches the version of the wasm-bindgen crate used during compilation. Anyway, I'll check on the user forum to see if someone can shed some light on this there.

[allsey87]

Referring to this answer and this blog post the advice around commiting lock files has changed.