Semver violation in libp2p-metrics v0.14.2

[michaelsproul]

Summary

The v0.14.2 release of libp2p-metrics broke semver such that a cargo update (or building without --locked) can break projects that depend on libp2p-metrics 0.14.x.

The reason for the breakage seems to be minor version bumps in libp2p-metrics's dependency on libp2p-core from v0.41 to v0.42 (and also libp2p-identify from v0.43 to v0.44).

You can see the semver-incompatible version changes by comparing the deps for v0.14.{1,2}:

• https://crates.io/crates/libp2p-metrics/0.14.1/dependencies
• https://crates.io/crates/libp2p-metrics/0.14.2/dependencies

In Lighthouse the semver violation results in cargo update breaking the build with the following error:

error[E0599]: `BandwidthTransport<T>` is not an iterator
  --> /home/michael/.cargo/registry/src/index.crates.io-6f17d22bba15001f/libp2p-0.53.2/src/builder/phase/bandwidth_metrics.rs:26:22
   |
25 |                   transport: libp2p_metrics::BandwidthTransport::new(self.phase.transport, registry)
   |  ____________________________-
26 | |                     .map(|(peer_id, conn), _| (peer_id, StreamMuxerBox::new(conn))),
   | |                     -^^^ `BandwidthTransport<T>` is not an iterator
   | |_____________________|
   |
   |
  ::: /home/michael/.cargo/registry/src/index.crates.io-6f17d22bba15001f/libp2p-metrics-0.14.2/src/bandwidth.rs:28:1
   |
28 |   pub struct Transport<T> {
   |   ----------------------- doesn't satisfy `BandwidthTransport<T>: Iterator`
   |
   = note: the following trait bounds were not satisfied:
           `BandwidthTransport<T>: Iterator`
           which is required by `&mut BandwidthTransport<T>: Iterator`

The compiler's hints about Iterator are a red herring: the issue is that BandwidthTransport implements Transport from libp2p-core v0.42.0 but the rest of the project is using libp2p-core v0.41.3.

Expected behavior

Crate releases should bump the minor version number when bumping the minor version of any pre-1.0 dependency.

Actual behavior

libp2p-metrics was released with a breaking change on a patch version

Relevant log output

No response

Possible Solution

Could libp2p-metrics v0.14.2 be yanked and reissued as v0.15?

Version

No response

Would you like to work on fixing this bug ?

Maybe

[jxs]

Thanks for reporting Michael!