"path" dev-dependencies withou "version" are silently dropped

[igor-raits]

Problem
The zvariant crate, when downloaded from crates.io fails on cargo test because of unresolved imports to zvariant_derive. Turns out that cargo automatically strips dev-dependencies that have path, but do not have version. I believe that when there are both, cargo keeps the dependency, but strips path. I did not test it with dependency (non-dev one) since I don't know some easy way to reproduce it but I believe that cargo used to reject those at some point.

Steps

1. curl -sL https://crates.io/api/v1/crates/zvariant/2.0.0/download#/zvariant-2.0.0.crate | tar -xzO 'zvariant-2.0.0/Cargo.toml' | grep zvariant_derive

(no output)

2. curl -sL https://crates.io/api/v1/crates/zvariant/2.0.0/download#/zvariant-2.0.0.crate | tar -xzO 'zvariant-2.0.0/Cargo.toml.orig' | grep zvariant_derive

zvariant_derive = { path = "../zvariant_derive" }

Possible Solution(s)
I think such crates should be prohibited from publishing and giving a hint that specifying version should fix the problem.

Notes

Output of cargo version:

cargo 1.43.0 (3532cf738 2020-03-17)

installed via rustup.

cc @zeenix

[ehuss]

This is intentional (see #7333). The package will need to specify the version for it to work. This will also be addressed by rust-lang/rfcs#2906 which will automatically inject the version.

[igor-raits]

@ehuss 😞 since that is making distributions maintainer’s life more complicated :/ Hope that linked RFC will be solved soon.