add --dry-run option to cargo update

[matklad]

Hi!

This is just an idea, but what if we had a --dry-run argument for cargo update, which shows which crates would be updated, without actually writing the lockfile? If this seems useful, I'll write the tests and such. If we can leave without it, feel free to close.

Context: at ferrous-systems, we put together a small tool to review the source code changes between different versions of the same crate. This obviously was inspired by the most recent npm incident. While implementing the tool, I thought that having --dry-run might also be useful for folks who a cautious about updating. IE, you could run cargo update --dry-run once to see what could be updated, and follow up with a series of update -p --precise, to do the update in minimal steps, reviewing the actual source each time.

[rust-highfive]

r? @alexcrichton

(rust_highfive has picked a reviewer for you, use r? to override)

[alexcrichton]

This sounds like a fantastic idea to me, others on @rust-lang/cargo have thoughts?

[joshtriplett]

Seems like a great idea.

[matklad]

Added the test.

Should we feature gate this? I'd say no: this is more-or-less UI-only features, so there's no new functionality to stabilize, and feature gate would seem like a procedural overhead. But of course adding a feature gate is not a big deal, will gladly do that if necessary.

[withoutboats]

Since we already have dry-run on other commands, I don't think we need to feature gate this. we should probably get a full team check off though

@rfcbot fcp merge

[withoutboats]

@rfcbot fcp merge

[rfcbot]

Team member @withoutboats has proposed to merge this. The next step is review by the rest of the tagged teams:

• @Eh2406
• @alexcrichton
• @dwijnand
• @ehuss
• @joshtriplett
• @nrc
• @withoutboats
• @wycats

No concerns currently listed.

Once a majority of reviewers approve (and none object), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for info about what commands tagged team members can give me.

[matklad]

Since we already have dry-run on other commands,

Pedantic correction: there's a single command with --dry-run, cargo publish :-)

[bors]

☔ The latest upstream changes (presumably #6400) made this pull request unmergeable. Please resolve the merge conflicts.

[matklad]

Fun fact: cargo update --locked is basically cargo update --dry-run.

[nrc]

Discussed in our meeting today. One question was about the exit code, should we return success if the Cargo.lock would have been updated? (Although cargo update --locked gives that). But overall the feeling was positive.

[Eh2406]

@nrc did you mean to merge without bors?

[nrc]

@nrc did you mean to merge without bors?

Whoops, I did not.