I think you are right, but IMO the reason is just a difference in numbers. If crate.io ever gets as much users as npm the problems will become exactly the same.
As soon as there is a situation where one dependency can decide tomorrow to pull in another one everybody is screwed. You might be comfortable with understanding the code, but if you don’t have the time to fix it you are screwed either way. The customer always says “it worked yesterday, what do you mean you need to fix something? Work on this new feature instead”. One year of this any you cannot manage your dependencies anymore and you have hundreds, welcome to npm.
I think you are right, but IMO the reason is just a difference in numbers. If crate.io ever gets as much users as npm the problems will become exactly the same.
As soon as there is a situation where one dependency can decide tomorrow to pull in another one everybody is screwed. You might be comfortable with understanding the code, but if you don’t have the time to fix it you are screwed either way. The customer always says “it worked yesterday, what do you mean you need to fix something? Work on this new feature instead”. One year of this any you cannot manage your dependencies anymore and you have hundreds, welcome to npm.