Cargo would be better if it had a separate unique and label names for dependencies, and dependency resolution used the former.
Basing immutablity to a label makes
crates.io quite unrobust IMHO, and given that not all projects fly that far, otherwise useful labels stay reserved permanently, up until Sun melts.
Such dual-name scheme could be transparent to Cargo.toml: e.g. Cargo.lock could map a label to a name.
I'm not saying that names would need to have expiration time. I'm thinking more like willingly giving name back to circulation from abandoned project.
C++ has bunch of offerings now for cargo alike package managers. In that front, I'd try to find a solution that is smarter than Cargo before there is a dominating solution.
#rustlang #cargo