`cargo add` fails when dependency is also listed in dev-dependencies

[leighmcculloch]

Problem

I have a place I am trying to use cargo add to modify an existing dependency that exists both in dependencies and dev-dependencies. Today with cargo add it errors whenever trying to update a dependency that lives in more than one sections of the toml.

Steps

For example, for the following toml, I experience the following errors with the following commands.

$ cat Cargo.toml
[package]
name = "soroban-fuzzing-contract"
version = "0.0.0"
edition = "2021"
publish = false
rust-version = "1.89.0"

[lib]
crate-type = ["cdylib", "rlib"]
doctest = false

[features]
testutils = []

[dependencies]
soroban-sdk = { version = "23.0.1" }

[dev-dependencies]
soroban-sdk = { version = "23.0.1", features = ["testutils"] }
arbitrary = { version = "1.1.3", features = ["derive"] }
proptest = "1.2.0"
proptest-arbitrary-interop = "0.1.0"

[profile.release]
opt-level = "z"
overflow-checks = true
debug = 0
strip = "symbols"
debug-assertions = false
panic = "abort"
codegen-units = 1
lto = true

[profile.release-with-logs]
inherits = "release"
debug-assertions = true

$ cargo add soroban-sdk --path ../../rs-soroban-sdk/soroban-sdk
      Adding soroban-sdk (local) to dependencies
             Features:
             - alloc
             - curve25519-dalek
             - docs
             - hazmat
             - testutils
error: failed to parse manifest at `/Users/leighmcculloch/Code/soroban-examples/fuzzing/Cargo.toml`

Caused by:
  Dependency 'soroban-sdk' has different source paths depending on the build target. Each dependency must have a single canonical source path irrespective of build target.

$ cargo add soroban-sdk --path ../../rs-soroban-sdk/soroban-sdk --dev
error: failed to parse manifest at `/Users/leighmcculloch/Code/soroban-examples/fuzzing/Cargo.toml`

Caused by:
  Dependency 'soroban-sdk' has different source paths depending on the build target. Each dependency must have a single canonical source path irrespective of build target.

$ git diff
diff --git i/Cargo.toml w/Cargo.toml
index af6a029..63b8572 100644
--- i/fuzzing/Cargo.toml
+++ w/fuzzing/Cargo.toml
@@ -13,7 +13,7 @@ doctest = false
 testutils = []
 
 [dependencies]
-soroban-sdk = { version = "23.0.1" }
+soroban-sdk = { version = "23.0.2", path = "../../rs-soroban-sdk/soroban-sdk" }
 
 [dev-dependencies]
 soroban-sdk = { version = "23.0.1", features = ["testutils"] }

The command errors both times, although does appear to successfully make the change at the first command. Whichever command I run first seems to succeed at making the change even if its exit code is non-zero, as if the first command is succeeding then failing some validation that is running after the change is made. The second command fails prior to doing any work.

Possible Solution(s)

I'd like to be able to run either a command once, or both commands separately, and result in all locations being updated:

diff --git i/Cargo.toml w/Cargo.toml
index af6a029..25912b8 100644
--- i/fuzzing/Cargo.toml
+++ w/fuzzing/Cargo.toml
@@ -13,10 +13,10 @@ doctest = false
 testutils = []
 
 [dependencies]
-soroban-sdk = { version = "23.0.1" }
+soroban-sdk = { version = "23.0.2", path = "../../rs-soroban-sdk/soroban-sdk" }
 
 [dev-dependencies]
-soroban-sdk = { version = "23.0.1", features = ["testutils"] }
+soroban-sdk = { version = "23.0.2", features = ["testutils"], path = "../../rs-soroban-sdk/soroban-sdk" }

Notes

No response

Version

cargo 1.90.0 (840b83a10 2025-07-30)
release: 1.90.0
commit-hash: 840b83a10fb0e039a83f4d70ad032892c287570a
commit-date: 2025-07-30
host: aarch64-apple-darwin
libgit2: 1.9.1 (sys:0.20.2 vendored)
libcurl: 8.7.1 (sys:0.4.82+curl-8.14.1 system ssl:(SecureTransport) LibreSSL/3.3.6)
ssl: OpenSSL 3.5.0 8 Apr 2025
os: Mac OS 15.6.1 [64-bit]

[epage]

On killercup/cargo-edit#951, I mentioned the workaround

$ git checkout HEAD -- Cargo.toml
$ cargo add soroban-sdk --path ../../rs-soroban-sdk/soroban-sdk --dev
$ cargo add soroban-sdk --path ../../rs-soroban-sdk/soroban-sdk

and you said

I'll include this in the report on the other repo, but you can't use the two add command back to back. The first command errors after making the change. The second command errors before making the change.

I'm not able to reproduce that; the following worked for me:

$ cargo new cargo-16101
$ cd cargo-16101
$ cargo add --dev clap
$ cargo add --dev clap --path ../../clap
$ cargo add clap --path ../../clap

[epage]

The reason we get in this state is that the error is being reported after cargo add modified Cargo.toml, while it is working to edit Cargo.lock.

Options

• Make the operation atomic. This would require doing the validation and Cargo.lock generation all in-memory which we do not support atm but would also need this for the cargo-plumbing commands
• Have cargo add error. I wonder how many other error states we might have in manfiest parsing to duplicate like this. That has me worried about the maintainability
• Have cargo add edit existing sources to align them

[leighmcculloch]

Even if I delete the Cargo.lock file, then run the two add commands, I still don't end up with both commands successfully editing the file.

For example, with the same Cargo.toml that's at the top of the issue:

$ mv Cargo.lock Cargo.lock.tmp

$ cargo add soroban-sdk --path ../../rs-soroban-sdk/soroban-sdk --dev
      Adding soroban-sdk (local) to dev-dependencies
             Features:
             + testutils
             - alloc
             - curve25519-dalek
             - docs
             - hazmat
error: failed to parse manifest at `/Users/leighmcculloch/Code/soroban-examples/fuzzing/Cargo.toml`

Caused by:
  Dependency 'soroban-sdk' has different source paths depending on the build target. Each dependency must have a single canonical source path irrespective of build target.

$ cargo add soroban-sdk --path ../../rs-soroban-sdk/soroban-sdk
error: failed to parse manifest at `/Users/leighmcculloch/Code/soroban-examples/fuzzing/Cargo.toml`

Caused by:
  Dependency 'soroban-sdk' has different source paths depending on the build target. Each dependency must have a single canonical source path irrespective of build target.

$ git diff Cargo.toml
diff --git i/Cargo.toml w/Cargo.toml
index af6a029..53ed019 100644
--- i/fuzzing/Cargo.toml
+++ w/fuzzing/Cargo.toml
@@ -16,7 +16,7 @@ testutils = []
 soroban-sdk = { version = "23.0.1" }
 
 [dev-dependencies]
-soroban-sdk = { version = "23.0.1", features = ["testutils"] }
+soroban-sdk = { version = "23.0.2", features = ["testutils"], path = "../../rs-soroban-sdk/soroban-sdk" }
 arbitrary = { version = "1.1.3", features = ["derive"] }
 proptest = "1.2.0"
 proptest-arbitrary-interop = "0.1.0"

The diff at the end only has one of the dependency lines updated, the one updated by the first command.

[epage]

Oh, I had missed that soroban-sdk was already a part of [dependencies]. I thought it was only in [dev-dependencies]. Yes, then this turns into trying to edit one of two at the same time which will fail, regardless of the order.