cargo hack check --locked fails because lockfile needs to be updated

[djc]

In Quinn, I'd like to start versioning the lockfile due to an issue in a transitive dependency. As such, I want to use --locked in all of my CI jobs to make sure they use the locked dependency versions rather than any newer ones.

However, this yields a failure on our features job:

Run cargo hack check --locked --feature-powerset --optional-deps --clean-per-run --no-dev-deps --ignore-unknown-features --ignore-private --group-features runtime-async-std,async-io,async-std --group-features runtime-smol,async-io,smol --skip ""
info: --no-dev-deps modifies real `Cargo.toml` while cargo-hack is running and restores it when finished
info: skipped applying group `runtime-async-std,async-io,async-std` to quinn-proto
info: skipped applying group `runtime-smol,async-io,smol` to quinn-proto
info: skipped applying group `runtime-async-std,async-io,async-std` to quinn-udp
info: skipped applying group `runtime-smol,async-io,smol` to quinn-udp
info: skipped running on private package `bench`
info: skipped running on private package `perf`
info: skipped running on private package `fuzz`
    Updating crates.io index
error: the lock file /home/runner/work/quinn/quinn/Cargo.lock needs to be updated but --locked was passed to prevent this
If you want to try to generate the lock file without accessing the network, remove the --locked flag and use --offline instead.
error: process didn't exit successfully: `/home/runner/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin/cargo clean --locked --package quinn` (exit status: 101)

I think the suggestion to use --offline wouldn't work in this case (could still pick up a newer semver-compatible dependency?). Do you know why this happens/is this is essential or incidental?

[taiki-e]

Do you know why this happens/is this is essential or incidental?

See:

info: --no-dev-deps modifies real Cargo.toml while cargo-hack is running and restores it when finished

And see readme:

https://github.com/taiki-e/cargo-hack?tab=readme-ov-file#--no-dev-deps

Currently, using --no-dev-deps flag removes dev-dependencies from real manifest while cargo-hack is running and restores it when finished.

--no-dev-deps is a flag necessary to address some bugs in the Cargo and third-party cargo subcommands, but the changes to the manifest should trigger a request to change the lock file.

[djc]

Okay, thanks.