This is not how the resolver works. A comment from the GitHub thread explains it well:
Cargo.lock
is not active when you simply use some software, for libraries used as a dependency it’s completely ignored, for applications installed viacargo install
it’s ignored by default but can be enabled withcargo install --locked
. Only when you are building from within the source tree is it active (e.g. via cloning the repo, or manually downloading and extracting the archive).
It’s weird how much difference a year makes in the Rust world. I had some initial pushback in this PR from 11 months ago, which only expanded the scope of recommendation for tracking
Cargo.lock
a little.