Unstable lockfile between cargo update runs

[amyspark]

Problem

In https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs I've noticed a very strange thing. When issuing cargo update against a specific crate, in this case aws-lc-rs, the lockfile oscillates between:

• updating just aws-lc-rs and aws-lc-sys
• and shuffling around itertools, windows-sys and other crates as well.

I haven't yet figured out why but the pattern's definite and the crates affected as well.

Steps

1. Clone gst-plugins-rs at the provided commit 4ee38b6cf99407bc8a633a4a06784e09816ff48d (see link above).
2. Issue cargo update aws-lc-rs@0.13.0 --precise 0.13.1 and check the lockfile. It should've updated the crates, reduced bindgen's itertools to 0.11.0, among other things.
3. Issue cargo update aws-lc-rs@0.13.1 --precise 0.13.1 and check the lockfile again. It should've updated just the selected crate and its immediate dependency.

In a minor pattern, you can try an in place update of winapi-util@0.1.9 to the same version, its windows-sys dep should oscillate between 0.52 and 0.59.

Possible Solution(s)

No response

Notes

Attached old, new (first try) and new (second try) lockfiles: cargo-bugg-lock.zip

Version

cargo 1.86.0 (adf9b6ad1 2025-02-28)
release: 1.86.0
commit-hash: adf9b6ad14cfa10ff680d5806741a144f7163698
commit-date: 2025-02-28
host: x86_64-pc-windows-msvc
libgit2: 1.9.0 (sys:0.20.0 vendored)
libcurl: 8.12.0-DEV (sys:0.4.79+curl-8.12.0 vendored ssl:Schannel)
os: Windows 10.0.19045 (Windows 10 Pro) [64-bit]

[epage]

In a minor pattern, you can try an in place update of winapi-util@0.1.9 to the same version, its windows-sys dep should oscillate between 0.52 and 0.59.

I wonder if this is another instance of #5529

[amyspark]

Possibly other related bugs: #14115 #14613 #14883 and #14446

[joshtriplett]

As a more minimal reproducer of this, a dependency on bindgen = "0.69.5" results in the same behavior. A dependency on more recent versions of bindgen does not.