cargo-rail: fixing the issue where pinning transitive deps pulls in 'all-feautres' and breaks the graph.

Author: loadingalias

.gitignore

@@ -26,6 +26,7 @@ rules.md
 ARCHITECTURE.md
 style.md
 demos/
+setup
 
 # Cargo-Rail (Testing)
 *rail.toml

src/cargo/manifest_ops/entry_builder.rs

@@ -126,23 +126,30 @@ pub fn build_transitive_entry(features: &[String]) -> Item {
 /// Build a versioned dependency entry for [workspace.dependencies]
 ///
 /// Used when adding transitive dependencies to workspace.dependencies.
-/// Creates entries like: `dep = { version = "1.0", features = ["foo"] }`
+/// Creates entries like: `dep = { version = "1.0", default-features = false, features = ["foo"] }`
+///
+/// IMPORTANT: When pinning transitives with explicit features, we MUST set
+/// `default-features = false` to prevent cargo from enabling default features
+/// that might pull in new dependencies not present in the current Cargo.lock.
 ///
 /// # Arguments
 ///
 /// * `version` - The semver version to use
-/// * `features` - Features to enable
+/// * `features` - Features to enable (intersection across all targets)
 pub fn build_versioned_dep_entry(version: &semver::Version, features: &[String]) -> Item {
-  // Simple case: just version, no features
+  // Simple case: just version, no features - let cargo use defaults
+  // This is safe because we're not changing the feature set
   if features.is_empty() {
     let mut value = Value::from(format!("^{}", version));
     value.decor_mut().set_suffix(" #unified");
     return Item::Value(value);
   }
 
-  // Complex case: version + features
+  // Complex case: version + explicit features
+  // MUST disable default-features to avoid pulling in new deps
   let mut table = InlineTable::new();
   table.insert("version", Value::from(format!("^{}", version)));
+  table.insert("default-features", Value::from(false));
   table.insert("features", build_feature_array(features));
 
   // Add #unified comment marker

src/cargo/multi_target_metadata.rs

@@ -316,7 +316,19 @@ impl MultiTargetMetadata {
 
       if unique_sets.len() > 1 {
         // This dep has different features across builds = fragmented
-        let all_features: HashSet<String> = features.values().flat_map(|s| s.iter().cloned()).collect();
+        //
+        // IMPORTANT: Use INTERSECTION of features, not union!
+        // Using union can enable features that pull in new transitive deps
+        // that aren't in the current Cargo.lock, breaking resolution.
+        // The intersection approach is safe - it only pins features that
+        // are already enabled everywhere, avoiding new dep introduction.
+        let common_features: HashSet<String> = features
+          .values()
+          .fold(None, |acc: Option<HashSet<String>>, set| match acc {
+            None => Some(set.clone()),
+            Some(existing) => Some(existing.intersection(set).cloned().collect()),
+          })
+          .unwrap_or_default();
 
         // Get the resolved version (use highest across all targets)
         let versions = self.all_versions(&dep_name);
@@ -329,7 +341,7 @@ impl MultiTargetMetadata {
           name: dep_name.to_string(),
           version,
           feature_sets: features,
-          unified_features: all_features.into_iter().collect(),
+          unified_features: common_features.into_iter().collect(),
         });
       }
     }