When the manifest file of my project/the root project, call it A, contains a dep/constraint statement for another project, say X, that doesn't appear in A's import statements, there are three modes in which tools can interpret that:
- X must be present in the result (A's lock+vendor), and it must meet the version constraint.
- (There's a variant where it works like this when it’s the root manifest giving the dep on X, but if it’s a non-root manifest, things work like 2)
- X needn't be present in the result, and even if it is, it needn't meet the constraint. (Basically, the constraint is cruft and we ignore it)
- X needn't necessarily be present in the result, but if it is (because some other dep actually does import X), then it must meet A's stated constraint.
- (Again, there's a variant where it works like this for the root manifest, but like 2 for a non-root manifest.)
The first mode's biggest benefit is up-front intuitiveness for users. As we've discussed, it corresponds nicely to a get or add-