Support status.svg for latest version on crates.io

[BaumiCoder]

If I want to link to the deps.rs report of the latest version of a released crate on crates.io, I can use a link like this:
https://deps.rs/crate/ecformat

But there is no status.svg without a version number.
https://deps.rs/crate/ecformat/status.svg gives an error page.

I know there is the option to point to a git repository, to get a status.svg without a version number
(like this https://deps.rs/repo/codeberg/BaumiCoder/ecformat/status.svg),
but I want to show the status for the released version and not the current development status.

[Feliix42]

That's an understandable request. However, before adding this redirect I would like to solicit opinions from other maintainers.

I agree that it would be neat to have. I just have one thought/concern.

My reason for hesitating is that it could be potentially misleading for others if there was a version-unspecific badge link. Suppose you publish the README on crates.io with a link pointing to the badge of the latest release. If you checked an old version then (for instance because you want to avoid updating for any reason), the dependencies would still show as "up to date", despite potentially containing a severe security vulnerability.
I agree that this is a somewhat constructed scenario, which is why I'm not against adding this feature, but I want to hear what others think. I'd just hate to be the reason someone used an old or insecure package.

[BaumiCoder]

My reason for hesitating is that it could be potentially misleading for others if there was a version-unspecific badge link. Suppose you publish the README on crates.io with a link pointing to the badge of the latest release. If you checked an old version then (for instance because you want to avoid updating for any reason), the dependencies would still show as "up to date", despite potentially containing a severe security vulnerability.
I agree that this is a somewhat constructed scenario, which is why I'm not against adding this feature, but I want to hear what others think. I'd just hate to be the reason someone used an old or insecure package.

I understand this risk. I would suggest adjusting the text in the status.svg to address this problem. Currently, lefthand side only says "dependencies". Maybe different texts like "dependencies of 0.1.0", "dependencies of latest crate (0.1.0)", "dependencies in the git main branch" (or similar) would make it more clear which version has (no) outdated dependencies.

[DCjanus]

Thanks for opening this — your use case is valid, and it’s actually already supported.

For crates.io latest release badges, you can use:

• https://deps.rs/crate/ecformat/latest/status.svg
• https://deps.rs/crate/ecformat/latest/shield.json

So in practice, this gives you the "latest released crate version" badge (not the current repo development state).

What is currently missing is discoverability/documentation: we don’t clearly document these /latest/... crate badge URLs yet, which likely made this hard to find. I’ll add documentation for this so it’s easier to discover.

[BaumiCoder]

Thanks for the information @DCjanus. Now, I was able to add the badge to my project in the way I want it (see PR).

However, I would suggest showing this interesting possibility more prominent. Maybe the webpage for the web link of such a badge (e.g., this) should also show the Markdown code for it. Currently, it redirects to the URL with the specific version, which only shows the Markdown for the badge with the specific version. I would suggest keeping it either a separate page (i.e., no redirect) or showing the Markdown code for the latest badge in addition the first version badge (maybe only if the version is the latest one).