Cargo's [patch.crates-io] entry supplies jacquard-oauth 0.12.1, but jacquard = "0.12.1" allowed the newest umbrella, 0.12.2, whose oauth requirement no longer matched. A fresh resolve — what cargo install --git does without --locked — recorded the patch as [[patch.unused]] and then failed with eight compile errors, while the committed lockfile kept local builds green. This pins the umbrella to =0.12.1, the release the vendored copy matches, and leaves Cargo.lock unchanged. A fresh cargo generate-lockfile now uses the patch, and the tree builds from that lock.
tests/vendored_patch.rs reads Cargo.lock and fails when it contains any [[patch.unused]], or when the vendored jacquard-oauth version differs from the one the lock resolves. Each message names both remedies: re-vendor the crate, or pin the umbrella to the release the vendored copy matches.
🤖 Generated with Claude Code