Function in_use_version 

pub fn in_use_version(
    dep: &dyn Dependency,
    normalized_name: &str,
    resolved_versions: &HashMap<PackageName, ConcreteVersion>,
    formatter: &dyn EcosystemFormatter,
    ecosystem: EcosystemId,
) -> Option<String>

The version of dep this project treats as actually in use.

The lock-file-resolved version, else the declared requirement when it is already concrete (concrete_pin_version). None when neither applies.

A dependency whose manifest requirement is itself the resolved version (crate::lsp_helpers::RequirementResolution::manifest_requirement_is_resolved_version — a Go require-directive dependency) skips the lockfile step entirely, going straight to the declared requirement (go.sum is unreliable there — a checksum ledger that go get/go build only ever append to, so its last-occurrence-wins parse can surface a version still recorded in the file but no longer selected by Go’s MVS). Shared by deps-lsp’s OSV target selection, its yanked-version check, and the yanked-diagnostic consistency check in super::diagnostics::generate_diagnostics_from_cache (#394 S1) — all three need “what version does the user actually have” for the same reason: querying a fabricated version produces a silent false negative.

Examples

use deps_core::lsp_helpers::{
    DiagnosticMessages, DiagnosticPolicy, OsvNaming, PackageNaming, PackageRendering,
    RequirementResolution, SourcePolicy, in_use_version,
};
use deps_core::{ConcreteVersion, Dependency, EcosystemId, PackageName, VersionReq};
use std::any::Any;
use std::collections::HashMap;
use tower_lsp_server::ls_types::Range;

struct SimpleDep {
    name: PackageName,
    version_req: Option<VersionReq>,
}

impl Dependency for SimpleDep {
    fn name(&self) -> &PackageName {
        &self.name
    }
    fn name_range(&self) -> Range {
        Range::default()
    }
    fn version_requirement(&self) -> Option<&VersionReq> {
        self.version_req.as_ref()
    }
    fn version_range(&self) -> Option<Range> {
        None
    }
    fn source(&self) -> deps_core::parser::DependencySource {
        deps_core::parser::DependencySource::Registry
    }
    fn as_any(&self) -> &dyn Any {
        self
    }
}

struct SimpleFormatter;
impl PackageNaming for SimpleFormatter {}
impl PackageRendering for SimpleFormatter {
    fn format_version_for_text_edit(&self, version: &ConcreteVersion) -> String {
        version.to_string()
    }
    fn package_url(&self, name: &PackageName) -> String {
        name.to_string()
    }
}
impl RequirementResolution for SimpleFormatter {}
impl DiagnosticMessages for SimpleFormatter {}
impl DiagnosticPolicy for SimpleFormatter {}
impl SourcePolicy for SimpleFormatter {}
impl OsvNaming for SimpleFormatter {}

let dep = SimpleDep {
    name: PackageName::new("time"),
    version_req: Some(VersionReq::new("=0.1.43")),
};
let resolved_versions: HashMap<PackageName, ConcreteVersion> = HashMap::new();

// No lock file, but the requirement is already an exact pin — falls
// back to it, stripped of its `=` marker.
assert_eq!(
    in_use_version(&dep, "time", &resolved_versions, &SimpleFormatter, EcosystemId::Cargo),
    Some("0.1.43".to_string())
);