Add a note to the FAQ about * for library dependencies

Fixes #1870

diff --git a/src/doc/faq.md b/src/doc/faq.md
index 8b9b9e5d616f785dab700313f90b39c9ede7d8ca..fc1d9416ebc570e0dd5ea3e93c9193e5da904d76 100644 (file)
--- a/src/doc/faq.md
+++ b/src/doc/faq.md
@@ -128,6 +128,13 @@ In other words, libraries specify semver requirements for their dependencies but
 cannot see the full picture. Only end products like binaries have a full
 picture to decide what versions of dependencies should be used.
 
+# Can libraries use `*` as a version for their dependencies?
+
+While they _can_, strictly speaking, they should not. A version requirement
+of `*` says “This will work with every version ever,” which is never going
+to be true. Libraries should always specifiy the range that they do work with,
+even if it’s something as general as “every 1.x.y version.”
+
 # Why `Cargo.toml`?
 
 As one of the most frequent interactions with Cargo, the question of why the