Should public_private_dependencies consider unreachable visibility?

[ehuss]

I tried this code:

mod foo {
    pub fn example() -> regex::Regex {
        regex::Regex::new("test").unwrap()
    }
}

pub fn x() {
    foo::example();
}

with cargo's public-dependency feature enabled, and regex is a private dependency.

I expected to see this happen: No warning

Instead, this happened: Generated a warning about the dependency in a public interface, but there is no exposure of the dependency in the public interface.

warning: type `regex::Regex` from private dependency 'regex' in public interface
 --> src/lib.rs:2:5
  |
2 |     pub fn example() -> regex::Regex {
  |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: `#[warn(exported_private_dependencies)]` on by default

In #44663 (comment), bjorn3 mentioned:

We consider any pub item to be public, even if not actually reachable. This is also why for example mod sealed { pub trait Sealed {} } pub trait MyTrait: Sealed {} is allowed despite Sealed not being reachable.

However, I'm not sure I completely agree with that reasoning. In the example above, there is no exposure of the private dependency in any types. This would make more sense if unreachable-pub was on by default, but it's not. Although I can sympathize that unreachable pub is probably bad form, it is very common in Rust code and would be a significant hurdle for false-positives of exported_private_dependencies.

Meta

rustc 1.83.0-nightly (9c01301c5 2024-09-05)