Fix another issue of poisoning too eagerly

This commit extends the fix in rust-lang#5288 by moving the logic added farther up in the
loop over package dependencies. This means that we won't recursively look at
optional/dev path dependencies which aren't members of the workspace. This
should fix the new issue that came up in rust-lang#5257

Closes rust-lang#5257

src/cargo/ops/resolve.rs

@@ -445,21 +445,6 @@ fn register_previous_locks<'a>(
             continue;
         }
         for dep in member.dependencies() {
-            let source = dep.source_id();
-
-            // If this is a path dependency then try to push it onto our
-            // worklist
-            if let Some(pkg) = path_pkg(source) {
-                path_deps.push(pkg);
-                continue;
-            }
-
-            // If we match *anything* in the dependency graph then we consider
-            // ourselves A-OK and assume that we'll resolve to that.
-            if resolve.iter().any(|id| dep.matches_ignoring_source(id)) {
-                continue;
-            }
-
             // If this dependency didn't match anything special then we may want
             // to poison the source as it may have been added. If this path
             // dependencies is *not* a workspace member, however, and it's an
@@ -477,9 +462,26 @@ fn register_previous_locks<'a>(
                 continue
             }
 
+            // If this is a path dependency then try to push it onto our
+            // worklist
+            if let Some(pkg) = path_pkg(dep.source_id()) {
+                path_deps.push(pkg);
+                continue;
+            }
+
+            // If we match *anything* in the dependency graph then we consider
+            // ourselves A-OK and assume that we'll resolve to that.
+            if resolve.iter().any(|id| dep.matches_ignoring_source(id)) {
+                continue;
+            }
+
             // Ok if nothing matches, then we poison the source of this
             // dependencies and the previous lock file.
-            for id in resolve.iter().filter(|id| id.source_id() == source) {
+            debug!("poisoning {} because {} looks like it changed {}",
+                   dep.source_id(),
+                   member.package_id(),
+                   dep.name());
+            for id in resolve.iter().filter(|id| id.source_id() == dep.source_id()) {
                 add_deps(resolve, id, &mut avoid_locking);
             }
         }

tests/testsuite/freshness.rs

@@ -1065,3 +1065,60 @@ fn unused_optional_dep() {
         execs().with_status(0).with_stderr("[FINISHED] [..]"),
     );
 }
+
+#[test]
+fn path_dev_dep_registry_updates() {
+    Package::new("registry1", "0.1.0").publish();
+    Package::new("registry2", "0.1.0").publish();
+
+    let p = project("p")
+        .file(
+            "Cargo.toml",
+            r#"
+                [package]
+                name = "p"
+                authors = []
+                version = "0.1.0"
+
+                [dependencies]
+                foo = { path = "foo" }
+            "#,
+        )
+        .file("src/lib.rs", "")
+        .file(
+            "foo/Cargo.toml",
+            r#"
+                [package]
+                name = "foo"
+                version = "0.1.1"
+                authors = []
+
+                [dependencies]
+                registry1 = "*"
+
+                [dev-dependencies]
+                bar = { path = "../bar"}
+            "#,
+        )
+        .file("foo/src/lib.rs", "")
+        .file(
+            "bar/Cargo.toml",
+            r#"
+                [package]
+                name = "bar"
+                version = "0.1.1"
+                authors = []
+
+                [dependencies]
+                registry2 = "*"
+            "#,
+        )
+        .file("bar/src/lib.rs", "")
+        .build();
+
+    assert_that(p.cargo("build"), execs().with_status(0));
+    assert_that(
+        p.cargo("build"),
+        execs().with_status(0).with_stderr("[FINISHED] [..]"),
+    );
+}