Improve --suggest-fix: Better adherence to restrictions

Cargo.toml

@@ -28,6 +28,9 @@ ureq = { version = "3", features = ["rustls", "json"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 anyhow = "1"
+semver = "1.0.28"
+glob = "0.3.4"
+cargo_toml = "1.0.1"
 
 [dev-dependencies]
 tempfile = "3"

README.md

@@ -28,11 +28,33 @@ cargo-oxidate Cargo.lock --min-age-days 14 --max-age-days 730
 | `--exclude-missing` | Don't flag packages with unknown publish dates |
 | `--timeout N` | HTTP timeout in seconds (default: 10) |
 | `--suggest-fix` | For "too new" violations, suggest `cargo update` commands to downgrade |
+| `--include-prerelease` | Consider prerelease versions as suggestion candidates (requires `--suggest-fix`) |
 | `--cache-path PATH` | Enable response caching at PATH (or set `CARGO_OXIDATE_CACHE_PATH`) |
 | `--cache-max-age-hours N` | Max age for cached version listings (default: 24) |
 
 At least one of `--min-age-days` or `--max-age-days` must be specified.
 
+## `--suggest-fix`
+
+For every "too new" violation, `--suggest-fix` walks candidate versions newest to oldest,
+within the same compatible range as the version currently locked, and suggests the first one
+that satisfies every version requirement currently placed on that package — from other packages
+in `Cargo.lock` (checked against the crates.io index) and from your own `Cargo.toml` manifests,
+workspace members included. Every printed `cargo update` command is one cargo will accept.
+
+Source-level compatibility — whether the project still compiles — is not checked, since that
+would require a build. Build after applying a suggestion.
+
+A package with no candidate that satisfies every requirement is reported separately, naming the
+package and requirement standing in the way, so you know what would have to change. Since each
+suggestion is computed independently against the current lockfile, apply them top to bottom and
+re-run.
+
+`--include-prerelease` allows a prerelease version to be suggested. Under semver, a requirement
+only matches a prerelease when it names the identical `major.minor.patch` with a prerelease part
+of its own, so this rarely changes the outcome for a package with real dependents — expect it to
+matter only for a package with no lockfile dependents, or one already tracking a prerelease line.
+
 ## Exit Codes
 
 - `0` — No violations found