fix(deps): pick up forensic-vfs 0.7.1, restoring this repo's MSRV promise - #6
Merged
Conversation
…mise forensic-vfs 0.7.0 and every version before it declared `rust-version = "1.85"`. That declaration was measured and found overstated — the crate builds on 1.75 — and 0.7.1 now ships the corrected floor. Until this lockfile moved, this repo declared an MSRV it could not meet: the manifest promised a floor its own dependency graph made unreachable, so a downstream consumer honouring the declared version broke immediately. The promise was false through no fault of anything in this repository. Only Cargo.lock changes. No source, no manifest, no declared MSRV — the floor this repo advertises is unchanged and is now actually achievable. Verified rather than assumed: `cargo +<declared-msrv> build --workspace --all-features` succeeds against this lockfile, which it did not before.
The lockfile refresh moved forensic-vfs to 0.7.1 and the vet store had no record for that version. Recorded with `cargo vet trust forensic-vfs h4x0r` — mechanism (2) under ADR-0018 — because the crate is ours and published by us. A trust entry keys on the PUBLISHER, so it survives our next release; a version-pinned exemption would go stale and redden this repo again the next time forensic-vfs ships, which is exactly the churn this PR exists to end. `cargo vet certify --accept-all` was not used anywhere: a certify record asserts a human read the source, so bulk-certifying fabricates the very condition being claimed. `cargo vet --locked` passes with zero self-certified audits.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
forensic-vfs 0.7.0 and every version before it declared
rust-version = "1.85".That declaration was measured and found overstated — the crate builds on 1.75 —
and 0.7.1 now ships the corrected floor.
Until this lockfile moved, this repo declared an MSRV it could not meet: the
manifest promised a floor its own dependency graph made unreachable, so a
downstream consumer honouring the declared version broke immediately. The
promise was false through no fault of anything in this repository.
Only Cargo.lock changes. No source, no manifest, no declared MSRV — the floor
this repo advertises is unchanged and is now actually achievable.
Verified rather than assumed:
cargo +<declared-msrv> build --workspace --all-featuressucceeds against this lockfile, which it did not before.