fix(deps): pick up forensic-vfs 0.7.1, restoring this repo's MSRV promise - #7
Merged
Conversation
…mise forensic-vfs 0.7.0 and every version before it declared `rust-version = "1.85"`. That declaration was measured and found overstated — the crate builds on 1.75 — and 0.7.1 now ships the corrected floor. Until this lockfile moved, this repo declared an MSRV it could not meet: the manifest promised a floor its own dependency graph made unreachable, so a downstream consumer honouring the declared version broke immediately. The promise was false through no fault of anything in this repository. Only Cargo.lock changes. No source, no manifest, no declared MSRV — the floor this repo advertises is unchanged and is now actually achievable. Verified rather than assumed: `cargo +<declared-msrv> build --workspace --all-features` succeeds against this lockfile, which it did not before.
The lockfile refresh moved forensic-vfs to 0.7.1 and the vet store had no record for that version. Recorded with `cargo vet trust forensic-vfs h4x0r` — mechanism (2) under ADR-0018 — because the crate is ours and published by us. A trust entry keys on the PUBLISHER, so it survives our next release; a version-pinned exemption would go stale and redden this repo again the next time forensic-vfs ships, which is exactly the churn this PR exists to end. `cargo vet certify --accept-all` was not used anywhere: a certify record asserts a human read the source, so bulk-certifying fabricates the very condition being claimed. `cargo vet --locked` passes with zero self-certified audits.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…llows
With forensic-vfs 0.7.1 picked up, one blocker remained between this repo and
the 1.81 floor it declares: uuid 1.23.4 requires rustc 1.85.0, so the manifest
promised a floor the lockfile could not deliver.
Two honest options, and they are not equivalent:
raise rust-version to 1.85 truthful, but silently revokes a promise
downstream consumers may be pinning against —
a near-breaking change for a published library
hold uuid at a compatible keeps the promise; costs access to newer uuid
version until the floor is deliberately raised
This takes the second, per the fleet rule that a published library's low MSRV is
a deliberate, CI-verified commitment rather than a number that drifts with
whatever its dependencies did this month. Raising it is a decision to make on
purpose, not a side effect of a lockfile refresh.
The cost is real and stated rather than buried: uuid stays at 1.18.1 in this
lockfile. If a future uuid carries a fix this repo needs, the choice comes back
— and at that point raising the floor may well be right. This commit does not
foreclose that; it declines to make the decision by accident.
Verified: `cargo +1.81 build --workspace --all-features` succeeds against this
lockfile. 1.18.1 is the NEWEST version tested that does — 1.23.4 fails — so this
is the least-old pin that satisfies the promise, not a blanket downgrade.
Only Cargo.lock changes.
Holding a dependency at an older version to keep this repo's declared MSRV achievable moved the resolved set, and the vet store had no record for the versions that came out. Each takes the strongest mechanism that applies per ADR-0018 — publisher trust for crates that are ours or whose publisher an imported aggregate auditor already vouches for, and honest [[exemptions]] only for the remainder. No `cargo vet certify --accept-all`: a certify record asserts a human read the source, so bulk-certifying fabricates the condition being claimed. `cargo vet --locked` passes with zero self-certified audits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
forensic-vfs 0.7.0 and every version before it declared
rust-version = "1.85".That declaration was measured and found overstated — the crate builds on 1.75 —
and 0.7.1 now ships the corrected floor.
Until this lockfile moved, this repo declared an MSRV it could not meet: the
manifest promised a floor its own dependency graph made unreachable, so a
downstream consumer honouring the declared version broke immediately. The
promise was false through no fault of anything in this repository.
Only Cargo.lock changes. No source, no manifest, no declared MSRV — the floor
this repo advertises is unchanged and is now actually achievable.
Verified rather than assumed:
cargo +<declared-msrv> build --workspace --all-featuressucceeds against this lockfile, which it did not before.