[56_maintenance] Fix cargo_audit: Pin cargo-msrv and Cargo.lock in CI#9902
Merged
Conversation
alamb
force-pushed
the
alamb/fix_56_cargo_msrv
branch
from
afa70c6 to
0930939
Compare
alamb
changed the title
alamb
force-pushed
the
alamb/fix_56_cargo_msrv
branch
2 times, most recently
from
1d40d28 to
24d81da
Compare
alamb
force-pushed
the
alamb/fix_56_cargo_msrv
branch
from
24d81da to
8de8731
Compare
This was referenced May 5, 2026
viirya
approved these changes
May 5, 2026
Contributor
Author
|
Thank you @viirya |
alamb
added a commit
that referenced
this pull request
May 7, 2026
NOTE: All of this PR is `Cargo.lock`. I swear it is easy to review... # Which issue does this PR close? - Closes #9938. - Modeled on #9902. # Rationale for this change The guidance on lock files from the Cargo folks changed a while ago: https://blog.rust-lang.org/2023/08/29/committing-lockfiles/ The MSRV check is failing on `main` because dependency resolution currently uses the latest compatible versions from crates.io for each package. The newest `tonic` release now require a newer Rust version than the workspace MSRV. Here is the reported CI failure: https://github.com/apache/arrow-rs/actions/runs/25472344356/job/74738606768 ```text error: rustc 1.85.0 is not supported by the following packages: [email protected] requires rustc 1.88 [email protected] requires rustc 1.88 ``` # What changes are included in this PR? This PR checks in a root `Cargo.lock` so CI verifies MSRV against the dependency set we control, rather than the tip of all dependency ranges. The generated lockfile pins the `tonic` 0.14 crates to `0.14.5`, which supports Rust 1.85. Note this does not change code in the crates. It only pins dependency resolution for workspace builds and CI. This will result in more dependabot PRs to explicitly update the crate versions, but I think that is a good thing. I think the existing config file will work fine https://github.com/apache/arrow-rs/blob/main/.github/dependabot.yml # Are these changes tested? Yes, by CI This passed locally with Rust 1.85.0. # Are there any user-facing changes? No. This only checks in the root lockfile used for dependency resolution in workspace builds and CI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NOTE: almost all of this PR is
Cargo.lockfiles. I swear it is easy to review...56.2.1(May 2026) #9857Rationale
The MSRV check is failing on 56 (I saw on #989) due to the fact that many of arrow's dependencies have upgraded to a newer version of rust that has a newer MSRV.
Here is an example CI fail https://github.com/apache/arrow-rs/actions/runs/25373570591/job/74402867748?pr=9896
This PR:
cargo-msrvin the56_maintenanceMSRV CI job to a version compatible with the Rust toolchain used by the jobNote this doesn't actually change any code in this crate. It simply updates the CI enough to get the tests to pass