Update dependencies #3107
Update dependencies #3107
Conversation
Cargo.toml
Outdated
| lazy_static = "1.4.0" | ||
| # Require a version of serde without intransparent unreproducible binary blobs. | ||
| serde = { version = "1.0.185", features = ["derive"] } | ||
| serde = { version = "1.0.188", features = ["derive"] } |
There was a problem hiding this comment.
Why this change? This is still the same semver bracket.
(Also applies for some of the other toml file changes)
There was a problem hiding this comment.
What is the criterion? Specify the latest version available at the time the dependency is added and keep it frozen forever in Cargo.toml and only update it in Cargo.lock?
There was a problem hiding this comment.
That's what we did so far. If we want something more principled it should be the minimum number that works (and we should have a CI job that uses minimal-version resolution -- which might nor work since some widely used ecosystem crates historically didn't care for working builds under minimal versions).
|
Thanks! |
|
☀️ Test successful - checks-actions |
| dependencies = [ | ||
| "libc", | ||
| "option-ext", |
There was a problem hiding this comment.
option-ext has a license that rustc's tidy doesn't like... I'm going to partially revert this PR until we figure that out.
No description provided.