chore: bump the patch group with 2 updates - #6132
Conversation
Bumps the patch group with 2 updates: [mdbook-core](https://github.com/rust-lang/mdBook) and [mdbook-preprocessor](https://github.com/rust-lang/mdBook). Updates `mdbook-core` from 0.5.2 to 0.5.4 - [Release notes](https://github.com/rust-lang/mdBook/releases) - [Changelog](https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md) - [Commits](rust-lang/mdBook@v0.5.2...v0.5.4) Updates `mdbook-preprocessor` from 0.5.2 to 0.5.4 - [Release notes](https://github.com/rust-lang/mdBook/releases) - [Changelog](https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md) - [Commits](rust-lang/mdBook@v0.5.2...v0.5.4) --- updated-dependencies: - dependency-name: mdbook-core dependency-version: 0.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: mdbook-preprocessor dependency-version: 0.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch ... Signed-off-by: dependabot[bot] <support@github.com>
prql-bot
left a comment
prql-bot
left a comment
There was a problem hiding this comment.
This bump breaks the declared MSRV. mdbook-core 0.5.4 requires toml ^1.1.2, which requires indexmap ^2.13.0 — and every indexmap ≥ 2.12 declares rust-version above 1.81 (2.12/2.13 → 1.82, 2.14 → 1.85). indexmap is not confined to the book: prqlc reaches it through serde_yaml, so the whole workspace inherits the floor.
prqlc declares metadata.msrv = "1.81.0" (prqlc/prqlc/Cargo.toml, mirroring rust-version in the workspace Cargo.toml), and test-msrv runs on this PR — Cargo.lock is in the nightly paths-filter — so I'd expect it to go red. It was still queued when this review was written, so this is from a local reproduction rather than from the CI result.
There's no lockfile-only way out: pinning indexmap back fails resolution, so the choice is to hold the mdbook bump or raise the MSRV to 1.85. Raising a published crate's MSRV is a maintainer call, so I haven't pushed either. Happy to push whichever you prefer.
Worth noting that .cargo/config.toml sets resolver.incompatible-rust-versions = "fallback", so this isn't a Dependabot-specific artifact — a local cargo update -p mdbook-core -p mdbook-preprocessor produces the identical lockfile, with cargo reporting the 1.85 requirement and taking it anyway because no compatible alternative satisfies toml's constraint.
Reproduction
cargo tree under 1.81, base lockfile vs. this PR's:
# base (b787ce2e8ef8ab9aa3091f996d05b4ca4ecd38c1)
$ cargo +1.81.0 tree --locked -e normal # in prqlc/prqlc
exit=0
# this PR (db4e18984aa9a23e4c945aa241194a56aa3834cc)
$ cargo +1.81.0 tree --locked -e normal # in prqlc/prqlc
error: failed to download `hashbrown v0.17.1`
Caused by:
feature `edition2024` is required
cargo check under 1.81 fails the same way, at manifest parse of hashbrown-0.17.1.
Why indexmap can't be held back:
$ cargo update -p indexmap --precise 2.11.4
error: failed to select a version for the requirement `indexmap = "^2.13.0"`
candidate versions found which didn't match: 2.11.4
required by package `toml v1.1.4+spec-1.1.0`
... which satisfies dependency `toml = "^1.1.2"` of package `mdbook-core v0.5.4`
Reproducing the lockfile locally, with the repo's own resolver config:
$ cargo update -p mdbook-core -p mdbook-preprocessor
Locking 7 packages to latest Rust 1.81.0 compatible versions
Adding hashbrown v0.17.1 (requires Rust 1.85.0)
Updating indexmap v2.11.4 -> v2.14.0 (requires Rust 1.85)
rust-version per indexmap release, from the crates.io index: 2.11.4 → 1.63, 2.12.0–2.13.1 → 1.82, 2.14.0 → 1.85.
Reverse dependency path pulling indexmap into prqlc:
indexmap v2.14.0
└── serde_yaml v0.9.34+deprecated
├── prqlc
└── prqlc-parser
└── prqlc
1 participant
Bumps the patch group with 2 updates: mdbook-core and mdbook-preprocessor.
Updates
mdbook-corefrom 0.5.2 to 0.5.4Release notes
Sourced from mdbook-core's releases.
Changelog
Sourced from mdbook-core's changelog.
... (truncated)
Commits
2ea30c0Merge pull request #3155 from ehuss/bump-versiona08ba2bBump version to 0.5.40e5ddf6Merge pull request #3154 from ehuss/ci-version-stringf4ddbffShow the correct version in CI install docs8b53f1bMerge pull request #3127 from GuillaumeGomez/zoom-inbeab2faMention zoom-in feature in mdbook guide588066cMake the "zoom in" feature work with keyboard and simplify DOMf526b18Only enable "zoom-in" feature on images not inside links73d6edfAdd possibility to "zoom out" using the escape key6a7ef4dAdd regression test for the "zoom-in" featureUpdates
mdbook-preprocessorfrom 0.5.2 to 0.5.4Release notes
Sourced from mdbook-preprocessor's releases.
Changelog
Sourced from mdbook-preprocessor's changelog.
... (truncated)
Commits
2ea30c0Merge pull request #3155 from ehuss/bump-versiona08ba2bBump version to 0.5.40e5ddf6Merge pull request #3154 from ehuss/ci-version-stringf4ddbffShow the correct version in CI install docs8b53f1bMerge pull request #3127 from GuillaumeGomez/zoom-inbeab2faMention zoom-in feature in mdbook guide588066cMake the "zoom in" feature work with keyboard and simplify DOMf526b18Only enable "zoom-in" feature on images not inside links73d6edfAdd possibility to "zoom out" using the escape key6a7ef4dAdd regression test for the "zoom-in" featureDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions