Can't build 0.23.0

[fooooooooooooooo]

tracing 0.1.38 was yanked, so the latest version doesn't build

error: failed to compile `cargo-binstall v0.23.0`

Caused by:
  failed to select a version for the requirement `tracing = "^0.1.38"`
  candidate versions found which didn't match: 0.1.37, 0.1.36, 0.1.35, ...
  location searched: crates.io index
  required by package `cargo-binstall v0.23.0`

[NobodyXu]

Thank you for notifying me on this!

I will wait for upstream to publish a new patch release.

Once it's published, I will update the lockfile and create another patch release for cargo-binstall.

[passcod]

In the meantime, it will build with --locked.

[qm3ster]

Potentially valuable: the yank was not due to any security issues, but because it didn't follow semver due to Drop bound.
So if your crate builds with this version, it's completely fine.

[beanow-at-crabnebula]

Looks like there may be more.

$ cargo install cargo-binstall --locked
    Updating crates.io index
  Installing cargo-binstall v0.23.0
warning: package `bumpalo v3.12.1` in Cargo.lock is yanked in registry `crates-io`, consider running without --locked
warning: package `tokio-stream v0.1.13` in Cargo.lock is yanked in registry `crates-io`, consider running without --locked
warning: package `tracing v0.1.38` in Cargo.lock is yanked in registry `crates-io`, consider running without --locked

[NobodyXu]

bumpalo and tokio-stream both released a new version after yank, so once we release a new version these warnings won't pop up.

For tracing, the upstream still hasn't released a new version yet, so maybe we can revert it and then make a release.

[passcod]

i'd be in favour of reverting

[beanow-at-crabnebula]

I wondered whether the --locked install now pulls in dependencies that are yanked for concerning reasons.

Seems that tokio-stream needed a version bump of it's dependencies to compile a specific feature.
Though I couldn't find a specific issue to explain the yank.

https://github.com/tokio-rs/tokio/blob/398dfda56d3ee4b0d4d9e86abe15039e86979d83/tokio-stream/CHANGELOG.md#0114-april-26th-2023

For bumpalo fitzgen/bumpalo#208 TL;DR the rust-version metadata was missing so incompatible rust toolchains would install and fail to compile this version.

[NobodyXu]

@beanow-at-crabnebula For tokio-stream, that's explained in tokio-rs/tokio#5655

TL; DR: They forgot to bump tokio dep in tokio-stream v0.1.13

[beanow-at-crabnebula]

Thanks for the patch :]
Just asking, is the intention to publish a patch release for this?

[NobodyXu]

Just asking, is the intention to publish a patch release for this?

Yes, I may try to finish a few other issues before publishing a new release, or go straight for a patch release if you'd like

[NobodyXu]

@fooooooooooooooo @qm3ster @beanow-at-crabnebula cargo-binstall v0.23.1 has released!