search

mongodb / bson-rust

Encoding and decoding support for BSON in Rust
MIT License
400 stars 132 forks source link

RUST-1780 Bump MSRV to 1.61.0, upgrade `ahash` to 0.8.5 in `Cargo.lock.msrv` #436

Closed stIncMale closed 11 months ago

stIncMale commented 11 months ago

ahash 0.8.3 and older were yanked because of a security vulnerability, and 0.8.4 (with a bug) and 0.8.5 were released to address that. ahash 0.8.5 requires Rust 1.61+. As a result, the Evergreen task for mongo-rust-driver that checks MSRV compilation started to fail.

https://github.com/mongodb/mongo-rust-driver/pull/981 is the corresponding PR in mongo-rust-driver.

RUST-1780

stIncMale commented 11 months ago

According to README.md, the MSRV can only be changed in a minor or major release. Should the bson-rust version be updated to 2.8.0 in this PR, or do you usually update it separately?

abr-egn commented 11 months ago

According to README.md, the MSRV can only be changed in a minor or major release. Should the bson-rust version be updated to 2.8.0 in this PR, or do you usually update it separately?

Nope, just make sure to tag RUST-1780 with the 2.8.0 fix version so we include the MSRV being bumped in the release notes for that.

stIncMale commented 11 months ago

tag RUST-1780 with the 2.8.0 fix version

@abr-egn Should I also create bson-2.8.0, so that RUST-1780 is tagged with both 2.8.0 and bson-2.8.0? I also noticed that there is bson-3.0.0, and there are already tickets tagged with it.

abr-egn commented 11 months ago

Should I also create bson-2.8.0, so that RUST-1780 is tagged with both 2.8.0 and bson-2.8.0? I also noticed that there is bson-3.0.0, and there are already tickets tagged with it.

Oh, yup, tagging with bson-2.8.0 would be good. We only tag tickets for 3.0.0 or bson-3.0.0 if they would be breaking changes, it's a convenient way to keep track of what needs to be done when we decide it's time for a major version release.