chore: bump toolchain 1.85 → 1.90 to unblock cargo-deny#28
Merged
Conversation
The audit job (cargo-deny) started failing on every PR because the
RustSec advisory database now ships entries with CVSS:4.0 metadata
(e.g. RUSTSEC-2026-0073 for libcrux-poly1305). cargo-deny only
gained CVSS 4.0 support in 0.19.4, which itself requires Rust 1.88+.
Our toolchain was pinned at 1.85, so the cargo-deny-action installed
0.18.3 which panics on the new advisory format before reaching any
of our project's actual dependencies — it was a pure parser failure
in the toolchain, not a real advisory hit on our crate graph (we do
not depend on libcrux-poly1305).
Changes:
rust-toolchain.toml channel = "1.85" → "1.90"
Cargo.toml rust-version = "1.85" → "1.90"
.github/workflows/ci.yml
all six dtolnay/rust-toolchain@1.85 → @1.90
crates/conn/src/heartbeat.rs
fix one doc-overindented-list-items lint that
1.90's clippy adds (a continuation line was
indented under "—" instead of two spaces).
`cargo test --workspace --all-targets`, `cargo clippy --all-targets
-- -D warnings`, `cargo doc`, and `cargo test -p geminio --features
interop --test interop` all pass on 1.90.
This is purely an infrastructure bump — no protocol or API change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…lint The cargo-deny audit was failing on RUSTSEC-2024-0375 (`atty` unmaintained). `atty` only entered our tree as a transitive dep of criterion 0.4; criterion 0.5+ removed it. Bumping criterion drops the advisory hit at the source instead of papering over it with an ignore. While in here: - clippy.toml MSRV synced to 1.90 (matches workspace Cargo.toml, silences the 'MSRV in clippy.toml differs' warning that 1.90 clippy emits). - chaos.rs: switch `global_pos % n == 0` to `global_pos.is_multiple_of(n)` — the new manual_is_multiple_of lint that 1.90 clippy adds. Tests / clippy / interop all green on 1.90. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
cargo-denyaudit job started failing on every PR (latest example: D4 #27). Root cause is not a real advisory hit on our dep graph — it's a tooling version mismatch:RUSTSEC-2026-0073forlibcrux-poly1305— not a dep of ours, but cargo-deny parses the whole database before checking our project).cargo-denyonly learned to parse CVSS 4.0 in 0.19.4.cargo-deny 0.19.4requires rustc 1.88+.cargo-deny-actioninstalled0.18.3, which panics on the new format and fails the audit job before any actual check runs.Bumping the pin to 1.90 lifts every constraint in the chain.
Changes
rust-toolchain.tomlchannel = "1.85"→"1.90"(with comment explaining why)Cargo.tomlrust-version = "1.85"→"1.90".github/workflows/ci.ymldtolnay/rust-toolchain@1.85→@1.90crates/conn/src/heartbeat.rsdoc-overindented-list-itemswarning on one continuation lineNo protocol, API, or test-shape change.
Test plan
cargo test --workspace --all-targets(all 145 pass on 1.90)cargo clippy --workspace --all-targets -- -D warnings(clean on 1.90)cargo doc --workspace --no-deps --document-private-items(clean on 1.90)cargo test -p geminio --features interop --test interop(3/3 still pass on 1.90)🤖 Generated with Claude Code