From bf6128008d7d93263fbffda8c3446fdfd51072fe Mon Sep 17 00:00:00 2001 From: Roderick Mendoza Date: Sat, 8 Aug 2026 22:30:08 -0500 Subject: [PATCH] =?UTF-8?q?docs(deps):=20defer=20sqlx=200.9=20=E2=80=94=20?= =?UTF-8?q?version-coupled=20public=20API=20plus=20a=201.94=20rustc=20floo?= =?UTF-8?q?r=20over=20the=201.81=20MSRV?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Assessment verdict for the dependency-currency follow-up filed by the tower-http/validator pass: sqlx stays at 0.8. Coupling, read from the source: impl From for ApiError (src/error.rs:318-338) is the crate's only sqlx-gated surface and puts sqlx::Error in the public API for sqlx-feature users, so a hard 0.9 bump is a semver major for them (the 2.0.0 route). The widen instrument that saved tower-http is blocked here by MSRV: sqlx 0.9.0 declares rust-version 1.94.0 (registry + its own changelog), thirteen minors above this crate's 1.81 floor, so >=0.8,<0.10 would hand fresh-resolving 1.81-1.93 consumers an unbuildable match — the false-declared-MSRV class 2.1.0 corrected. Candidate 3.0 driver, or rides an MSRV raise to >=1.94. Recorded in ROADMAP.md's dependency watch (dated) and CHANGELOG [Unreleased], mirroring the validator 0.21 deferral. No code change. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 9 +++++++++ ROADMAP.md | 1 + 2 files changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c78edc4..7aabced 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -70,6 +70,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 is therefore a candidate 3.0 driver plus an MSRV raise, deferred until a major is warranted; assessed 2026-08-08, recorded in `ROADMAP.md`'s dependency watch. +- `sqlx` stays at `0.8`, deliberately: `sqlx::Error` is version-coupled into + the public API for `sqlx`-feature users (`impl From for ApiError`), + so a hard `0.9` bump is a semver major for them — and unlike tower-http, the + widen instrument is also blocked, because `sqlx 0.9.0` declares + `rust-version = "1.94.0"`, far above this crate's 1.81 MSRV floor: a widened + range would hand fresh-resolving 1.81-1.93 consumers an unbuildable resolver + match, the false-declared-MSRV failure 2.1.0 corrected. A 0.9 adoption is a + candidate 3.0 driver, or rides a future MSRV raise to >=1.94; assessed + 2026-08-08, recorded in `ROADMAP.md`'s dependency watch. ## [2.1.0] - 2026-08-08 diff --git a/ROADMAP.md b/ROADMAP.md index ad4a579..0743d32 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -85,6 +85,7 @@ Both deferred 1.3.0 features shipped as the planned two PRs (PR #2: Accept-heade Background stream: pick these up when they unblock feature work or upstream ships something relevant. Respect the cadence of at most roughly one minor version per week, and only release when there is something to ship. - Periodically check for new axum, tower-http, utoipa, validator, and sqlx releases; widen bounds and fix deprecations in a small PR when upstream ships a compatible minor. - Assessment on record, 2026-08-08 (both upstream majors surfaced by the v2.1.0 cut's lockfile generation; each judged against the Dependencies policy above): **tower-http 0.7.0** — WIDENED (`>=0.6, <0.8`) rather than bumped, because `cors_allowing`/`cors_permissive` publicly return `tower_http::cors::CorsLayer`, making a hard bump a public-type-identity break for consumers whose own `tower-http = "0.6"` names it, while a widen unifies with either side; rustc floor 1.65 (under the 1.81 MSRV), cors module unchanged in 0.7 apart from relaxed `Vary` defaults (tower-http #674), all 0.7.0 breaking changes confined to modules this crate does not use. **validator 0.21.0** — DEFERRED, two independent blockers measured at the registry: it declares `rust-version = "1.88"` (above the 1.81 floor, so a bump forces an MSRV raise), and the `Validate` bound is version-coupled into the public API for `validator`-feature users (the exact route that made 2.0.0 a major). A validator 0.21+ bump is a candidate **3.0 driver** and does not happen inside 2.x; re-assess only when a major is otherwise warranted. +- Assessment on record, 2026-08-08 (surfaced by the tower-http/validator PR's own lockfile generation; judged against the Dependencies policy above): **sqlx 0.9.0** — DEFERRED at `0.8`. The coupling determination, read from the source rather than inherited: `sqlx::Error` IS version-coupled into the public API for `sqlx`-feature users via `#[cfg(feature = "sqlx")] impl From for ApiError` (src/error.rs:318-338, the crate's only sqlx-gated surface; no `pub use sqlx` re-export exists), so a hard `0.8 -> 0.9` bump changes which `sqlx::Error` that impl accepts and is a semver **major** for feature users — the exact route that made 2.0.0 a major. The instrument that avoids the major, a tower-http-style widen (`>=0.8, <0.10`), is ALSO blocked, by MSRV rather than by API: sqlx 0.9.0 declares `rust-version = "1.94.0"` at the registry (its own changelog names 1.94.0 as the release cycle's supported floor), thirteen minors above this crate's declared 1.81 — so a widened range would hand any fresh-resolving 1.81-1.93 consumer a resolver match on 0.9.0 followed by a compile failure, which is precisely the false-declared-MSRV failure class (2.0.0's `rust-version = "1.75"` over an effective 1.81 floor) that 2.1.0 exists to correct. Usage-level compatibility of the `From` impl against 0.9's `Error` was NOT fully assessed because it is moot below the MSRV blocker; 0.9.0's changelog names no breaking change to the `Error` variants the impl matches (its error-adjacent entry, #3918, is an additive exclusion-violation kind). A sqlx 0.9 adoption is therefore a candidate **3.0 driver**, or rides an MSRV raise to >=1.94 (minor under the Semver policy but needing its own justification); re-assess only when either is otherwise warranted. (`matchit`, the other newer package in that lockfile generation, is axum's transitive dependency, not ours — re-verified against `[dependencies]`, nothing to assess.) - Confirm CI is green and docs build; fix only actual breakage, no feature work. - If axum announces 0.9 or 1.0: write a short impact assessment as its own PR before any code changes (this is the designated major trigger). - Resulting releases run under the release delegation above (2026-07-26).