From 0b8918cd5f8f95cb06d7f6afc17db6106b598df7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Einar=20Fl=C3=B8ystad=20D=C3=B8rum?= Date: Wed, 26 Aug 2026 23:48:38 +0200 Subject: [PATCH] Keep Dependabot away from the MSRV toolchain pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The MSRV job pins `dtolnay/rust-toolchain@1.88` because that is the oldest Rust this crate claims to build on. Dependabot reads the ref as a version and opened #3, "Bump dtolnay/rust-toolchain from 1.88 to 1.100" — sorting 88 to 100, which is not a Rust that exists. CI failed with "could not download nonexistent rust version 1.100.0". The failure is the harmless outcome. A bump that resolved would leave the job named "MSRV (1.88)" while compiling against something newer, and the manifest field it exists to enforce would quietly stop being enforced — the exact drift the job was added to catch. The other two uses of this action are `@stable`, which Dependabot does not treat as a version, so ignoring the action outright costs nothing. The pin moves when `rust-version` moves, by hand, in the same commit. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2d17ee8..fcf17ee 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,6 +14,19 @@ updates: interval: monthly commit-message: prefix: "CI:" + # The MSRV job pins `dtolnay/rust-toolchain@`, and that ref + # is a policy statement — the oldest Rust this crate claims to build + # on — not a dependency to keep current. Dependabot reads it as a + # version anyway and proposed 1.88 -> 1.100, which is not a Rust that + # exists; it failed with "could not download nonexistent rust version + # 1.100.0". A bump that *did* resolve would be worse: the job would + # keep the name "MSRV (1.88)" while testing something else entirely, + # and the field it exists to enforce would go unchecked again. + # + # The toolchain moves when `rust-version` in Cargo.toml moves, by + # hand and in the same commit. + ignore: + - dependency-name: dtolnay/rust-toolchain # Cargo deps grouped into one PR per run. agv pins loosely ("1", # "0.22"), so most updates are already picked up at build time and a