ci(rust): bump mlua from 0.11.6 to 0.12.1

[dependabot]

Bumps mlua from 0.11.6 to 0.12.1.

Release notes

Sourced from mlua's releases.

v0.12.1

What's Changed

• Lua 5.5 updated to 5.5.1
• Luau updated to 0.736
• Allow #[mlua::userdata_impl] to be used in a different module from #[derive(UserData)] (#726)
• Fix coroutine stack handling after yielding from hooks (#723)

Full Changelog: mlua-rs/mlua@v0.12.0...v0.12.1

v0.12.0

Highlights

More ergonomic UserData building blocks

• Declaratively implement UserData with #[derive(UserData)] and register methods/fields with the new #[mlua::userdata_impl] attribute macro.
• UserDataOwned<T> wrapper takes ownership of userdata and implements FromLua
• UserDataMethods::add_method_once/add_async_method_once
• __todebugstring metamethod for pretty-printing userdata when debugging
• MaybeSync trait for userdata under the send feature

Reorganized public API

Types are now grouped into focused modules: chunk, debug, error, function, table, string, state, thread, userdata and luau.

Thread lifecycle callbacks

Hook into coroutine create/resume/yield events across all Lua versions (when using mlua API).

Luau improvements

Latest Luau with extended require-by-string support and JIT options.

Garbage-collector interface refactor

Lua::gc_inc / Lua::gc_gen are replaced by a Lua::gc_set_mode, with GcIncParams/GcGenParams for fine-grained tuning.

What's Changed (since v0.12.0-rc.2)

• Crate root re-exports are refactored (only essentials are re-exported, the rest is in the new submodules)
• Added ThreadStatus::Normal and Thread::is_normal (mimic coroutine.status)
• Added Lua::set_jit_options with support of Luau JIT inliner (Luau)
• Added Value::as_vector/Value::is_vector (Luau)
• Added Table::remove
• serde: tables with the array metatable are always encoded as arrays (incl. detect_mixed_tables option)
• impl Hash for BorrowedStr/BorrowedBytes
• Lua::current_thread resolves implicit async threads to their root owner (#706)
• Bugfixes and improvements

Full Changelog: mlua-rs/mlua@v0.11.6...v0.12.0

... (truncated)

Changelog

Sourced from mlua's changelog.

v0.12.1 (Aug 29, 2026)

• Lua 5.5 updated to 5.5.1
• Luau updated to 0.736
• Allow #[mlua::userdata_impl] to be used in a different module from #[derive(UserData)] (#726)
• Fix coroutine stack handling after yielding from hooks (#723)

v0.12.0 (Jul 05, 2026)

Changes since v0.12.0-rc.2

• Create root re-exports are refactored (only essentials are re-exported, the rest is in the new submodules)
• Added ThreadStatus::Normal and Thread::is_normal (mimic coroutine.status)
• Added Lua::set_jit_options with support of Luau JIT inliner (Luau)
• Added Value::as_vector/Value::is_vector (Luau)
• Added Table::remove
• serde: tables with the array metatable are always encoded as arrays (incl. detect_mixed_tables option)
• impl Hash for BorrowedStr/BorrowedBytes
• Lua::current_thread resolves implicit async threads to their root owner (#706)
• Bugfixes and improvements

v0.12.0-rc.2 (Jun 06, 2026)

• Add #[derive(UserData)] and #[mlua::userdata_impl] macros
• Support thread create/resume/yield callbacks for all Lua versions (including Luau)
• Support to_alias_override/to_alias_fallback in Require trait (Luau)
• Prevent XRc overflow when dropping RawLua with foreign Lua state
• implement Not for StdLib (#699)
• Fix String::to_pointer return NULL in Lua <5.4

v0.12.0-rc.1 (Apr 21, 2026)

• Rust 2024 edition
• Removed Error::ToLuaConversionError variant as it was unused (and not practically useful)
• New modules to group data types: chunk, debug, error, function, table, string, state, thread, userdata, luau
• Support __todebugstring metamethod for pretty formatting userdata value (for debugging)
• New MaybeSync trait that is required for userdata types
• Removed lifetime from BorrowedStr and BorrowedBytes
• New Thread methods: is_resumable, is_running, is_finished, is_error
• Added Thread::state to get raw Lua state pointer
• Luau TextRequirer is renamed to FsRequirer
• GC interface refactor: Lua::gc_inc/Lua::gc_gen is replaced with gc_set_mode
• Added GcIncParams and GcGenParams for GC tuning
• New UserDataMethods::add_method_once and UserDataMethods::add_async_method_once
• Initial Luau integer64 type support
• Changed interface of Function::wrap/wrap_mut/wrap_async to support any Error type
• Changed AnyUserData::type_name to return LuaString instead
• Added UserDataOwned<T> wrapper to take ownership of userdata T and implements FromLua

Commits

• 4fd87af v0.12.1
• 983c384 mlua-sys: v0.12.0
• 0224864 mlua_derive: v0.12.1
• aca3bb3 Update CHANGELOG
• 8ceeceb Create C closures under lua_cpcall so an allocation failure doesn't escape ...
• 4bca98f clippy
• 87dc0c1 mlua_derive: Make userdata_impl independent from module where UserData is d...
• 7539003 mlua-sys: Bump luau-src to v0.21 (Luau 0.736)
• e9b9844 mlua-sys: bump luau-src to 551+
• 66b9f08 Fix coroutine stack handling after hook yields
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent Does this version bump break anything or is it good to merge?

[strandly-the-agent]

TL;DR: good to merge. mlua 0.11→0.12 is a breaking release, but none of its breaking changes touch what this repo uses — confirmed both by a usage audit and by a 42-probe differential run of the lua builtin against 0.11.6 vs 0.12.1 (identical behavior; only tostring pointer addresses differ).

All mlua usage lives in src/builtins/lua.rs, and its whole surface — mlua::prelude::*, Lua::new_with, set_memory_limit, set_global_hook with HookTriggers::new().every_nth_instruction(4096) / VmState::Continue, raw_set, create_async_function, eval_async — is unchanged in 0.12. The removed/refactored APIs (gc_inc/gc_gen, Function::wrap* signatures, AnyUserData::type_name, Error::ToLuaConversionError, the serde behavior change — serde feature isn't enabled here) appear nowhere in the tree, and no mlua types leak into this crate's public API. CI is green on the exact head (d413f5b) across all three OSes.

One non-blocking heads-up: this bump raises the effective MSRV from 1.85 to 1.88 — mlua 0.12.1 declares rust-version = "1.88", while CONTRIBUTING.md:65 still says "Rust 1.85+". CI (dtolnay/rust-toolchain@stable) won't catch it; contributors on 1.85–1.87 will hit a clear cargo error. Worth a one-line CONTRIBUTING update in a follow-up rather than editing this Dependabot branch.

Verification ledger & analysis

Verified

• ✅ Head reviewed: d413f5b, based on current main tip (6fecd79), GitHub reports MERGEABLE
• ✅ Diff is manifest + lockfile only: mlua 0.11.6→0.12.1, mlua-sys 0.10.0→0.12.0, lua-src 550.0.0→551.0.1, luajit-src 210.6.6→210.7.3; features unchanged (["lua54", "async", "vendored"])
• ✅ crates.io: all four lockfile checksums independently match the registry; none of the versions are yanked
• ✅ CI on the exact head: Rust (ubuntu/macos/windows) ✅, Python (3.10–3.14 × 3 OSes) ✅, Node (20/22/24 × 3 OSes) ✅, Security audit ✅, CI Gate ✅, CodeQL neutral
• ✅ Local differential probe run (independent reviewer pass): 42 probes of the lua builtin executed against both mlua 0.11.6 and 0.12.1, same release profile — every status, stdout, stderr and latency bucket identical; only diffs are pointer addresses in tostring(userdata/table/thread) output (3 hunks)

Behavioral-risk spot-checks (0.11→0.12 changes vs. this code, probe-confirmed)

• Timeout hook × coroutines (src/builtins/lua.rs:165-186): the hook still fires inside Lua-created threads — while true do end in coroutine.create returns execution timeout exceeded, async-then-loop still trips it. The hook only returns VmState::Continue and never yields, so 0.12.1's hook-yield stack fix is inert here
• Async functions × coroutines (create_async_function): io.open/os.execute/require/dofile inside coroutine.create/wrap, nested coroutines, and coroutine.status after an async yield all behave identically to 0.11.6; Lua::current_thread isn't used, so 0.12's async-thread-resolution change can't reach the yield_now workaround (src/builtins/lua.rs:954)
• set_memory_limit (src/builtins/lua.rs:161): still enforced — string.rep("A", 200MB) yields not enough memory on 0.12.1
• Error text surfaced to users: the os.exit sentinel and timeout message are preserved verbatim by 0.12's error Display chain, traceback shape unchanged
• serde array-encoding change: mlua's serde feature isn't enabled, so not applicable
• Vendored interpreter sources update via lua-src/luajit-src; repo pins lua54; luajit-src appears in the lockfile but isn't compiled

Reading order: Cargo.toml (the one-line version bump), then Cargo.lock (the four resolved records). src/builtins/lua.rs is unchanged — read it only if you want to see the usage surface this verdict is based on.

Appendix — non-blocking (2)

• ⚪ MSRV drift (detailed above): CONTRIBUTING.md:65 says Rust 1.85+, effective MSRV is now 1.88. Suggest a follow-up one-liner; happy to open it if useful.
• ⚪ Pre-existing (not this PR): the shell matches mlua error text by substring — the os.exit sentinel at src/builtins/lua.rs:121/:317 and contains("timeout") in tests/lua_integration.rs:970 — while no test asserts the exact strings. A future mlua Display change would silently degrade exit-code plumbing to a generic exit 1. Fine today (0.12 preserves both verbatim), but worth hardening eventually.

Evidence uploaded to the artifacts bucket: mlua-usage-audit.txt, checksum-verification.txt, probe-mlua-0.11.6.log, probe-mlua-0.12.1.log, probe-diff.txt, zz_probe.rs (probe source — untracked scratch, not part of the PR).

[opieter-aws]

@strandly-the-agent make a PR with edit to CONTRIBUTING.md

[strandly-the-agent]

I prepared the commit but can't open the PR: strandly-the-agent has no push access to this repo (403 on push, 404 on branch creation via the API), and repo forking is blocked by my guardrails. The change is one line:

-- **Rust** 1.85+ (stable; required by Rust edition 2024). Install via [rustup](https://rustup.rs/). `cargo fmt` and `cargo clippy` require the `rustfmt` and `clippy` components (included with the default profile).
+- **Rust** 1.88+ (stable; required by `mlua` 0.12). Install via [rustup](https://rustup.rs/). `cargo fmt` and `cargo clippy` require the `rustfmt` and `clippy` components (included with the default profile).

A git am-ready patch (commit message included) is in the artifacts bucket as contributing-msrv-1.88.patch. If you give strandly-the-agent write access (or an existing fork), say the word and I'll open the PR myself.