What the developer wrote
Authored by Joost Jager
Pin zeroize for old Rust CI
zeroize 1.9.0 uses Rust 2024 metadata, which Cargo 1.75 cannot
parse. Pin it to 1.8.2 for older toolchains so the transaction sync
HTTPS feature check keeps passing on the MSRV job.
What changed, and why it matters
This commit only changes a CI script to pin a dependency version so older Rust toolchains can still build the project. It is a build-maintenance fix with no security relevance.
No security action needed. Treat as routine CI/maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit adds a line to ci/ci-tests-common.sh that pins the zeroize crate to version 1.8.2 when the Rust compiler version is below 1.85. This is because zeroize 1.9.0 uses Rust 2024 edition metadata that Cargo 1.75 cannot parse. The change preserves the existing MSRV CI job and has no functional or security impact on the codebase.
Changed components
ci/ci-tests-common.shInspect captured patch +3 / −0
diff --git a/ci/ci-tests-common.sh b/ci/ci-tests-common.sh
index 9631689..a14928d 100755
--- a/ci/ci-tests-common.sh
+++ b/ci/ci-tests-common.sh
@@ -23,4 +23,7 @@ PIN_RELEASE_DEPS # pin the release dependencies in our main workspace
# Starting with version 0.27.8, the `hyper-rustls` crate has an MSRV of rustc 1.85.0.
[ "$RUSTC_MINOR_VERSION" -lt 85 ] && cargo update -p hyper-rustls --precise "0.27.7" --quiet
+# Starting with version 1.9.0, the `zeroize` crate uses Rust 2024.
+[ "$RUSTC_MINOR_VERSION" -lt 85 ] && cargo update -p zeroize --precise "1.8.2" --quiet
+
export RUST_BACKTRACE=1
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.