ci: bump dtolnay/rust-toolchain from 1.95.0 to 1.120.0

[dependabot]

Bumps dtolnay/rust-toolchain from 1.95.0 to 1.120.0.

Commits

• 237493c toolchain: 1.120.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR should not be merged in its current state. The update to the minimal-features job is problematic because it is designed to be a static guard for the project's Minimum Supported Rust Version (MSRV). Allowing an automated tool to bump this version defeats the purpose of testing against the oldest supported toolchain. Furthermore, the syntax used for the GitHub Action version is invalid for this specific action, which will lead to immediate CI failures. Codacy analysis indicates the project is currently up to standards, but this change would introduce a functional regression in the CI pipeline.

About this PR

• The 'minimal-features' job is documented as 'Pinned to the declared MSRV' to prevent regressions on the minimum supported version. Automatically bumping this via Dependabot defeats the intentionality of this guard. This update should only be performed manually when the project's official rust-version in Cargo.toml is also being updated.

Test suggestions

• Verify that the project successfully compiles and passes tests on the new MSRV (1.120.0).
• Confirm that 1.120.0 is the intended new minimum version and that the change is reflected in the project's Cargo.toml (rust-version field).

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the project successfully compiles and passes tests on the new MSRV (1.120.0).
2. Confirm that 1.120.0 is the intended new minimum version and that the change is reflected in the project's Cargo.toml (rust-version field).

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

This update is problematic for several reasons:

1. Invalid Action Reference: The dtolnay/rust-toolchain action typically does not use semantic version tags like @1.120.0 for the action itself (usually @master or @stable). Using an invalid reference will cause the GitHub Action to fail to initialize. To pin the toolchain version, use the toolchain input parameter instead.
2. MSRV Guard Violation: This job is a guard for the project's MSRV. Bumping it raises the minimum requirement without a corresponding update to Cargo.toml, meaning you are no longer testing your actual minimum supported version.
3. Security Risk: Pinning to a mutable tag (1.120.0) is a security risk. It is a best practice to pin actions to a specific 40-character commit SHA to prevent supply chain attacks.