Take rust-version into account when updating lock file / manifest

[epage]

rust-version specifies what the minimum supported rust version is for the crate. In the ideal case, Dependabot would ensure that dependencies' rust-version is not higher than for the crate being modified.

[epage]

In case its a blocker, the index does not yet have rust-version. We are looking to add it.

[jeffwidman]

This makes sense to me, but I think this is all blocked on upstream?

• cargo add takes package.rust-version into account when no version-req is specified rust-lang/cargo#10653

We use native cargo to run the update, so I would expect it to flag when this is a problem, as long as we are correctly feeding it the manifest of the crate being updated so that it has access to that crate's rust-version field.

Once this gets added upstream, then should start showing up here as soon as we bump to the newer version of cargo.

[epage]

MSRV is now in the index.

rust-lang/cargo#9930 is the issue for cargo update. However, whats not said is how Dependabot handles choosing breaking changes since you can't be relying on cargo update. Looks like Dependabot is using crates.io's API so that code would need to be updated.