Uh oh!
There was an error while loading. Please reload this page.
ci(rust): bump mlua from 0.11.6 to 0.12.1 - #99
Conversation
Bumps [mlua](https://github.com/mlua-rs/mlua) from 0.11.6 to 0.12.1. - [Release notes](https://github.com/mlua-rs/mlua/releases) - [Changelog](https://github.com/mlua-rs/mlua/blob/main/CHANGELOG.md) - [Commits](mlua-rs/mlua@v0.11.6...v0.12.1) --- updated-dependencies: - dependency-name: mlua dependency-version: 0.12.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
opieter-aws
commented
Sep 2, 2026
@strandly-the-agent Does this version bump break anything or is it good to merge? |
There was a problem hiding this comment.
TL;DR: good to merge. mlua 0.11→0.12 is a breaking release, but none of its breaking changes touch what this repo uses — confirmed both by a usage audit and by a 42-probe differential run of the lua builtin against 0.11.6 vs 0.12.1 (identical behavior; only tostring pointer addresses differ).
All mlua usage lives in src/builtins/lua.rs, and its whole surface — mlua::prelude::*, Lua::new_with, set_memory_limit, set_global_hook with HookTriggers::new().every_nth_instruction(4096) / VmState::Continue, raw_set, create_async_function, eval_async — is unchanged in 0.12. The removed/refactored APIs (gc_inc/gc_gen, Function::wrap* signatures, AnyUserData::type_name, Error::ToLuaConversionError, the serde behavior change — serde feature isn't enabled here) appear nowhere in the tree, and no mlua types leak into this crate's public API. CI is green on the exact head (d413f5b) across all three OSes.
One non-blocking heads-up: this bump raises the effective MSRV from 1.85 to 1.88 — mlua 0.12.1 declares rust-version = "1.88", while CONTRIBUTING.md:65 still says "Rust 1.85+". CI (dtolnay/rust-toolchain@stable) won't catch it; contributors on 1.85–1.87 will hit a clear cargo error. Worth a one-line CONTRIBUTING update in a follow-up rather than editing this Dependabot branch.
Verification ledger & analysis
Verified
- ✅ Head reviewed:
d413f5b, based on currentmaintip (6fecd79), GitHub reports MERGEABLE - ✅ Diff is manifest + lockfile only: mlua 0.11.6→0.12.1, mlua-sys 0.10.0→0.12.0, lua-src 550.0.0→551.0.1, luajit-src 210.6.6→210.7.3; features unchanged (
["lua54", "async", "vendored"]) - ✅ crates.io: all four lockfile checksums independently match the registry; none of the versions are yanked
- ✅ CI on the exact head: Rust (ubuntu/macos/windows) ✅, Python (3.10–3.14 × 3 OSes) ✅, Node (20/22/24 × 3 OSes) ✅, Security audit ✅, CI Gate ✅, CodeQL neutral
- ✅ Local differential probe run (independent reviewer pass): 42 probes of the
luabuiltin executed against both mlua 0.11.6 and 0.12.1, same release profile — every status, stdout, stderr and latency bucket identical; only diffs are pointer addresses intostring(userdata/table/thread)output (3 hunks)
Behavioral-risk spot-checks (0.11→0.12 changes vs. this code, probe-confirmed)
- Timeout hook × coroutines (
src/builtins/lua.rs:165-186): the hook still fires inside Lua-created threads —while true do endincoroutine.createreturnsexecution timeout exceeded, async-then-loop still trips it. The hook only returnsVmState::Continueand never yields, so 0.12.1's hook-yield stack fix is inert here - Async functions × coroutines (
create_async_function):io.open/os.execute/require/dofileinsidecoroutine.create/wrap, nested coroutines, andcoroutine.statusafter an async yield all behave identically to 0.11.6;Lua::current_threadisn't used, so 0.12's async-thread-resolution change can't reach theyield_nowworkaround (src/builtins/lua.rs:954) set_memory_limit(src/builtins/lua.rs:161): still enforced —string.rep("A", 200MB)yieldsnot enough memoryon 0.12.1- Error text surfaced to users: the
os.exitsentinel and timeout message are preserved verbatim by 0.12's error Display chain, traceback shape unchanged - serde array-encoding change: mlua's
serdefeature isn't enabled, so not applicable - Vendored interpreter sources update via lua-src/luajit-src; repo pins
lua54; luajit-src appears in the lockfile but isn't compiled
Reading order: Cargo.toml (the one-line version bump), then Cargo.lock (the four resolved records). src/builtins/lua.rs is unchanged — read it only if you want to see the usage surface this verdict is based on.
Appendix — non-blocking (2)
- ⚪ MSRV drift (detailed above):
CONTRIBUTING.md:65says Rust 1.85+, effective MSRV is now 1.88. Suggest a follow-up one-liner; happy to open it if useful. - ⚪ Pre-existing (not this PR): the shell matches mlua error text by substring — the
os.exitsentinel atsrc/builtins/lua.rs:121/:317andcontains("timeout")intests/lua_integration.rs:970— while no test asserts the exact strings. A future mlua Display change would silently degrade exit-code plumbing to a generic exit 1. Fine today (0.12 preserves both verbatim), but worth hardening eventually.
Evidence uploaded to the artifacts bucket: mlua-usage-audit.txt, checksum-verification.txt, probe-mlua-0.11.6.log, probe-mlua-0.12.1.log, probe-diff.txt, zz_probe.rs (probe source — untracked scratch, not part of the PR).
opieter-aws
commented
Sep 2, 2026
@strandly-the-agent make a PR with edit to CONTRIBUTING.md |
Uh oh!
There was an error while loading. Please reload this page.
strandly-the-agent
commented
Sep 2, 2026
I prepared the commit but can't open the PR: -- **Rust** 1.85+ (stable; required by Rust edition 2024). Install via [rustup](https://rustup.rs/). `cargo fmt` and `cargo clippy` require the `rustfmt` and `clippy` components (included with the default profile).+- **Rust** 1.88+ (stable; required by `mlua` 0.12). Install via [rustup](https://rustup.rs/). `cargo fmt` and `cargo clippy` require the `rustfmt` and `clippy` components (included with the default profile).A |
Bumps mlua from 0.11.6 to 0.12.1.
Release notes
Sourced from mlua's releases.
... (truncated)
Changelog
Sourced from mlua's changelog.
Commits
4fd87afv0.12.1983c384mlua-sys: v0.12.00224864mlua_derive: v0.12.1aca3bb3Update CHANGELOG8ceecebCreate C closures underlua_cpcallso an allocation failure doesn't escape ...4bca98fclippy87dc0c1mlua_derive: Makeuserdata_implindependent from module where UserData is d...7539003mlua-sys: Bump luau-src to v0.21 (Luau 0.736)e9b9844mlua-sys: bump luau-src to 551+66b9f08Fix coroutine stack handling after hook yieldsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)