Pin important dependencies

[senekor]

Same PR as: exercism/rust-test-runner#183

[github-actions]

Hello 👋 Thanks for your PR.

This repo does not currently have dedicated maintainers. Our guardians team will attempt to review and merge your PR, but it will likely take longer for your PR to be reviewed.

If you enjoy contributing to Exercism and have a track-record of doing so successfully, you might like to become an Exercism maintainer for this track.

Please feel free to ask any questions, or chat to us about anything to do with this PR or the reviewing process on the Exercism forum.

(cc @exercism/guardians)

[IsaacG]

Would pinning pin it to the minor/patch version? Is that a problem?

[senekor]

So, the "pinning" is just a comment on the "important" libraries. If these are updated in a semver-breaking way (1.0 -> 2.0 or also 0.1 -> 0.2), I hope the comment will cause humans to read the longer instructions above. Non-semver-breaking updates can still be applied via the lockfile by running cargo update.

[IsaacG]

Gotcha. So this won't block dependabot from creating PRs that attempt to bump them?

[senekor]

That's right, dependabot doesn't read these comments. There would be specific syntax to make automated tools aware of the pinning. I think something like this:

time = "=0.3.0"

But that's not the goal, we do want to offer newer versions when they come out. We just want a reminder for humans to also include the old version, to avoid breaking lots of exercise solutions.