Yank both 2.6.0 and 2.6.1 as they both introduce a breaking change and republish as 3.0.0

[jqnatividad]

Just making this request explicit based on the #332 thread - as both 2.6.0 and 2.6.1 introduce a breaking change, and per https://semver.org/ guidance - requires a major version.

[jqnatividad]

Doing so should allow zip 2.5 ecosystem users (which far outnumber zip 2.6 users) to remove workarounds, and for the few that have upgraded to 2.6, to simply just bump their zip to 3.0.0.

[prophittcorey]

This would be ideal. If this change goes out, it would fix all of the packages that didn't pin specifically to 2.5.0.

I've opened a change in a crate that depends on 2.5.0 (tafia/calamine#497) and the maintainer doesn't seem to be around. That's not a unique experience, it's happening to many crates.

If zip yanks 2.6 and 2.6.1 and republishes those changes as 3.0, all currently broken crates will be fixed.

[simnalamburt]

I agree with this as well. zip v2.6.0 and v2.6.1 should be yanked. A large number of developers are currently forced to pin the version to 2.5.0 just to avoid issues. Please take appropriate action.

[VimCommando]

When I upgraded my crate from 2.2.2 to 2.6.1 it also broke my container builds.

Since I'm deploying with a distroless container image, by design there are very minimal system libraries. Version 2.6.1 somehow introduced lzma-sys into the dependency chain (found it in cargo.lock). With lzma enabled, the container would build, but always fail at runtime with:

/usr/local/bin/esdiag: error while loading shared libraries: liblzma.so.5: cannot open shared object file: No such file or directory

I had to use default-features = false on zip2 in the Cargo.toml to drop the lzma feature and only opt-in to what I was using. This allow my containers to build and as expected again.

[tylerasai]

Come on guys let's get this going.

[Leandros]

Issues are happening downstream due to this, see zip-extract: MCOfficer/zip-extract#38

[k-bx]

@Pr0methean any chance on making this happen? It broke quite a number of upgrades

[Pr0methean]

I'll do this once #345 is merged, since creating a new release while the build in master is failing would risk even worse issues.

[Pr0methean]

Update: Since #340 and #342 seem to be addressing potential showstoppers, I've decided to give each of them at least an attempt at passing CI and being merged before the next release. I'll also try to merge #351 first, since (a) it's worth doing if we're bumping the major version anyway, and (b) the ! in its commit message will trigger release-plz to increase the version to 3.0.0 and save the need for complicated manual intervention.

[Pr0methean]

Further update: in the event that CI fails on the aforementioned PRs, this release may be delayed slightly while I wait for an answer to release-plz/release-plz#2225.

[prophittcorey]

@Pr0methean is the plan to yank 2.6.0, 2.6.1 and release 2.6.2 with 2.5 compatible changes?

[Pr0methean]

No, it's to release 3.0.0 as soon as all the showstoppers (including the bugs #340 and #342 fix) that I'm aware of are fixed in master and CI is passing, and then yank 2.6.0 and 2.6.1 once 3.0.0 is released.

[prophittcorey]

I see, that will work (assuming all 2.6.* releases are yanked). Unfortunately, some crates have already applied changes for 2.6 and will need to bump to 3, but that seems like the best way forward.

[Pr0methean]

Released version 3.0.0 and yanked 2.6.0 and 2.6.1. I've added cargo semver checks for multiple feature configurations (default, all, none) to the CI workflow to detect future breaking changes.

[jmcnamara]

Released version 3.0.0 and yanked 2.6.0 and 2.6.1.

v2.5.0 was also yanked. Why was that?

[astraw]

v2.5.0 was also yanked. Why was that?

#328

[jqnatividad]

Hi @Pr0methean , thanks for yanking 2.6.0 and 2.6.1 and releasing 3.0.0.

However, was wondering what's the reason for yanking 2.5.0 as well as its the last version that did not have semver breaking changes.

Could 2.5.0 be unyanked?

[prophittcorey]

Hi @Pr0methean , thanks for yanking 2.6.0 and 2.6.1 and releasing 3.0.0.

However, was wondering what's the reason for yanking 2.5.0 as well as its the last version that did not have semver breaking changes.

Could 2.5.0 be unyanked?

This is why 2.5 was yanked: #328

[jqnatividad]

Thanks for the clarification @prophittcorey .

Mea culpa - should have read the previous comment in more detail...

Just the same, props to @Pr0methean for maintaining zip! The breaking semver stuff is testament to the importance of the crate in the ecosystem, and truly appreciate the work you've been doing when you took over maintaining the project.