Release tracking PR: hex-conservative 0.2.3

.gitignore

@@ -1,4 +1,3 @@
 # .gitignore for hex-conservative repository.
 
-Cargo.lock
 target

CHANGELOG.md

@@ -1,3 +1,9 @@
+# 0.2.3 - 2026-09-01
+
+- Commit a lock file (`Cargo.lock`) and explicitly use MSRV
+  `rust-version` in manifest [#259](https://github.com/rust-bitcoin/hex-conservative/pull/259)
+- Backport serde deserializton bug fix [#202](https://github.com/rust-bitcoin/hex-conservative/pull/202)
+
 # 0.2.2 - 2025-11-25
 
 - remove `doc_auto_cfg` from src/lib.rs due to breaking compiler change

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hex-conservative"
-version = "0.2.2"
+version = "0.2.3"
 authors = ["Martin Habovštiak <martin.habovstiak@gmail.com>", "Andrew Poelstra <apoelstra@wpsoftware.net>"]
 license = "CC0-1.0"
 repository = "https://github.com/rust-bitcoin/hex-conservative"
@@ -11,6 +11,7 @@ keywords = ["encoding", "hex", "hexadecimal"]
 readme = "README.md"
 edition = "2018"
 exclude = ["tests", "contrib"]
+rust-version = "1.56.1"
 
 [package.metadata.docs.rs]
 all-features = true

contrib/test.sh

@@ -15,6 +15,16 @@ if cargo --version | grep nightly >/dev/null; then
 fi
 
 if cargo --version | grep ${MSRV}; then
+    # `Cargo.lock` is committed and gets generated using a modern toolchain, so
+    # it can contain multiple dependencies simultaneously too new for the MSRV
+    # toolchain to even parse (e.g. ones using the `dep:` optional-dependency
+    # syntax). `cargo update -p x --precise y` treats every package other than
+    # `x` as frozen at its current (unparsable) version, so pinning them one at
+    # a time deadlocks. First bulk-update all of them together, without
+    # `--precise`, so the resolver is free to settle on versions the MSRV
+    # toolchain can at least parse; only then pin each one precisely.
+    cargo update -p memchr -p honggfuzz -p semver -p memmap2 -p syn -p serde_derive -p serde -p quote -p proc-macro2 -p unicode-ident -p ryu -p itoa -p serde_json
+
     cargo update -p serde_json --precise 1.0.48
     cargo update -p itoa --precise 0.4.3
 
@@ -25,6 +35,12 @@ if cargo --version | grep ${MSRV}; then
     cargo update -p memchr --precise 2.5.0
     cargo update -p ryu --precise 1.0.0
     cargo update -p unicode-ident --precise 1.0.0
+    # honggfuzz >= 0.5.56 requires edition 2021 (fuzz/ dev workspace member)
+    cargo update -p honggfuzz --precise 0.5.55
+    # semver >= 1.0.24 uses the `dep:` optional-dependency syntax
+    cargo update -p semver --precise 1.0.23
+    # memmap2 >= 0.9.11 requires rustc 1.65; honggfuzz 0.5.55 needs memmap2 0.5.x anyway
+    cargo update -p memmap2 --precise 0.5.10
 fi
 
 # Make all cargo invocations verbose

src/lib.rs

@@ -117,15 +117,8 @@ mod table {
     pub(crate) struct Table([u8; 16]);
 
     impl Table {
-        pub(crate) const LOWER: Self = Table([
-            b'0', b'1', b'2', b'3', b'4', b'5', b'6', b'7', b'8', b'9', b'a', b'b', b'c', b'd',
-            b'e', b'f',
-        ]);
-        pub(crate) const UPPER: Self = Table([
-            b'0', b'1', b'2', b'3', b'4', b'5', b'6', b'7', b'8', b'9', b'A', b'B', b'C', b'D',
-            b'E', b'F',
-        ]);
-
+        pub(crate) const LOWER: Self = Table(*b"0123456789abcdef");
+        pub(crate) const UPPER: Self = Table(*b"0123456789ABCDEF");
         /// Encodes single byte as two ASCII chars using the given table.
         ///
         /// The function guarantees only returning values from the provided table.