[Kewe63]

Summary

• raise the declared minimum Rust version from 1.88.0 to 1.91.0
• add a dedicated CI job that checks the committed lockfile with the declared MSRV
• preserve the existing stable Linux/macOS test matrix

Problem

The manifest advertised Rust 1.88.0, but the committed lockfile resolves Alloy 1.7.3 packages that require Rust 1.91. Locked builds therefore failed before compilation when users followed the package metadata.

Approach

The manifest now declares the actual maximum minimum version required by the locked graph. CI installs that exact toolchain and runs cargo check --locked so future dependency updates cannot silently invalidate the advertised MSRV.

Tests

• CARGO_BUILD_JOBS=1 cargo +1.91.0 check --locked
• cargo +1.91.0 fmt --check
• CARGO_BUILD_JOBS=1 cargo +1.91.0 clippy --locked -- -D warnings
• CARGO_BUILD_JOBS=1 cargo +1.91.0 test --locked --all-targets — 82 unit and 49 integration tests passed
• workflow YAML lint passed
• git diff --check

Risk

Low. This makes package metadata honest and adds verification; runtime behavior is unchanged.

Fixes #100

---

Note

Low Risk
Metadata and CI-only verification; no application or runtime behavior changes.

Overview
Raises the advertised MSRV from 1.88.0 to 1.91.0 in Cargo.toml so package metadata matches what the locked dependency graph (e.g. Alloy) actually requires.

Adds an msrv CI job on Ubuntu that pins Rust 1.91.0 and runs cargo check --locked, so MSRV regressions from lockfile updates are caught in CI. The existing stable Linux/macOS check matrix (fmt, clippy, test) is unchanged.

^{Reviewed by Cursor Bugbot for commit 673ef79. Bugbot is set up for automated code reviews on this repo. Configure here.}