chore(deps): bump syn from 2.0.119 to 3.0.5

[dependabot]

Bumps syn from 2.0.119 to 3.0.5.

Release notes

Sourced from syn's releases.

3.0.5

• Report correct span for lex errors from LitStr::parse_with (#2080, thanks @​sunshowers)

3.0.4

• Allow safe fn in impl Parse for ForeignItemFn (#2078)

3.0.3

• Documentation improvements

3.0.2

• Add Error::new_range(start..end, "msg") (#2068, #2070)
• Add Cursor::prev_span

3.0.1

• Parse const traits (#2056, #2057, #2058, #2063, #2064)
• Parse unsafe binder types (#2065)
• Parse impl restrictions (#2066)

3.0.0

This release contains adjustments to the syntax tree to account for ongoing Rust language development from the 3 years since syn 2.0.0 and to anticipate some in-flight Rust language RFCs.

These include: default values in fields, pinned type sugar, raw lifetimes, generator blocks and functions, unnamed enum variants, attributes in tuple types and tuple patterns, named arguments in parenthesized generic argument lists, lightweight clones, const traits, const function pointers, mutability restricted fields, supertrait auto implementation, final associated functions, trait implementability restrictions, const blocks in path arguments, item-level const blocks, return type notation, never patterns, function delegation, mutable by-reference bindings, in-place initialization, field projections, explicitly dyn-compatible traits, view types, file-level frontmatter, generic const arguments, guard patterns, lazy type aliases, explicitly safe foreign items, super let, unsafe fields, pattern types, heterogeneous try-blocks, function contracts, async function trait bounds, static closure coroutine syntax, unsafe binder types, move expressions, for-await loops, and postfix keywords.

Breaking changes

Modifiers

To reserve more room for language evolution, there are 10 new non-exhaustive structs in the syntax tree having the following commonality:

• Name ending in Modifiers. {BlockModifiers, ClosureModifiers, ConstModifiers, FieldModifiers, FnModifiers, ImplModifiers, LocalModifiers, TraitBoundModifiers, TraitModifiers, TypeModifiers}

• Each implements Default. The default value is guaranteed to comprise no tokens.

• Non-exhaustive. Can only be instantiated by Syn's parser or by creating and then mutating ▁▁Modifiers::default().

• Does not implement Parse. When parsing, they are parsed by the enclosing syntax tree node.

• Does not implement ToTokens. In some cases the syntax that these nodes might hold in the future is not necessarily contiguous tokens.

• Provides .require_empty() -> Result<()> which returns a meaningfully spanned error if the modifiers are different from the empty default. This enables a caller to reject syntax it does not recognize without knowing what that syntax may be.

Types

• Type::BareFn has been renamed to Type::FnPtr to mirror the compiler's terminology. Together with this, BareVariadic is renamed to FnPtrVariadic.

• The mutually exclusive const_token and mutability fields of Type::Ptr have been unified into an enum of type PointerMutability, which was already previously used by Expr::RawAddr.

... (truncated)

Commits

• e0ad92d Release 3.0.5
• 74e7d75 Merge pull request #2080 from sunshowers/lit-str-span
• 4c264f3 In LitStr::parse_with, report correct span for lex errors
• 7e2b27b Update test suite to nightly-2026-08-26
• b5d62a6 Release 3.0.4
• abf019c Merge pull request #2078 from dtolnay/foreginitemfn
• d454333 Allow safe fn in impl Parse for ForeignItemFn
• 8011b1c Update test suite to nightly-2026-08-18
• 56a8d83 Raise rayon thread size for tests
• f2c5c50 Ignore assert_is_empty pedantic clippy lint
• Additional commits viewable in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.95%. Comparing base (bd4aa83) to head (1f060a5).
⚠️ Report is 2 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #2106      +/-   ##
===========================================
- Coverage    84.96%   84.95%   -0.01%     
===========================================
  Files          351      351              
  Lines        30208    30208              
  Branches     30208    30208              
===========================================
- Hits         25665    25664       -1     
  Misses        4174     4174              
- Partials       369      370       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[da2ce7]

@dependabot rebase

[da2ce7]

Reviewed at 310b3a75d49eb905491261c3eed17a8a9f173c57.

Verified on a detached worktree at this exact head (rebased onto develop 89d45145, 0 behind), toolchain rustc 1.100.0-nightly (a69a63265 2026-09-03).

Diff. One line in contrib/dev-tools/analysis/workspace-coupling/Cargo.toml (syn = { version = "2", … } to "3", same ["full", "visit"] feature list) and one line in Cargo.lock retargeting that package's edge from syn 2.0.119 to syn 3.0.4. No package is added or removed, and no other version moves.

Graph effect. syn 3.0.4 was already a node at the base with 10 dependents; after this PR it has 11. syn 2.0.119 keeps its 34 transitive dependents (axum-macros, darling_core, mockall_derive, serde_with_macros, sqlx-macros, thiserror-impl, tracing-attributes, …). So both majors were already resolved before this change; it moves the only first-party syn consumer onto the newer one and adds no duplicate. That is also why cargo update -p syn --precise 3.0.4 cannot express it — the second major already exists as its own node, so the manifest requirement is what has to move, which is exactly what this PR does.

API compatibility. syn ships no changelog in the packaged crate, so this was checked against the sources. The feature tables are identical between 2.0.119 and 3.0.4, as are edition = "2021" and rust-version = "1.71", and the src/ and src/gen/ file lists match. Every item workspace-coupling/src/lib.rs touches is byte-identical across the majors:

• pub trait Visit<'ast> — same declaration;
• visit_file, visit_item_use, visit_macro, visit_path — identical signatures in both the trait and the free-function form (only line numbers move; gen/visit.rs grows 3941 to 4037 lines because syn 3 visits more AST nodes);
• enum UseTree with all five variants (Path, Name, Rename, Glob, Group), matched exhaustively by collect_use_tree;
• struct ItemUse, struct Macro, struct Path;
• pub fn parse_file(mut content: &str) -> Result<File>.

Gates at this head, --workspace --all-targets --all-features:

gate	exit	wall
cargo check	0	3.4s
cargo clippy … -- -D warnings	0	4.1s
cargo test	0	141.1s — 57 suites, 2603 passed, 0 failed
cargo machete --with-metadata	0	7.7s
cargo deny check bans	0	1.5s
linter all	0	20.9s
contrib/dev-tools/git/hooks/pre-commit.sh	0	40.7s — all 6 steps pass
cargo test --doc --workspace	0	6.2s — 30 passed

workspace-coupling is a workspace member, so --workspace builds it, and its own tests/parse_imports.rs is the direct exercise of the changed dependency; it passes.

Checklist items a manifest and lockfile change cannot exercise are non-applicable: no new functionality so no new tests, no public API added so no doc comments, no user-facing behaviour change so no docs update, no new terms for project-words.txt. Title is Conventional Commits, base branch is develop, and the description carries the upstream release notes.

CI at this head. Every workflow run is green except one: Testing (push) run 34460557287, whose sole failing job is Docker E2E. Green: Testing (pull_request) 34460561678, OS Compatibility 34460561640 / 34460557247, Database Compatibility 34460557310, Database Benchmarking 34460557224, Container 34460561724, Generate Coverage Report (PR) 34460561647, Docs Lint 34460561623 / 34460557277, Copilot Setup Steps 34460557222.

That Docker E2E red is #2179's defect, not this bump's. The job log fails at cargo run --bin e2e_tests_runner … with error: no bin target named 'e2e_tests_runner' in default-run packages / help: available bin in 'torrust-tracker-e2e-tools' package, i.e. the missing -p flag described in #2179 (specification in #2194). It reproduces identically on the other two dependabot heads currently open and cannot be affected by a dependency version, since it fails before any test runs. The pull_request run's Docker E2E is skipped by design, because container.yaml covers that event.

[da2ce7]

ACK 310b3a7 — syn 3.0.4: every API item workspace-coupling uses is byte-identical to syn 2.0.119, syn 3 was already in the graph, and check, clippy -D warnings, test (2603 passed), machete, deny bans, linter all, doctests and the pre-commit hook all green at this head.

[da2ce7]

@dependabot rebase

[da2ce7]

Re-reviewed at 55ec16580ab2dc5910552c9edae0ed8e4069d54b on 2026-09-10, after the rebase onto develop 65a077b5 (merge-base is 65a077b5, 0 behind).

Verified on a detached worktree at this exact head, toolchain rustc 1.100.0-nightly (a69a63265 2026-09-03), cargo 1.100.0-nightly (b2e9d5f9d 2026-09-02).

Rebase. The head moved from 310b3a75d49eb905491261c3eed17a8a9f173c57 to 55ec16580ab2dc5910552c9edae0ed8e4069d54b when the branch was rebased from develop 89d45145 onto 65a077b5. The patch itself did not change: git diff 89d45145 310b3a75 and git diff 65a077b5 55ec1658 produce byte-identical output (775 bytes, 24 lines), so the diff-of-diffs is empty and this is the same change re-parented. Both old and new head are single commits whose only parent is the respective base.

What develop gained in between is #2188 and #2189 — six documentation files plus tests/AGENTS.md and tests/common/workspace.rs, which drops the environment-variable guard from the integration-test fixture in favour of an explicit config path. Nothing in that delta mentions base64, syn or rstest, and it touches no Cargo.toml and no Cargo.lock, so it cannot interact with this bump. The gates below were nonetheless re-run in full at the new head rather than carried over.

Diff. Two files, 2 insertions / 2 deletions. contrib/dev-tools/analysis/workspace-coupling/Cargo.toml moves syn = { version = "2", features = [ "full", "visit" ] } to version = "3", and Cargo.lock changes that package's single dependency line from syn 2.0.119 to syn 3.0.4.

API, re-derived from the vendored sources at the locked versions. workspace-coupling is the only crate in the workspace that uses syn, and contrib/dev-tools/analysis/workspace-coupling/src/lib.rs uses six items: syn::parse_file, syn::Error, the syn::visit::Visit trait with visit_item_use, visit_macro and visit_path overridden, and the syn::ItemUse, syn::UseTree, syn::Path and syn::Macro types. Every one is unchanged at 3.0.4. The ItemUse and Macro structs, the UseTree enum and the Path struct are byte-identical to their 2.0.119 definitions. pub fn parse_file(mut content: &str) -> Result<File> is the same signature at syn-3.0.4/src/lib.rs:1108 and syn-2.0.119/src/lib.rs:992. fn visit_item_use(&mut self, i: &'ast crate::ItemUse) and fn visit_macro(&mut self, i: &'ast crate::Macro) are the same at syn-3.0.4/src/gen/visit.rs:522 and :577. The full and visit features both still exist, and rust-version stays at 1.71.

syn 3 is a real major elsewhere: the Visit trait renames visit_type_bare_fn to visit_type_fn_ptr, drops visit_bare_fn_arg, visit_bare_variadic, visit_field_mutability, visit_impl_restriction, visit_span and visit_trait_bound_modifier, and adds visit_frontmatter, visit_named_arg, visit_pat_guard, visit_receiver_kind, visit_safety and visit_where_clause_placement, with matching churn in the top-level type re-exports. None of that reaches this consumer: the visitor overrides three methods that survive unchanged, and Visit's methods are all provided, so additions are not breaking for a partial implementor.

Lockfile. The change is one line. syn 3.0.4 was already a node in the lockfile at the base, pulled in by ten proc-macro crates — async-trait, clap_derive, displaydoc, futures-macro, ref-cast-impl, serde_derive, serde_repr, thiserror-impl, tokio-macros and zerovec-derive. This bump adds no package and removes none; it only re-points workspace-coupling's edge from syn 2.0.119 to the syn 3.0.4 already being built. The duplicate count is unchanged at two, which is why cargo deny check bans reports the same warning[duplicate]: found 2 duplicate entries for crate 'syn' here as on the two sibling heads that do not touch syn.

Gates at this head, all on the server, one shared target directory, the three PRs serialized under a lock:

gate	exit	wall
cargo check --workspace --all-targets --all-features	0	1.0s
cargo clippy --workspace --all-targets --all-features -- -D warnings	0	1.2s
cargo test --workspace --all-targets --all-features	0	133.9s — 57 suites, 2603 passed, 0 failed, 0 ignored
cargo test --doc --workspace	0	6.1s — 30 passed, 0 failed, 2 ignored
cargo machete --with-metadata	0	7.8s — no unused dependencies
cargo deny check bans	0	1.4s — bans ok
linter all	0	18.7s
contrib/dev-tools/git/hooks/pre-commit.sh	0	33.6s — all 6 steps pass

The suite and case totals are identical across all three rebased heads and identical to the previous round, which is the empirical statement that this bump changes no test outcome.

CI at this head.

workflow (event)	run	conclusion
Testing (pull_request)	34498394115	success
Testing (push)	34498389494	failure — Docker E2E only
Container (pull_request)	34498393906	success
OS Compatibility (pull_request)	34498394016	success
OS Compatibility (push)	34498389439	success
Generate Coverage Report (PR)	34498393968	success
Docs Lint (pull_request)	34498393916	success
Docs Lint (push)	34498389515	success

That one red is #2179, not this bump. In each failing run the only failing job is Docker E2E and within it the only failing step is Run E2E Tests; the preceding Build Tracker Image step succeeds and the three qBittorrent steps are skipped as downstream of the failure. The step runs cargo run --bin e2e_tests_runner -- … and cargo answers error: no bin target named 'e2e_tests_runner' in default-run packages, with its own help line naming the owning package: available bin in 'torrust-tracker-e2e-tools' package. That is the missing -p flag #2179 describes, it fails before any test executes, and it reproduces identically on all three rebased dependabot heads. The Docker E2E job is skipped on every pull_request run here because the job's if: guard excludes pull requests whose base is develop or main.

Everything else at this head is green: Unit (nightly), Unit (stable) and Layer Boundary Bans pass in both the push and the pull_request Testing runs.

[da2ce7]

ACK 55ec165 — syn 3.0.4: patch byte-identical to the previously ACKed head, the bump adds no lockfile node because syn 3.0.4 was already present via ten proc-macro crates, the six items workspace-coupling uses are unchanged at 3.0.4, and all eight gates plus every CI job other than #2179's Docker E2E are green at this head.

[da2ce7]

Re-reviewed at 1f060a55d39ab989c65e694495258d1f6863fc70 (round r3), after the rebase onto develop e53892791af6f497ce4c35bce6bc7a3c55c97ee2, which now carries the all-dependencies maintenance update. Verified on a detached worktree at this exact head, toolchain rustc 1.100.0-nightly (a69a63265 2026-09-03), cargo 1.100.0-nightly (b2e9d5f9d 2026-09-02).

Verdict: approve. No blockers.

What moved since the previous round

The head went from 55ec1658 to 1f060a55. The manifest hunk is byte-identical between the two: contrib/dev-tools/analysis/workspace-coupling/Cargo.toml moves syn = { version = "2", features = [ "full", "visit" ] } to version = "3", and because that requirement is the bare caret "3", the 3.0.4-to-3.0.5 move is not a manifest change at all — only the locked patch version differs.

syn 3.0.5 contains exactly one change over 3.0.4: Report correct span for lex errors from LitStr::parse_with (dtolnay/syn#2080), confirmed against the upstream releases API rather than the PR body. This tool never calls LitStr::parse_with; its entire syn surface is syn::parse_file, syn::visit::{self, Visit}, syn::Path, syn::UseTree, and the two visitor methods visit_item_use and visit_macro (src/lib.rs:5-6,25-26,43,47). The 3.0.5 delta is inert here.

Diff

Two files, one line each. Cargo.lock retargets the workspace-coupling node's syn 2.0.119 edge to syn 3.0.5; nothing else in the lock moves. workspace-coupling is a first-class workspace member (root Cargo.toml:125), so the ordinary workspace gates do exercise it — and the check log confirms real compilation rather than a cache hit: Checking syn v3.0.5 followed by Checking workspace-coupling v0.1.0. The tool was additionally built, linted and tested through its own manifest; its 9 integration tests pass against syn 3.

Reverse dependencies, recomputed at this head

develop already resolves both syn majors, so the interesting question is what the bump actually changes in the build.

crate	on develop e5389279	at this head
syn 2.0.119	25 direct dependents: 24 proc-macro/derive crates plus workspace-coupling	24 direct dependents — the proc-macro crates only; workspace-coupling is gone
syn 3.0.5	13 direct dependents (async-trait, clap_derive, darling_core, darling_macro, displaydoc, futures-macro, multiversion-macros, serde_derive, serde_repr, serde_with_macros, thiserror-impl 2.x, tokio-macros, zerovec-derive)	the same 13, plus workspace-coupling

syn 2.0.119 stays in the graph after the bump because those 24 proc-macro crates still require syn ^2; that is upstream's business, not this repository's, and it resolves as those crates migrate.

The feature sets are the part worth stating plainly, because they make this a genuinely zero-risk change:

• syn 3.0.5 on develop already resolves with {clone-impls, default, derive, extra-traits, full, parsing, printing, proc-macro, visit, visit-mut}. Both features this tool asks for — full and visit — are already enabled by other dependents, so the bump adds no feature and triggers no rebuild of syn 3.
• syn 2.0.119's enabled set is {clone-impls, default, derive, extra-traits, fold, full, parsing, printing, proc-macro, visit, visit-mut} both before and after; other crates still enable full and visit on the 2.x line, so nothing shrinks there either.

Net effect on compiled third-party output: none. Exactly one crate is recompiled, workspace-coupling itself.

The major bump is API-inert for this consumer

syn 3.0.0's breaking changes are the ten new non-exhaustive *Modifiers structs, Type::BareFn to Type::FnPtr with BareVariadic to FnPtrVariadic, Type::Ptr's const_token/mutability unified into PointerMutability, attributes on every Type variant, BareFnArg to NamedArg, and the Expr::Closure or1_token/or2_token rename. This tool constructs no syntax-tree nodes and matches on none of those variants: it parses a file, walks it with the derived Visit default traversal, and records use paths and macro paths. That is why a major bump lands here as a one-line manifest edit with no code change — which is also the strongest argument that the change is complete rather than under-done.

syn 3.0.5 declares rust-version = "1.71", comfortably under the workspace MSRV of 1.88.

Nits

• The commit's updated-dependencies trailer still reads dependency-version: 3.0.4, and the branch is named dependabot/cargo/develop/syn-3.0.4, while the title, the manifest and the lock are all at 3.0.5. Stale bot metadata from the re-bump; cosmetic, and the merge commit takes its subject from the PR title, which is correct.
• cargo deny check bans reports warning[duplicate]: found 2 duplicate entries for crate 'syn'. That duplicate already exists on develop — both majors are in the base lock — so this PR neither creates nor removes it, and deny.toml's multiple-versions = "warn" accommodates it. bans ok.

Gates

Server lane, detached worktree at 1f060a55, one shared target directory under a lock; wait is time spent blocked on that lock, run is the command itself.

gate	exit	wait	run	result
cargo tree --workspace --locked --depth 0	0	111.8s	0.3s	lock consistent with the manifests
cargo check --workspace --all-targets	0	19.3s	2.5s
cargo clippy --workspace --all-targets -- -D warnings	0	3.6s	1.1s
cargo test --workspace	0	4.2s	139.9s	78 suites, 2631 passed, 0 failed, 2 ignored
cargo test --doc --workspace	0	171.4s	6.2s	24 suites, 30 passed, 0 failed, 2 ignored
cargo deny check bans	0	14.8s	1.4s	bans ok
linter all	0	21.2s	18.1s	all linters passed
cargo check -p workspace-coupling --all-targets	0	35.7s	2.5s
cargo clippy -p workspace-coupling --all-targets -- -D warnings	0	135.0s	0.6s
cargo test -p workspace-coupling	0	0.8s	2.0s	9 passed, 0 failed
contrib/dev-tools/git/hooks/pre-commit.sh --format=json	0	3.0s	33.0s	all 6 steps pass

The workspace test totals are identical to those measured at develop e5389279 and at the sibling base64 head, which is the empirical statement that this bump changes no test outcome.

One note on method: a bare cargo machete exits 1 here with two findings — torrust-tracker in packages/e2e-tools and torrust-tracker-client-lib in packages/test-helpers. Those reproduce byte-identically on develop e5389279, so they are pre-existing and unrelated to this PR, and the repository's own gate is cargo machete --with-metadata (pre-commit step 2), which passes in 7s.

CI at this head

workflow (event)	run	conclusion
Testing (pull_request)	34589079538	success
Container (pull_request)	34589079559	success
OS Compatibility (pull_request)	34589079526	success
Generate Coverage Report (PR)	34589079518	success
Docs Lint (pull_request)	34589079611	success
Docs Lint (push)	34589075329	success
OS Compatibility (push)	34589075158	success
Testing (push)	34589075079	failure — Docker E2E only

That single red is #2179, not this bump. In run 34589075079 the jobs Unit (stable), Unit (nightly) and Layer Boundary Bans all pass; only Docker E2E fails, and within it only the Run E2E Tests step, after Build Tracker Image succeeded. The step runs cargo run --bin e2e_tests_runner -- … (.github/workflows/testing.yaml:185) and cargo answers:

error: no bin target named `e2e_tests_runner` in default-run packages
help: available bin in `torrust-tracker-e2e-tools` package:
    e2e_tests_runner

Cargo's own help line names the owning package, which is the missing -p that #2179 describes. It fails at target resolution before any code executes, so no dependency version can influence it. The three qBittorrent steps are skipped as downstream, and they carry the same missing--p shape at lines 189/193/197, so they would fail identically if reached. The job is skipped on every pull_request run here because its if: guard excludes pull requests whose base is develop or main, and it is also skipped on pushes to develop/main/releases/* — which is precisely why the defect is invisible on develop and surfaces only on feature-branch pushes like this one.

[da2ce7]

ACK 1f060a5 — two-line bump of the workspace-coupling tool to syn 3, verified API-inert against its syn surface, with the workspace and the tool's own gates green and the only red CI job being the pre-existing #2179 Docker E2E target-resolution defect.

[dependabot]

Superseded by #2209.