correct windows-core dependency version

[astraw]

As noted in #125 (comment), commit d3a9e0a introduced a potentially breaking change. This is the fix.

@MarijnS95 thanks for the tip. Do you know if there a public issue regarding this dependabot bug that we can link to? I spent a little bit of time looking around https://github.com/dependabot/dependabot-core/issues but didn't find anything relevant.

I would release this as 0.1.60.

Shall we then yank 0.1.59?

[Kijewski]

Shall we then yank 0.1.59?

Yes, I guess this would be a good idea.

[MarijnS95]

I'm not aware of an upstream reported issue about this (nor where to report it), but it might be good to include logs.

[astraw]

OK, 0.1.60 published and 0.1.59 yanked.

[ijackson]

FYI our release preparations for our monthly release of Art have been interrupted by this yank. We run cargo audit in CI so the yank caused our CI to fail. The original unintentional breaking change didn't affect us significantly.

I think it's usually a bad idea to yank a crate just becaue it has breaking changes. The correct response is simply to publish a fixed version in the same semver series.

[MarijnS95]

I think it's usually a bad idea to yank a crate just becaue it has breaking changes

While you might not be affected this time, other downstream consumers could be affected when e.g. running with -Zminimal-versions against a crate version that is broken, selected (indirectly) by certain projects, and not yanked.

[c-git]

I think it's usually a bad idea to yank a crate just becaue it has breaking changes

While you might not be affected this time, other downstream consumers could be affected when e.g. running with -Zminimal-versions against a crate version that is broken, selected (indirectly) by certain projects, and not yanked.

Thanks for explaining why it was yanked