Pin transitive dependency "zeroize"

dialoguer depends on zeroize, which broke their public interface in 1.4.0 by
updating the minimum required rust version to 1.51.0.
Because we have 1.50.0, this does not work anymore.

Because dialoguer depends on zeroize "1.1.1", we can pin zeroize to 1.3 in our
dependencies, to force the build to not use the 1.4.* release (or newer) of
zeroize.

This is of course not a long-term solution. The proper fix is to update our
MSRV, but I do not want to do that right before our 0.2.0 release.

Signed-off-by: Matthias Beyer <matthias.beyer@atos.net>

2 files changed, 5 insertions, 0 deletions

diff --git a/Cargo.toml b/Cargo.toml
index b982d11..dce802a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -94,3 +94,7 @@ rand = "=0.4.3"
 # See https://github.com/bitvecto-rs/bitvec/issues/105#issuecomment-778570981
 funty = "=1.1.0"
 
+# Pin, because dialoguer pulls it in, but 1.4.x and newer has MSRV 1.51.0. With
+# the pin here, we enforce the build to not use 1.4.0 or newer.
+zeroize = ">=1.3.0, <1.4.0"
+
diff --git a/src/main.rs b/src/main.rs
index 59dd559..f32b3a5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -62,6 +62,7 @@ use logcrate::error;
 use rand as _; // Required to make lints happy
 use aquamarine as _; // doc-helper crate
 use funty as _; // doc-helper crate
+use zeroize as _; // Required to make lints happy
 
 mod cli;
 mod commands;