axum pins itoa to `1.0.5` causing issues with cargo update

[alexheretic]

• I have looked for existing issues (including closed) about this

Bug Report

Version

axum v0.6.10

Platform

Linux

Description

cargo update on my project picks axum v0.6.7 which confused me. If I ask explicitly for the latest cargo update -p axum --precise 0.6.10 it downgrades itoa 1.0.6 -> 1.0.5. It's pinned to the latter in the axum manifest, which is presumably the reason for the funky default selection.

I don't see any benefit or mention of pinning in the pr that made this change. The pr is also older than itoa 1.0.6 so can't have been avoiding it. Perhaps this was simply a mistake?