Increasing MSRV problem with wasmer version auto-updating

[brew0722]

cosmwasm 0.16.3 uses wasmer 2.0.

However, wasmer 2.0 does not pin subpackages to 2.0, so the minor version is automatically increased. (2.0 -> 2.2) The problem is that wasmer 2.2's MSRV is different from 2.0. Previously it was rust 1.54, but rust 1.55 is required.

We were able to restrict the wasmer version via cargo.lock in the cosmwasm and wasmvm repo.

But the problem arises again with contracts. For test logic of contracts, refer to cosmwasm-vm package as dev-dependencies. So, the contract again has wasmer 2.2.0 dependency, and the above problem is reproduced.

After all, a lower rust version can compile the contract, but cannot test that. Until cargo.lock limits the wasmer subpackages. So we must bump-up up to cosmwasm 0.16.4 with msrv of 1.55.0.

[brew0722]

This is precisely because of hashbrown 0.12.0 of rkyv's dependencies used by wasmer. The problem of wasmer version automatically updating was solved by pinning subpackages to "=2.2.0" in 2.2.0. But the rkyv is still not pinned so the same problem is reproduced.

This problem has been fixed in cosmwasm 0.16.5, but it may occur again in the process of developing a new contract or updating an existing contract. https://github.com/CosmWasm/cosmwasm/issues/1244

[brew0722]

similar issue https://github.com/CosmWasm/cosmwasm/issues/1204

I recommend that you look at all the comments on the above issues. Fundamentally, the problem arises because there is no specifications of the cargo dependency system and msrv. This bomb can be brust again anywhere we use Rust.