spdx=0.4.1 dependency increases MSRV to 1.52

[EndilWayfare]

Running cargo install pyoxidizer with Rust 1.50.0 on Windows 10 failed, complaining about use of unstable feature str_split_once.

The usage occurs in spdx::lexer::find_document_and_license_ref. The change was introduced in [email protected] as part of removing dependence on regex/lazy_static. That's awesome for compilation-speed/binary-size, but now all depending crates transitively depend on Rust >=1.52, the version which stabilized str::split_once. This isn't a big deal for me personally, because I don't have a reason to use an older toolchain (I just hadn't upgraded for a bit). But, since this project's MSRV is 1.46, I thought this might become an issue for someone else.

python-packaging, tugger-licensing, and tugger-licensing-net all depend on spdx = "0.4". Cloning the repo and building from source succeeds; the Cargo.lock pins spdx=0.4.0. However, cargo install --path pyoxidizer fails just like cargo install pyoxidizer. Apparently, cargo install doesn't respect Cargo.lock unless you use --locked.

Constraining spdx = "= 0.4.0" fixes this, at the cost of shackling users with Rust >=1.52 to the old implementation. On the other hand, that may be desirable for consistency between MSRV up to current version.

Alternatively, the documentation could add a suggestion to use cargo install --locked for older toolchains.

[EndilWayfare]

Ok, I just found out that pyoxidizer enforces Rust 1.52.1 as the minimum rust version for use with the cli.

I only thought of the MSRV because I had seen #324, being curious as to the relationship of this project with pyo3. There, it was specified as 1.46, and I found 1.46 associated with the most recent usage of "minimum" searching in Project History. I see now that 1.52.1 is mentioned much more recently in the context of "Manged Rust toolchain".

I think this PR is entirely useless, then. 😅