Tracking issue for cargo update

[jtgeibel]

We've tried twice now to land a broad cargo update against the backend, but both attempts resulted in segfaults in production. This was first attempted in #1263 (April 2018), and again in #1756 (June 2019).

I've been examining the differences between that first attempt, current master, and their common ancestor. Following is a list of crates which were bumped in that first attempt but which have not yet been superseded by a more recent version on master. My hope is that the problematic change will be within this set of crates.

I've added columns to capture the version bump from the 2nd attempt, and the most recent (possibly semver incompatible) published version. I've highlighted in bold the places where the version bump in the 2nd attempt was identical to the first.

	Master	1st attempt	2nd attempt	Most recent	Notes
aho-corasick	0.6.3	0.6.4	0.6.10	0.7.6	N/A after #1917
backtrace	0.3.3	0.3.5	0.3.26	0.3.34	#1861
docopt	0.8.1	0.8.3	0.8.3	1.1.0	only used in render-readmes binary #1812
filetime	0.1.14	0.1.15	0.1.15	0.2.7	old version pulled in via conduit-static - #2089
lazy_static	0.2.9	0.2.11	0.2.11	1.3.0	pulled in via old semver (via conduit) - #2099
maplit	1.0.0	1.0.1	1.0.1	1.0.1	#2089
num	0.1.40	0.1.42	gone	0.2.0	#1917
num-integer	0.1.35	0.1.36	0.1.41	0.1.41	#1917
num-iter	0.1.34	0.1.35	gone	0.1.39	#1917
openssl-probe	0.1.1	0.1.2	0.1.2	0.1.2	#2099
r2d2	0.8.1	0.8.2	0.8.4	0.8.6	#1899
regex	0.2.2	0.2.6	0.2.11	1.2.1	N/A after #1917
regex-syntax	0.4.1	0.4.2	gone	0.6.11	N/A after #1917
rustc-demangle	0.1.5	0.1.6	0.1.15	0.1.16	via backtrace #1861
thread_local	0.3.4	0.3.5	0.3.6	0.3.6	#1812
utf-8	0.7.1	0.7.2	0.7.5	0.7.5	via ammonia - #2089

I plan to start bumping crates on this list in an attempt to track down this old bug.

[sgrif]

This list is only the direct dependencies that were updated, not transitive dependencies, right?

[jtgeibel]

I basically did a 3-way diff of the lines at the bottom of Cargo.lock, so this should cover the entire set of dependencies. The comparison algorithm in Beyond Compare did a decent job, but I still had to manually align and compare quite a few lines so it's possible I've missed a few crates above.