build(deps): bump syn from 2.0.119 to 3.0.4

[dependabot]

Bumps syn from 2.0.119 to 3.0.4.

Release notes

Sourced from syn's releases.

3.0.4

• Allow safe fn in impl Parse for ForeignItemFn (#2078)

3.0.3

• Documentation improvements

3.0.2

• Add Error::new_range(start..end, "msg") (#2068, #2070)
• Add Cursor::prev_span

3.0.1

• Parse const traits (#2056, #2057, #2058, #2063, #2064)
• Parse unsafe binder types (#2065)
• Parse impl restrictions (#2066)

3.0.0

This release contains adjustments to the syntax tree to account for ongoing Rust language development from the 3 years since syn 2.0.0 and to anticipate some in-flight Rust language RFCs.

These include: default values in fields, pinned type sugar, raw lifetimes, generator blocks and functions, unnamed enum variants, attributes in tuple types and tuple patterns, named arguments in parenthesized generic argument lists, lightweight clones, const traits, const function pointers, mutability restricted fields, supertrait auto implementation, final associated functions, trait implementability restrictions, const blocks in path arguments, item-level const blocks, return type notation, never patterns, function delegation, mutable by-reference bindings, in-place initialization, field projections, explicitly dyn-compatible traits, view types, file-level frontmatter, generic const arguments, guard patterns, lazy type aliases, explicitly safe foreign items, super let, unsafe fields, pattern types, heterogeneous try-blocks, function contracts, async function trait bounds, static closure coroutine syntax, unsafe binder types, move expressions, for-await loops, and postfix keywords.

Breaking changes

Modifiers

To reserve more room for language evolution, there are 10 new non-exhaustive structs in the syntax tree having the following commonality:

• Name ending in Modifiers. {BlockModifiers, ClosureModifiers, ConstModifiers, FieldModifiers, FnModifiers, ImplModifiers, LocalModifiers, TraitBoundModifiers, TraitModifiers, TypeModifiers}

• Each implements Default. The default value is guaranteed to comprise no tokens.

• Non-exhaustive. Can only be instantiated by Syn's parser or by creating and then mutating ▁▁Modifiers::default().

• Does not implement Parse. When parsing, they are parsed by the enclosing syntax tree node.

• Does not implement ToTokens. In some cases the syntax that these nodes might hold in the future is not necessarily contiguous tokens.

• Provides .require_empty() -> Result<()> which returns a meaningfully spanned error if the modifiers are different from the empty default. This enables a caller to reject syntax it does not recognize without knowing what that syntax may be.

Types

• Type::BareFn has been renamed to Type::FnPtr to mirror the compiler's terminology. Together with this, BareVariadic is renamed to FnPtrVariadic.

• The mutually exclusive const_token and mutability fields of Type::Ptr have been unified into an enum of type PointerMutability, which was already previously used by Expr::RawAddr.

• Every Type variant now holds attributes, which can represent the attributes of element types inside a tuple type, or attributes for a function return type.

... (truncated)

Commits

• b5d62a6 Release 3.0.4
• abf019c Merge pull request #2078 from dtolnay/foreginitemfn
• d454333 Allow safe fn in impl Parse for ForeignItemFn
• 8011b1c Update test suite to nightly-2026-08-18
• 56a8d83 Raise rayon thread size for tests
• f2c5c50 Ignore assert_is_empty pedantic clippy lint
• 0eba76d Update test suite to nightly-2026-08-05
• baaebce Update test suite to nightly-2026-07-25
• b886a38 Update test suite to nightly-2026-07-24
• 3c41416 Update test suite to nightly-2026-07-23
• Additional commits viewable in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.97%. Comparing base (65a077b) to head (55ec165).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #2106   +/-   ##
========================================
  Coverage    84.96%   84.97%           
========================================
  Files          351      351           
  Lines        30208    30208           
  Branches     30208    30208           
========================================
+ Hits         25665    25668    +3     
+ Misses        4171     4168    -3     
  Partials       372      372           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[da2ce7]

@dependabot rebase

[da2ce7]

Reviewed at 310b3a75d49eb905491261c3eed17a8a9f173c57.

Verified on a detached worktree at this exact head (rebased onto develop 89d45145, 0 behind), toolchain rustc 1.100.0-nightly (a69a63265 2026-09-03).

Diff. One line in contrib/dev-tools/analysis/workspace-coupling/Cargo.toml (syn = { version = "2", … } to "3", same ["full", "visit"] feature list) and one line in Cargo.lock retargeting that package's edge from syn 2.0.119 to syn 3.0.4. No package is added or removed, and no other version moves.

Graph effect. syn 3.0.4 was already a node at the base with 10 dependents; after this PR it has 11. syn 2.0.119 keeps its 34 transitive dependents (axum-macros, darling_core, mockall_derive, serde_with_macros, sqlx-macros, thiserror-impl, tracing-attributes, …). So both majors were already resolved before this change; it moves the only first-party syn consumer onto the newer one and adds no duplicate. That is also why cargo update -p syn --precise 3.0.4 cannot express it — the second major already exists as its own node, so the manifest requirement is what has to move, which is exactly what this PR does.

API compatibility. syn ships no changelog in the packaged crate, so this was checked against the sources. The feature tables are identical between 2.0.119 and 3.0.4, as are edition = "2021" and rust-version = "1.71", and the src/ and src/gen/ file lists match. Every item workspace-coupling/src/lib.rs touches is byte-identical across the majors:

• pub trait Visit<'ast> — same declaration;
• visit_file, visit_item_use, visit_macro, visit_path — identical signatures in both the trait and the free-function form (only line numbers move; gen/visit.rs grows 3941 to 4037 lines because syn 3 visits more AST nodes);
• enum UseTree with all five variants (Path, Name, Rename, Glob, Group), matched exhaustively by collect_use_tree;
• struct ItemUse, struct Macro, struct Path;
• pub fn parse_file(mut content: &str) -> Result<File>.

Gates at this head, --workspace --all-targets --all-features:

gate	exit	wall
cargo check	0	3.4s
cargo clippy … -- -D warnings	0	4.1s
cargo test	0	141.1s — 57 suites, 2603 passed, 0 failed
cargo machete --with-metadata	0	7.7s
cargo deny check bans	0	1.5s
linter all	0	20.9s
contrib/dev-tools/git/hooks/pre-commit.sh	0	40.7s — all 6 steps pass
cargo test --doc --workspace	0	6.2s — 30 passed

workspace-coupling is a workspace member, so --workspace builds it, and its own tests/parse_imports.rs is the direct exercise of the changed dependency; it passes.

Checklist items a manifest and lockfile change cannot exercise are non-applicable: no new functionality so no new tests, no public API added so no doc comments, no user-facing behaviour change so no docs update, no new terms for project-words.txt. Title is Conventional Commits, base branch is develop, and the description carries the upstream release notes.

CI at this head. Every workflow run is green except one: Testing (push) run 34460557287, whose sole failing job is Docker E2E. Green: Testing (pull_request) 34460561678, OS Compatibility 34460561640 / 34460557247, Database Compatibility 34460557310, Database Benchmarking 34460557224, Container 34460561724, Generate Coverage Report (PR) 34460561647, Docs Lint 34460561623 / 34460557277, Copilot Setup Steps 34460557222.

That Docker E2E red is #2179's defect, not this bump's. The job log fails at cargo run --bin e2e_tests_runner … with error: no bin target named 'e2e_tests_runner' in default-run packages / help: available bin in 'torrust-tracker-e2e-tools' package, i.e. the missing -p flag described in #2179 (specification in #2194). It reproduces identically on the other two dependabot heads currently open and cannot be affected by a dependency version, since it fails before any test runs. The pull_request run's Docker E2E is skipped by design, because container.yaml covers that event.

[da2ce7]

ACK 310b3a7 — syn 3.0.4: every API item workspace-coupling uses is byte-identical to syn 2.0.119, syn 3 was already in the graph, and check, clippy -D warnings, test (2603 passed), machete, deny bans, linter all, doctests and the pre-commit hook all green at this head.

[da2ce7]

@dependabot rebase

[da2ce7]

Re-reviewed at 55ec16580ab2dc5910552c9edae0ed8e4069d54b on 2026-09-10, after the rebase onto develop 65a077b5 (merge-base is 65a077b5, 0 behind).

Verified on a detached worktree at this exact head, toolchain rustc 1.100.0-nightly (a69a63265 2026-09-03), cargo 1.100.0-nightly (b2e9d5f9d 2026-09-02).

Rebase. The head moved from 310b3a75d49eb905491261c3eed17a8a9f173c57 to 55ec16580ab2dc5910552c9edae0ed8e4069d54b when the branch was rebased from develop 89d45145 onto 65a077b5. The patch itself did not change: git diff 89d45145 310b3a75 and git diff 65a077b5 55ec1658 produce byte-identical output (775 bytes, 24 lines), so the diff-of-diffs is empty and this is the same change re-parented. Both old and new head are single commits whose only parent is the respective base.

What develop gained in between is #2188 and #2189 — six documentation files plus tests/AGENTS.md and tests/common/workspace.rs, which drops the environment-variable guard from the integration-test fixture in favour of an explicit config path. Nothing in that delta mentions base64, syn or rstest, and it touches no Cargo.toml and no Cargo.lock, so it cannot interact with this bump. The gates below were nonetheless re-run in full at the new head rather than carried over.

Diff. Two files, 2 insertions / 2 deletions. contrib/dev-tools/analysis/workspace-coupling/Cargo.toml moves syn = { version = "2", features = [ "full", "visit" ] } to version = "3", and Cargo.lock changes that package's single dependency line from syn 2.0.119 to syn 3.0.4.

API, re-derived from the vendored sources at the locked versions. workspace-coupling is the only crate in the workspace that uses syn, and contrib/dev-tools/analysis/workspace-coupling/src/lib.rs uses six items: syn::parse_file, syn::Error, the syn::visit::Visit trait with visit_item_use, visit_macro and visit_path overridden, and the syn::ItemUse, syn::UseTree, syn::Path and syn::Macro types. Every one is unchanged at 3.0.4. The ItemUse and Macro structs, the UseTree enum and the Path struct are byte-identical to their 2.0.119 definitions. pub fn parse_file(mut content: &str) -> Result<File> is the same signature at syn-3.0.4/src/lib.rs:1108 and syn-2.0.119/src/lib.rs:992. fn visit_item_use(&mut self, i: &'ast crate::ItemUse) and fn visit_macro(&mut self, i: &'ast crate::Macro) are the same at syn-3.0.4/src/gen/visit.rs:522 and :577. The full and visit features both still exist, and rust-version stays at 1.71.

syn 3 is a real major elsewhere: the Visit trait renames visit_type_bare_fn to visit_type_fn_ptr, drops visit_bare_fn_arg, visit_bare_variadic, visit_field_mutability, visit_impl_restriction, visit_span and visit_trait_bound_modifier, and adds visit_frontmatter, visit_named_arg, visit_pat_guard, visit_receiver_kind, visit_safety and visit_where_clause_placement, with matching churn in the top-level type re-exports. None of that reaches this consumer: the visitor overrides three methods that survive unchanged, and Visit's methods are all provided, so additions are not breaking for a partial implementor.

Lockfile. The change is one line. syn 3.0.4 was already a node in the lockfile at the base, pulled in by ten proc-macro crates — async-trait, clap_derive, displaydoc, futures-macro, ref-cast-impl, serde_derive, serde_repr, thiserror-impl, tokio-macros and zerovec-derive. This bump adds no package and removes none; it only re-points workspace-coupling's edge from syn 2.0.119 to the syn 3.0.4 already being built. The duplicate count is unchanged at two, which is why cargo deny check bans reports the same warning[duplicate]: found 2 duplicate entries for crate 'syn' here as on the two sibling heads that do not touch syn.

Gates at this head, all on the server, one shared target directory, the three PRs serialized under a lock:

gate	exit	wall
cargo check --workspace --all-targets --all-features	0	1.0s
cargo clippy --workspace --all-targets --all-features -- -D warnings	0	1.2s
cargo test --workspace --all-targets --all-features	0	133.9s — 57 suites, 2603 passed, 0 failed, 0 ignored
cargo test --doc --workspace	0	6.1s — 30 passed, 0 failed, 2 ignored
cargo machete --with-metadata	0	7.8s — no unused dependencies
cargo deny check bans	0	1.4s — bans ok
linter all	0	18.7s
contrib/dev-tools/git/hooks/pre-commit.sh	0	33.6s — all 6 steps pass

The suite and case totals are identical across all three rebased heads and identical to the previous round, which is the empirical statement that this bump changes no test outcome.

CI at this head.

workflow (event)	run	conclusion
Testing (pull_request)	34498394115	success
Testing (push)	34498389494	failure — Docker E2E only
Container (pull_request)	34498393906	success
OS Compatibility (pull_request)	34498394016	success
OS Compatibility (push)	34498389439	success
Generate Coverage Report (PR)	34498393968	success
Docs Lint (pull_request)	34498393916	success
Docs Lint (push)	34498389515	success

That one red is #2179, not this bump. In each failing run the only failing job is Docker E2E and within it the only failing step is Run E2E Tests; the preceding Build Tracker Image step succeeds and the three qBittorrent steps are skipped as downstream of the failure. The step runs cargo run --bin e2e_tests_runner -- … and cargo answers error: no bin target named 'e2e_tests_runner' in default-run packages, with its own help line naming the owning package: available bin in 'torrust-tracker-e2e-tools' package. That is the missing -p flag #2179 describes, it fails before any test executes, and it reproduces identically on all three rebased dependabot heads. The Docker E2E job is skipped on every pull_request run here because the job's if: guard excludes pull requests whose base is develop or main.

Everything else at this head is green: Unit (nightly), Unit (stable) and Layer Boundary Bans pass in both the push and the pull_request Testing runs.

[da2ce7]

ACK 55ec165 — syn 3.0.4: patch byte-identical to the previously ACKed head, the bump adds no lockfile node because syn 3.0.4 was already present via ten proc-macro crates, the six items workspace-coupling uses are unchanged at 3.0.4, and all eight gates plus every CI job other than #2179's Docker E2E are green at this head.