Update phf to 0.14. Bump versions.

[xu-cheng]

Also bump MSRV to 1.85 as required by phf.

Per RELEASE.md, phf updates are breaking changes. Thus, bump versions for both web_atom and html5ever.

Depends on servo/string-cache#298

[xu-cheng]

Hi, any chance to merge this and publish a new version of html5ever? Thanks.

[nicoburns]

@mrobinson @Loirooriol @jdm @simonwuelker How urgent are the security fixes that seem to open against this repo recently?

This PR looks good to me, but I think landing it may mean that we can't upgrade the html5ever version in Servo until such time as cssparser and Stylo are also upgraded to phf 0.14 (Stylo is easy enough as we have our own fork, but cssparser will require coordination). So I'm not sure if we want to hold off on that and put out a patch release with the fixes first?

[Loirooriol]

Will this upgrade require change changes in cssparser? Or what's the coordination that you are concerned about?

[nicoburns]

Will this upgrade require change changes in cssparser? Or what's the coordination that you are concerned about?

cssparser and stylo/selectors also need an phf upgrade. If we want only one version of phf in Servo, then those upgrades all need to happen in sync. So the concern is that if we land this and the phf upgrade in cssparser / Stylo is slow then that might block us upgrading html5ever in Servo until that's resolved.

[simonwuelker]

How urgent are the security fixes that seem to open against this repo recently?

• Remove #[derive(Clone)] from SendTendril to prevent data races #753: Is pretty bad.
• Zero-initialize buffers in read_to_tendril and TendrilSink::read_from #752: Should not cause problems for any reasonable implementation of Read, but is still a source of potential UB. Looks like read_to_tendril is mostly used in tests, benchmarks and example code for tendril.
• Buf32 allocator capacity mismatch triggers Undefined Behavior upon reallocation/drop #751: No idea, depends on whether or not Vec::with_capacity actually over-allocates in practice.

I would strongly prefer not merging changes that prevent us from using the latest version of html5ever in servo.

[SimonSapin]

If it comes to that I think we should accept temporarily having two versions of phf in Servo rather than block security fixes

Still, let’s track moving Servo’s dependency graph to phf 0.14: servo/servo#47431

[SimonSapin]

By the way @nicoburns if anything Servo-related is blocked on reviews or releases in cssparser feel free to ping me