Anchor version 0.28.0 seems to be broken

[AnderUstarroz]

New installations of Anchor 0.28.0 fails showing multiple Borsh errors while using following dependencies:

[dependencies]
anchor-lang = { version = "0.28.0", features = ["init-if-needed"] }
anchor-spl = { version = "0.28.0", features = ["metadata"] }
solana-program = "1.14.19"
mpl-token-metadata = { version = "1.12.0", features = ["no-entrypoint"] }

Errors displayed:

error[E0277]: the trait bound `Pubkey: BorshSerialize` is not satisfied
   --> src/system_program.rs:374:10
    |
374 | #[derive(Accounts)]
    |          ^^^^^^^^ the trait `BorshSerialize` is not implemented for `Pubkey`
    |
    = help: the following other types implement trait `BorshSerialize`:
              &T
              ()
              (T0, T1)
              (T0, T1, T2)
              (T0, T1, T2, T3)
              (T0, T1, T2, T3, T4)
              (T0, T1, T2, T3, T4, T5)
              (T0, T1, T2, T3, T4, T5, T6)
            and 81 others
    = help: see issue #48214
    = help: add `#![feature(trivial_bounds)]` to the crate attributes to enable
    = note: this error originates in the derive macro `Accounts` (in Nightly builds, run with -Z macro-backtrace for more info)

Issue is explained in more detail here.

I think that the error comes from this line forcing the Borsh version 0.10.3 instead of 0.9.3.

Suggestion
Replace that line by borsh = "=0.9.3" and bump a new "working" Anchor version 0.28.1?

[acheroncrypto]

[dependencies]
anchor-lang = "0.28.0"
anchor-spl = "0.28.0"
# ✅ Success

[dependencies]
anchor-lang = "0.28.0"
anchor-spl = "0.28.0"
mpl-token-metadata = "1.12.0"
# ❌ Error

💡 Conclusion: "Anchor version 0.28.0 seems to be broken"

Do you see the problem with that logic? I'll put forth a crazy idea: the problem is coming from the mpl-token-metadata crate.

---

I think that the error comes from this line forcing the Borsh version 0.10.3 instead of 0.9.3.

Suggestion
Replace that line by borsh = "=0.9.3" and bump a new "working" Anchor version 0.28.1?

Thanks for your analysis and your suggestion but it won't work because the latest Solana minor release bumped the borsh version to 0.10.3.

How to fix

There are 2 ways to solve this problem.

1. Downgrade solana crates and borsh version by running:

cargo update -p solana-zk-token-sdk --precise 1.14.19
cargo update -p borsh@0.10.3 --precise 0.9.3

2. Wait for mpl-token-metadata crate to release a new version that is compatible with the latest solana-program crate.

[dependencies]
solana-program = "1.16"
mpl-token-metadata = "1.12"
# ❌ Error

You can see that even without using Anchor, the latest solana-program and mpl-token-metadata crates don't compile together.