collin/anvil · f98caac9

Pin every dependency to a full semver version; untrack Cargo.lock

Collin Richards · 2026-08-25 06:46 UTC · f98caac96a50183c6fa615a9c40ead2a728d39c4 · parent a60d607b · browse files

modified.gitignore+1 −0

deletedCargo.lock+0 −5893

modifiedCargo.toml+24 −24

modifiedcrates/anvil-ci/Cargo.toml+1 −1

modifiedcrates/anvil-core/Cargo.toml+1 −1

modifiedcrates/anvil-git/Cargo.toml+1 −1

modifiedcrates/anvil-web/Cargo.toml+3 −3

modifiedvendor/gitserver-core/Cargo.toml+6 −6

	1	+	Cargo.lock
1	2		/target
2	3		/data
3	4		*.db
⋯ 11 unchanged lines

⋯ 79 unchanged lines
80	80		# (auth). Pinned to match russh's transitive ssh-key so fingerprints agree.
81	81
82	82		aes-gcm = { version = "0.11.1" }
83		-	anyhow = { version = "1" }
	83	+	anyhow = { version = "1.0.104" }
84	84		argon2 = { version = "0.6.0-rc.8", features = ["rand_core"] }
85		-	async-trait = { version = "0.1" }
86		-	axum = { version = "0.8", features = ["ws"] }
	85	+	async-trait = { version = "0.1.92" }
	86	+	axum = { version = "0.8.9", features = ["ws"] }
87	87		axum-extra = { version = "0.12.6", features = ["cookie"] }
88	88		base64 = { version = "0.22.1" }
89	89		bollard = { version = "0.21.1" }
90		-	clap = { version = "4", features = ["derive"] }
	90	+	clap = { version = "4.6.6", features = ["derive"] }
91	91		curve25519-dalek = { version = "5.0.0" }
92		-	flate2 = { version = "1" }
93		-	futures-util = { version = "0.3" }
	92	+	flate2 = { version = "1.1.9" }
	93	+	futures-util = { version = "0.3.34" }
94	94		gitserver-core = { path = "vendor/gitserver-core" }
95	95		gix = { version = "0.87.1", default-features = false, features = ["sha1", "max-performance-safe", "revision"] }
96	96		gix-pack = { version = "0.74.2", features = ["sha1"] }
97	97		hmac = { version = "0.13.0" }
98	98		lru = { version = "0.18.2" }
99		-	maud = { version = "0.27", features = ["axum"] }
100		-	pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
101		-	rand = { version = "0.10" }
	99	+	maud = { version = "0.27.0", features = ["axum"] }
	100	+	pulldown-cmark = { version = "0.13.4", default-features = false, features = ["html"] }
	101	+	rand = { version = "0.10.2" }
102	102		reqwest = { version = "0.13.4", default-features = false, features = ["form", "json", "rustls-no-provider"] }
103		-	ring = { version = "0.17" }
104		-	rpassword = { version = "7" }
	103	+	ring = { version = "0.17.14" }
	104	+	rpassword = { version = "7.5.4" }
105	105		rusqlite = { version = "0.40.2" }
106	106		russh = { version = "0.63.1", default-features = false, features = ["flate2", "ring", "rsa"] }
107		-	rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
108		-	serde = { version = "1", features = ["derive"] }
109		-	serde_json = { version = "1" }
110		-	serde_yaml = { version = "0.9" }
	107	+	rustls = { version = "0.23.43", default-features = false, features = ["ring", "logging", "std", "tls12"] }
	108	+	serde = { version = "1.0.229", features = ["derive"] }
	109	+	serde_json = { version = "1.0.151" }
	110	+	serde_yaml = { version = "0.9.34" }
111	111		sha2 = { version = "0.11.0" }
112	112		similar = { version = "3.2.0" }
113	113		ssh-key = { version = "0.7.0-rc.11" }
114		-	syntect = { version = "5", default-features = false, features = ["default-onig"] }
115		-	tar = { version = "0.4" }
116		-	thiserror = { version = "2" }
117		-	time = { version = "0.3", features = ["serde", "formatting"] }
	114	+	syntect = { version = "5.3.0", default-features = false, features = ["default-onig"] }
	115	+	tar = { version = "0.4.46" }
	116	+	thiserror = { version = "2.0.20" }
	117	+	time = { version = "0.3.55", features = ["serde", "formatting"] }
118	118		toasty = { version = "0.10.0", features = ["sqlite"] }
119		-	tokio = { version = "1", features = ["full"] }
120		-	tokio-util = { version = "0.7", features = ["io"] }
	119	+	tokio = { version = "1.53.1", features = ["full"] }
	120	+	tokio-util = { version = "0.7.19", features = ["io"] }
121	121		toml = { version = "1.1.4" }
122		-	tower = { version = "0.5" }
123		-	tracing = { version = "0.1" }
124		-	tracing-subscriber = { version = "0.3", features = ["env-filter"] }
	122	+	tower = { version = "0.5.3" }
	123	+	tracing = { version = "0.1.44" }
	124	+	tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }

⋯ 21 unchanged lines
22	22		tracing.workspace = true
23	23
24	24		[dev-dependencies]
25		-	tempfile = { version = "3" }
	25	+	tempfile = { version = "3.27.0" }

⋯ 37 unchanged lines
38	38
39	39		[dev-dependencies]
40	40		tokio = { workspace = true }
41		-	tempfile = { version = "3" }
	41	+	tempfile = { version = "3.27.0" }
42	42		# Tests mint throwaway ssh keys; the `ed25519` feature is what derives a public
43	43		# key from a seed. The library itself only ever parses keys, so it does not
44	44		# need it.
⋯ 1 unchanged line

⋯ 21 unchanged lines
22	22		tracing.workspace = true
23	23
24	24		[dev-dependencies]
25		-	tempfile = { version = "3" }
	25	+	tempfile = { version = "3.27.0" }

⋯ 35 unchanged lines
36	36		time.workspace = true
37	37
38	38		[dev-dependencies]
39		-	tempfile = { version = "3" }
	39	+	tempfile = { version = "3.27.0" }
40	40		serde_json.workspace = true
41	41		rand.workspace = true
42	42		ssh-key = { workspace = true, features = ["ed25519"] }
⋯ 2 unchanged lines
45	45		# The stand-in identity provider in tests/oidc_flow.rs generates a key and
46	46		# signs its own id tokens. ring, which verifies them on anvil's side, can only
47	47		# verify with an RSA key, not make one.
48		-	rsa = { version = "0.9" }
	48	+	rsa = { version = "0.9.10" }
49	49		# `oid` for the DigestInfo prefix PKCS#1 v1.5 (and so RS256) signs over. Its
50	50		# own 0.10 rather than the workspace's 0.11: `rsa` 0.9 is still on `digest`
51	51		# 0.10, and a `Sha256` from the newer generation does not satisfy its bounds.
52		-	sha2 = { version = "0.10", features = ["oid"] }
	52	+	sha2 = { version = "0.10.9", features = ["oid"] }

⋯ 16 unchanged lines
17	17		tracing = { workspace = true }
18	18		serde = { workspace = true }
19	19		thiserror = { workspace = true }
20		-	miniz_oxide = { version = "0.8" }
21		-	sha1 = { version = "0.10" }
22		-	tokio-stream = { version = "0.1" }
23		-	tokio-util = { version = "0.7", features = ["io", "io-util"] }
24		-	bytes = { version = "1" }
	20	+	miniz_oxide = { version = "0.8.9" }
	21	+	sha1 = { version = "0.10.7" }
	22	+	tokio-stream = { version = "0.1.19" }
	23	+	tokio-util = { version = "0.7.19", features = ["io", "io-util"] }
	24	+	bytes = { version = "1.12.1" }
25	25
26	26		[dev-dependencies]
27		-	tempfile = { version = "3" }
	27	+	tempfile = { version = "3.27.0" }
28	28		tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

1	-	# This file is automatically @generated by Cargo.
2	-	# It is not intended for manual editing.
3	-	version = 4
4	-
5	-	[[package]]
6	-	name = "adler2"
7	-	version = "2.0.1"
8	-	source = "registry+https://github.com/rust-lang/crates.io-index"
9	-	checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
10	-
11	-	[[package]]
12	-	name = "aead"
13	-	version = "0.6.1"
14	-	source = "registry+https://github.com/rust-lang/crates.io-index"
15	-	checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
16	-	dependencies = [
17	-	"crypto-common 0.2.2",
18	-	"inout",
19	-	]
20	-
21	-	[[package]]
22	-	name = "aes"
23	-	version = "0.9.2"
24	-	source = "registry+https://github.com/rust-lang/crates.io-index"
25	-	checksum = "f8eb277bec05f56a0e0591f155a484cbd0f4f07ff2905051a48c72f004f7ed58"
26	-	dependencies = [
27	-	"cipher",
28	-	"cpubits",
29	-	"cpufeatures 0.3.0",
30	-	"zeroize",
31	-	]
32	-
33	-	[[package]]
34	-	name = "aes-gcm"
35	-	version = "0.11.1"
36	-	source = "registry+https://github.com/rust-lang/crates.io-index"
37	-	checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
38	-	dependencies = [
39	-	"aead",
40	-	"aes",