chore(deps): bisync yanked all releases, pending gix update to fix (#524)

* chore(deps): depsup

* fix(deps): pin gix to 0.85.0 to avoid yanked bisync dependency

gix-protocol 0.64.0+ (pulled in by gix 0.86.0+) depends on bisync
^0.3.0, and every published version of bisync has been yanked by its
author (permanently, as a supply-chain-risk precaution). This makes
gix >=0.86.0 unresolvable during a fresh `cargo update`, which is
exactly what the audit-check workflow does, so it now fails on both
this branch and master.

gix 0.85.0 depends on gix-protocol ^0.63.0, which predates the bisync
dependency, so pinning back to it avoids the yanked crate entirely
until upstream gitoxide ships a fix.

* chore(deps): gix to 0.87.1 to fix bisync yank, deps pulled to top level to ease maintenance.

Author: CraZySacX

Cargo.toml

@@ -14,20 +14,37 @@ members = [
 [workspace.dependencies]
 anyhow = "1.0.104"
 bon = "3.9.3"
-gix = { version = "0.86.0", default-features = false, features = [
+cargo_metadata = "0.23.1"
+console = "0.16.4"
+convert_case = "0.11.0"
+git2-rs = { version = "0.21.0", package = "git2", default-features = false }
+gix = { version = "0.87.1", default-features = false, features = [
     "revision",
     "worktree-mutation",
     "blocking-network-client",
     "sha1",
 ] }
 rand = { version = "0.10.2" }
 regex = { version = "1.13.1" }
+rkyv = { version = "0.8.18", features = ["std"] }
+rustc_version = "0.4.1"
 rustversion = "1.0.23"
+serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 serial_test = "4.0.1"
+sysinfo = "0.39.6"
 temp-env = "0.3.6"
+test_util = { version = "10.0.3", path = "test_util" }
 time = { version = "0.3.55", features = [
     "formatting",
     "local-offset",
     "parsing",
 ] }
+tracing = { version = "0.1.44", features = [
+    "max_level_trace",
+    "release_max_level_trace",
+] }
+tracing-subscriber = { version = "0.3.23", features = ["fmt"] }
+vergen = { version = "10.0.3", path = "vergen", default-features = false }
+vergen-gix = { version = "10.0.3", path = "vergen-gix" }
+vergen-lib = { version = "10.0.3", path = "vergen-lib" }

test_util/Cargo.toml

@@ -30,7 +30,7 @@ repo = ["gix", "rand"]
 
 [dependencies]
 anyhow = { workspace = true }
-gix = { workspace = true, optional = true}
+gix = { workspace = true, optional = true }
 rand = { workspace = true, optional = true }
 temp-env = { workspace = true }
 

vergen-git2/Cargo.toml

@@ -55,12 +55,10 @@ vcs_info = ["vergen-lib/vcs_info"]
 [dependencies]
 anyhow = { workspace = true }
 bon = { workspace = true }
-git2-rs = { version = "0.21.0", package = "git2", default-features = false }
+git2-rs = { workspace = true }
 time = { workspace = true }
-vergen = { version = "10.0.3", path = "../vergen", default-features = false }
-vergen-lib = { version = "10.0.3", path = "../vergen-lib", features = [
-    "git",
-] }
+vergen = { workspace = true }
+vergen-lib = { workspace = true, features = ["git"] }
 
 [build-dependencies]
 rustversion = { workspace = true }
@@ -69,7 +67,7 @@ rustversion = { workspace = true }
 regex = { workspace = true }
 serial_test = { workspace = true }
 temp-env = { workspace = true }
-test_util = { path = "../test_util", features = ["repo", "unstable"] }
+test_util = { workspace = true, features = ["repo", "unstable"] }
 
 [package.metadata.docs.rs]
 features = ["build", "cargo", "emit_and_set", "rustc", "si"]

vergen-gitcl/Cargo.toml

@@ -54,8 +54,8 @@ vcs_info = ["vergen-lib/vcs_info"]
 anyhow = { workspace = true }
 bon = { workspace = true }
 time = { workspace = true }
-vergen = { version = "10.0.3", path = "../vergen", default-features = false }
-vergen-lib = { version = "10.0.3", path = "../vergen-lib", features = ["git"] }
+vergen = { workspace = true }
+vergen-lib = { workspace = true, features = ["git"] }
 
 [build-dependencies]
 rustversion = { workspace = true }
@@ -64,7 +64,7 @@ rustversion = { workspace = true }
 regex = { workspace = true }
 serial_test = { workspace =  true }
 temp-env = { workspace = true }
-test_util = { path = "../test_util", features = ["repo", "unstable"] }
+test_util = { workspace = true, features = ["repo", "unstable"] }
 
 [package.metadata.docs.rs]
 features = ["build", "cargo", "emit_and_set", "rustc", "si"]

vergen-gix/Cargo.toml

@@ -73,17 +73,15 @@ gix = { workspace = true, features = [
     "sha1",
 ] }
 time = { workspace = true }
-vergen = { version = "10.0.3", path = "../vergen", default-features = false }
-vergen-lib = { version = "10.0.3", path = "../vergen-lib", features = [
-    "git",
-] }
+vergen = { workspace = true }
+vergen-lib = { workspace = true, features = ["git"] }
 
 [build-dependencies]
 rustversion = { workspace = true }
 
 [dev-dependencies]
 regex = { workspace = true }
-test_util = { path = "../test_util", features = ["repo", "unstable"] }
+test_util = { workspace = true, features = ["repo", "unstable"] }
 serial_test = { workspace = true }
 temp-env = { workspace = true }
 

vergen-lib/Cargo.toml

@@ -50,7 +50,7 @@ rustversion = { workspace = true }
 [dev-dependencies]
 serial_test = { workspace = true }
 temp-env = { workspace = true }
-test_util = { path = "../test_util", features = ["unstable"] }
+test_util = { workspace = true, features = ["unstable"] }
 
 [package.metadata.docs.rs]
 features = ["build", "cargo", "git", "rustc", "si"]

vergen-pretty/Cargo.toml

@@ -45,20 +45,17 @@ __vergen_empty_test = ["vergen-gix", "vergen-gix/unstable"]
 [dependencies]
 anyhow = { workspace = true }
 bon = { workspace = true }
-console = { version = "0.16.4", optional = true }
-convert_case = "0.11.0"
+console = { workspace = true, optional = true }
+convert_case = { workspace = true }
 rand = { workspace = true, optional = true }
-serde = { version = "1.0.229", features = ["derive"], optional = true }
-rkyv = { version = "0.8.17", features = ["std"], optional = true }
-tracing = { version = "0.1.44", features = [
-    "max_level_trace",
-    "release_max_level_trace",
-], optional = true }
+serde = { workspace = true, optional = true }
+rkyv = { workspace = true, optional = true }
+tracing = { workspace = true, optional = true }
 
 [build-dependencies]
 anyhow = { workspace = true }
 rustversion = { workspace = true }
-vergen-gix = { version = "10.0.3", path = "../vergen-gix", features = [
+vergen-gix = { workspace = true, features = [
     "build",
     "cargo",
     "rustc",
@@ -67,8 +64,8 @@ vergen-gix = { version = "10.0.3", path = "../vergen-gix", features = [
 
 [dev-dependencies]
 regex = { workspace = true }
-serde_json = "1.0.151"
-tracing-subscriber = { version = "0.3.23", features = ["fmt"] }
+serde_json = { workspace = true }
+tracing-subscriber = { workspace = true }
 
 [package.metadata.docs.rs]
 features = ["color", "header", "rkyv", "serde", "trace"]

vergen/Cargo.toml

@@ -36,19 +36,19 @@ emit_and_set = ["vergen-lib/emit_and_set"]
 [dependencies]
 anyhow = { workspace = true }
 bon = { workspace = true }
-cargo_metadata = { version = "0.23.1", optional = true }
+cargo_metadata = { workspace = true, optional = true }
 regex = { workspace = true, optional = true }
-rustc_version = { version = "0.4.1", optional = true }
-sysinfo = { version = "0.39.6", optional = true }
+rustc_version = { workspace = true, optional = true }
+sysinfo = { workspace = true, optional = true }
 time = { workspace = true, optional = true }
-vergen-lib = { version = "10.0.3", path = "../vergen-lib" }
+vergen-lib = { workspace = true }
 
 [build-dependencies]
 rustversion = { workspace = true }
 
 [dev-dependencies]
 regex = { workspace = true }
-test_util = { path = "../test_util", features = ["unstable"] }
+test_util = { workspace = true, features = ["unstable"] }
 serial_test = { workspace = true }
 temp-env = { workspace = true }