Repository navigation
chore: centralize nine stray dependency specifiers into [workspace.dependencies] #1495
Description
Warning
This content was written by an AI agent and must be verified by a human developer. After human verification, this alert may be removed.
Summary
The workspace centralizes dependency versions in the root Cargo.toml, but nine specifiers are declared directly in member manifests.
Sites
| Crate | Dependency |
|---|---|
graphcal-cli |
fs2 = "0.4.3" |
graphcal-compiler |
jiff-tzdb = "=0.1.8" |
graphcal-io |
cap-std = "4.0.2" (under [target.'cfg(not(target_arch = "wasm32"))'.dependencies]) |
graphcal-lsp |
loom = "0.7" |
graphcal-package |
url = "2.5.8" |
graphcal-wasm |
js-sys = "0.3.104" |
graphcal-wasm |
serde-wasm-bindgen = "0.6.5" |
graphcal-wasm |
wasm-bindgen = "0.2.126" |
graphcal-wasm |
wasm-bindgen-test = "=0.3.77" |
Roughly 40 other dependencies are correctly centralized in [workspace.dependencies].
Impact
Not a security issue — cargo deny check advisories reports advisories ok at 6e462341a. It is purely that version policy for these nine is not visible where the rest lives, so a version bump or pin review can miss them.
Suggested fix
Move all nine to [workspace.dependencies], preserving:
- the
=pins onjiff-tzdbandwasm-bindgen-test - the
cfg(not(target_arch = "wasm32"))gate oncap-std, which stays at the member level (cap-std.workspace = trueinside the existing[target...]section)
Provenance
Found during a full-workspace code review at 6e462341a (v0.0.1-alpha.27). Baseline at that commit: cargo clippy --workspace --all-targets clean, cargo test --workspace 2926 passed / 0 failed, cargo deny check advisories ok.
Activity