update ring dependency about gitoxide

[phanen]

It appears to be just caused by an outdated lockfile.

> cargo update && cargo tree -i ring --no-default-features --features max-pure
ring v0.17.7
├── rustls v0.21.10
│   ├── hyper-rustls v0.24.2
│   │   └── reqwest v0.11.22
│   │       ├── gix v0.56.0 (/home/phan/b/gitoxide/gix)
│   │       │   ├── gitoxide v0.32.0 (/home/phan/b/gitoxide)
│   │       │   └── gitoxide-core v0.34.0 (/home/phan/b/gitoxide/gitoxide-core)
│   │       │       └── gitoxide v0.32.0 (/home/phan/b/gitoxide)
│   │       └── gix-transport v0.39.0 (/home/phan/b/gitoxide/gix-transport)
│   │           ├── gitoxide-core v0.34.0 (/home/phan/b/gitoxide/gitoxide-core) (*)
│   │           ├── gix v0.56.0 (/home/phan/b/gitoxide/gix) (*)
│   │           └── gix-protocol v0.42.0 (/home/phan/b/gitoxide/gix-protocol)
│   │               └── gix v0.56.0 (/home/phan/b/gitoxide/gix) (*)
│   ├── reqwest v0.11.22 (*)
│   └── tokio-rustls v0.24.1
│       ├── hyper-rustls v0.24.2 (*)
│       └── reqwest v0.11.22 (*)
├── rustls-webpki v0.101.7
│   └── rustls v0.21.10 (*)
└── sct v0.7.1
    └── rustls v0.21.10 (*)

I've successfully built it on RISC-V (also supported in ring 0.17+).

[Skgland]

On the point of dependency updates it might be of interest to include an update of the url crate to 2.5.0 to get the transitive idna dependency from 0.4.0 to 0.5.0, to get the fix for servo/rust-url#870

[Byron]

Thanks for letting me know! I wasn't aware a new release of url was available.

Otherwise, it seems like ring comes in with reqwest, which didn't see an upgrade yet.

❯ cargo tree -i ring --no-default-features --features max-pure
ring v0.16.20
├── rustls v0.21.7
│   ├── hyper-rustls v0.24.1
│   │   └── reqwest v0.11.22
│   │       ├── gix v0.56.0 (/Users/byron/dev/github.com/Byron/gitoxide/gix)
│   │       │   ├── gitoxide v0.32.0 (/Users/byron/dev/github.com/Byron/gitoxide)
│   │       │   └── gitoxide-core v0.34.0 (/Users/byron/dev/github.com/Byron/gitoxide/gitoxide-core)
│   │       │       └── gitoxide v0.32.0 (/Users/byron/dev/github.com/Byron/gitoxide)
│   │       └── gix-transport v0.39.0 (/Users/byron/dev/github.com/Byron/gitoxide/gix-transport)
│   │           ├── gitoxide-core v0.34.0 (/Users/byron/dev/github.com/Byron/gitoxide/gitoxide-core) (*)
│   │           ├── gix v0.56.0 (/Users/byron/dev/github.com/Byron/gitoxide/gix) (*)
│   │           └── gix-protocol v0.42.0 (/Users/byron/dev/github.com/Byron/gitoxide/gix-protocol)
│   │               └── gix v0.56.0 (/Users/byron/dev/github.com/Byron/gitoxide/gix) (*)
│   ├── reqwest v0.11.22 (*)
│   └── tokio-rustls v0.24.1
│       ├── hyper-rustls v0.24.1 (*)
│       └── reqwest v0.11.22 (*)
├── rustls-webpki v0.101.6
│   └── rustls v0.21.7 (*)
└── sct v0.7.0
    └── rustls v0.21.7 (*)

[Byron]

Oh, that's interesting as I have just closed the PR. Can you reopen it with only a subset of crates updated?

Please note that the lock file is only for CI and for providing binaries - users who build gix themselves will typically not use the lock file and get the latest dependencies for that reason.