resolve cargo audit warns and dedupe few deps

[klensy]

See commits. Sadly, idna pulled big tree of new deps.

[Kobzol]

Thanks! I checked this and it adds like 20 new packages though 😞 Could we keep just the RUSTSEC updates, i.e. basically the first and third commits? That on its own actually reduces the package count by a few.

[klensy]

Thanks! I checked this and it adds like 20 new packages though 😞 Could we keep just the RUSTSEC updates, i.e. basically the first and third commits? That on its own actually reduces the package count by a few.

Yes, this is:

Sadly, idna pulled big tree of new deps.

reqwest bump required for idna bump (i've tried and it didn't worked without url -> reqwest bump):
(you can check 3rd commit - most new deps from it)

idna v1.0.3
└── url v2.5.4
    ├── reqwest v0.11.27

I've dropped clap bump and killed few windows deps, should be better (redox deps unused anyway)

[Kobzol]

I tried this: cargo update ruzstd openssl tempfile futures-util idna and that resulted in 4 less packages for cargo build -p collector.

[klensy]

cargo update ruzstd openssl tempfile futures-util idna

Yes, because your update didn't update idna :-)

[Kobzol]

I see. I mean, the idna vulnerability doesn't exactly look terrifying, but so be it.

Thanks!

[klensy]

I see. I mean, the idna vulnerability doesn't exactly look terrifying, but so be it.

Thanks!

Yes, didn't look that scary.