Pin gix-transport (#642)

Fucked again by `cargo install` not using the lockfile unless explicitly
specified.

rust-lang/cargo#7169

Resolves: #641

Author: Jake-Shadle

CHANGELOG.md

@@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- next-header -->
 ## [Unreleased] - ReleaseDate
+### Fixed
+- [PR#642](https://github.com/EmbarkStudios/cargo-deny/pull/642) resolved [#641](https://github.com/EmbarkStudios/cargo-deny/issues/641) by pinning `gix-transport` (and its unique dependencies) to 0.41.2 as a workaround for `cargo install` not using the lockfile. See [this issue](https://github.com/Byron/gitoxide/issues/1328) for more information.
+
 ## [0.14.19] - 2024-03-21
 ### Changed
 - [PR#639](https://github.com/EmbarkStudios/cargo-deny/pull/639) updated tame-index to avoid an error if you don't used `--locked`.

Cargo.lock

@@ -131,6 +131,22 @@ features = [
   "worktree-mutation",
 ]
 
+# Pin gix-transport to this version, people who don't use --locked will get 0.41.3
+# which is either itself broken, or else one the following versions it depends
+# on has introduced a bug
+# Removing h2 v0.4.3
+# Removing http v1.1.0
+# Removing http-body v1.0.0
+# Removing http-body-util v0.1.1
+# Removing hyper v1.2.0
+# Removing hyper-util v0.1.3
+# Removing pin-project v1.1.5
+# Removing pin-project-internal v1.1.5
+# Removing reqwest v0.12.1
+# Removing tower v0.4.13
+# Removing tower-layer v0.3.2
+gix-transport = "<=0.41.2"
+
 [dev-dependencies]
 # Folder copying
 fs_extra = "1.3"