chore(deps): update Cargo.lock

[hanabi1224]

Description

• run cargo update
• lock webrtc-ice = "=0.10.0" to not break webrtc smoke tests
• fix cargo clippy warnings
• update deny.toml accordingly

Notes & open questions

Change checklist

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• A changelog entry has been made in the appropriate crates

[drHuangMHT]

Dependencies are managed by bots automatically, I don't think it is a good idea to just run cargo update and then done. cc @jxs

[hanabi1224]

@drHuangMHT As I understand, dependabot manages only direct dependencies, while cargo update bumps all indirect dependencies as well. Also, since libp2p works as libraries, having Cargo.lock in source control could give some false sense of security, it's important to regularly update all indirect dependencies. e.g. libp2p-webrtc smote test scenario does not work without locking webrtc-ice = "=0.10.0", or exclude Cargo.lock from source control.

However, this determinism can give a false sense of security because Cargo.lock does not affect the consumers of your package, only Cargo.toml does that.

[jxs]

Thanks for this @hanabi1224!

@drHuangMHT As I understand, dependabot manages only direct dependencies, while cargo update bumps all indirect dependencies as well. Also, since libp2p works as libraries, having Cargo.lock in source control could give some false sense of security, it's important to regularly update all indirect dependencies. e.g. libp2p-webrtc smote test scenario does not work without locking webrtc-ice = "=0.10.0", or exclude Cargo.lock from source control.

However, this determinism can give a false sense of security because Cargo.lock does not affect the consumers of your package, only Cargo.toml does that.

yeah this PR is helpful due to also the freeze in the webrc-ice freeze, can you just address the comment?
Thanks!