build: unbreak CI by bumping vlen off the yanked 0.3.0

[martin-kolinek]

What

Bumps the workspace vlen dependency from the yanked 0.3.0 to 0.4.6 (latest non-yanked release).

Why

vlen 0.3.0 was yanked from crates.io. This makes cargo deny check advisories fail repo-wide:

error[yanked]: detected yanked crate (try `cargo update -p vlen`)
advisories FAILED

which takes down every static-analysis job and every anvil-pr / pr-fast job (the anvil-deny recipe) on any PR that re-runs CI. There is no in-range replacement — the only 0.3.x is the yanked 0.3.0 — so cargo update -p vlen cannot resolve it and the workspace requirement has to move to 0.4.

vlen is a transitive dependency via cargo-aprz-lib (varint encode/decode), unrelated to any single feature branch, so this is a standalone fix.

Validation

• The encode/decode API cargo-aprz-lib uses (vlen::decode::<u64> / vlen::encode_u64) is unchanged across the 0.3 → 0.4 major bump.
• cargo build -p cargo-aprz-lib — clean.
• cargo test -p cargo-aprz-lib — 816 passed, 0 failed.
• cargo deny check advisories — advisories ok.

[Copilot]

Pull request overview

Updates the workspace’s vlen dependency to a non-yanked release to restore cargo deny check advisories and unblock CI (notably static-analysis and anvil-deny-driven jobs).

Changes:

• Bump vlen from 0.3.0 (yanked) to 0.4.6 in workspace dependencies.
• Refresh Cargo.lock to reflect the new resolved vlen version and remove now-unneeded transitive crates.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
Cargo.toml	Bumps the workspace vlen version to 0.4.6 to avoid the yanked 0.3.0.
Cargo.lock	Updates the resolved dependency graph to vlen 0.4.6 and drops no-longer-required transitive dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

⚠️ Breaking Changes Detected

error: running 'cargo update' on crate 'cargo-aprz-lib' failed with output:
-----
    Updating crates.io index
error: failed to select a version for the requirement `vlen = "^0.3.0"`
  version 0.3.0 is yanked
location searched: crates.io index
required by package `cargo-aprz-lib v1.1.0 (/home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/62337a7653d949024cf13af633898891a821e187/crates/cargo-aprz-lib)`
    ... which satisfies path dependency `cargo-aprz-lib` of package `placeholder v0.0.0 (/home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/local-cargo_aprz_lib-1_1_0-x86_64_unknown_linux_gnu-b8ca82443f45339a)`

-----
error: failed to update dependencies for crate cargo-aprz-lib v1.1.0
note: this is unlikely to be a bug in cargo-semver-checks,
      and is probably an issue with the crate's Cargo.toml
note: the following command can be used to reproduce the compilation error:
      cargo new --lib example &&
          cd example &&
          echo '[workspace]' >> Cargo.toml &&
          cargo add --path /home/runner/work/ox-tools/ox-tools/target/semver-checks/git-origin_main/62337a7653d949024cf13af633898891a821e187/crates/cargo-aprz-lib --features internals &&
          cargo update

error: aborting due to failure to run 'cargo update' for crate cargo-aprz-lib v1.1.0

Stack backtrace:
   0: <anyhow::Error>::msg::<alloc::string::String>
   1: anyhow::__private::format_err
   2: cargo_semver_checks::data_generation::generate::generate_rustdoc
   3: <cargo_semver_checks::data_generation::request::CrateDataRequest>::resolve
   4: <cargo_semver_checks::rustdoc_gen::StatefulRustdocGenerator<cargo_semver_checks::rustdoc_gen::ReadyState>>::load_rustdoc
   5: <cargo_semver_checks::Check>::check_release::{closure#5}
   6: <cargo_semver_checks::Check>::check_release
   7: cargo_semver_checks::exit_on_error::<cargo_semver_checks::Report, cargo_semver_checks::main::{closure#5}>
   8: cargo_semver_checks::main
   9: std::sys::backtrace::__rust_begin_short_backtrace::<fn(), ()>
  10: main
  11: <unknown>
  12: __libc_start_main
  13: _start

If the breaking changes are intentional then everything is fine - this message is merely informative.

Remember to apply a version number bump with the correct severity when publishing a version with breaking changes (1.x.x -> 2.x.x or 0.1.x -> 0.2.x).

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.9%. Comparing base (12a8155) to head (f6302fb).

❌ Your project status has failed because the head coverage (99.9%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@          Coverage Diff          @@
##            main     #97   +/-   ##
=====================================
  Coverage   99.9%   99.9%           
=====================================
  Files        135     135           
  Lines      17449   17449           
=====================================
  Hits       17448   17448           
  Misses         1       1           

Flag	Coverage Δ
linux	99.9% <ø> (ø)
linux-arm	99.9% <ø> (ø)
scheduled	?
windows	99.9% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.