Speedup pre-release CI runs (#1804)

.cargo/config.toml

@@ -1,8 +1,3 @@
-# Set macOS deployment target to avoid linker warnings
-# Use Rust project defaults: 10.12 for x86_64, 11.0 for aarch64
-[target.x86_64-apple-darwin.env]
-MACOSX_DEPLOYMENT_TARGET = "10.12"
-
 [target.x86_64-apple-darwin]
 rustflags = [
     "-C", "link-arg=-framework",
@@ -13,9 +8,6 @@ rustflags = [
     "-C", "link-arg=Foundation",
 ]
 
-[target.aarch64-apple-darwin.env]
-MACOSX_DEPLOYMENT_TARGET = "11.0"
-
 [target.aarch64-apple-darwin]
 rustflags = [
     "-C", "link-arg=-framework",

.github/workflows/pre-release.yml

@@ -27,6 +27,7 @@ env:
   NODE_VERSION: 22
   PNPM_VERSION: 10.13.1
   RUST_TOOLCHAIN: nightly-2025-12-04
+  CARGO_XWIN_VERSION: 0.20.2
 
 jobs:
   bump-version:
@@ -119,7 +120,7 @@ jobs:
 
   build-frontend:
     needs: bump-version
-    runs-on: ubuntu-latest-m
+    runs-on: ubuntu-latest-x64-l
     env:
       VITE_PUBLIC_REACT_VIRTUOSO_LICENSE_KEY: ${{ secrets.PUBLIC_REACT_VIRTUOSO_LICENSE_KEY }}
       VITE_VK_SHARED_API_BASE: ${{ secrets.VK_SHARED_API_BASE }}
@@ -169,23 +170,19 @@ jobs:
   build-backend:
     needs: [bump-version, build-frontend]
     runs-on: ${{ matrix.os }}
-    container: ${{ matrix.container }}
     strategy:
       # Platform matrix - keep target/name in sync with package-npx-cli job
       matrix:
         include:
           - target: x86_64-unknown-linux-musl
             os: ubuntu-latest-x64-l
-            container: &zigbuild_container ghcr.io/rust-cross/cargo-zigbuild@sha256:af1bc2b869c5d76c1300f7a4685c2f1793d068e6e895c9f5c399b517b31a731e
             name: linux-x64
           - target: aarch64-unknown-linux-musl
             os: ubuntu-latest-arm64-l
             name: linux-arm64
-            container: *zigbuild_container
           - target: x86_64-pc-windows-msvc
-            os: windows-latest-l
+            os: ubuntu-latest-x64-l
             name: windows-x64
-          # Intel-only runner; last supported x86_64 image (EOL Aug 2027)
           - target: x86_64-apple-darwin
             os: macos-15-xlarge
             name: macos-x64
@@ -193,13 +190,30 @@ jobs:
             os: macos-15-xlarge
             name: macos-arm64
           - target: aarch64-pc-windows-msvc
-            os: windows-latest-l
+            os: ubuntu-latest-x64-l
             name: windows-arm64
+    env:
+      CARGO_INCREMENTAL: "0"
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
+      SCCACHE_CACHE_SIZE: "10G"
+      CARGO_HOME: ${{ github.workspace }}/.cargo
+      RUSTUP_HOME: ${{ github.workspace }}/.rustup
+      XWIN_CACHE_DIR: ${{ github.workspace }}/.xwin-cache
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ needs.bump-version.outputs.new_tag }}
 
+      - name: Setup sccache
+        uses: BloopAI/sccache-action@main
+
+      - name: Cache Rust toolchain
+        uses: actions/cache@v4
+        with:
+          path: .rustup/toolchains
+          key: rust-toolchain-${{ runner.os }}-${{ matrix.target }}-${{ env.RUST_TOOLCHAIN }}
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -207,21 +221,65 @@ jobs:
           targets: ${{ matrix.target }}
           components: rustfmt, clippy
 
-      - name: Install libclang (Linux)
+      - name: Install dependencies (Linux)
         if: runner.os == 'Linux'
         run: |
-          apt-get update
+          sudo apt-get update
-          DEBIAN_FRONTEND=noninteractive apt-get install -y clang libclang-dev
+          DEBIAN_FRONTEND=noninteractive sudo apt-get install -y clang libclang-dev lld llvm nasm cmake ninja-build
 
-      - name: Cache Rust dependencies
+          if [[ "${{ matrix.target }}" == *"windows"* ]]; then
-        uses: Swatinem/rust-cache@v2
+            DEBIAN_FRONTEND=noninteractive sudo apt-get install -y clang-19 clang-tools-19 llvm-19 lld-19
+            echo "/usr/lib/llvm-19/bin" >> $GITHUB_PATH
+          fi
+
+      - name: Cache Cargo registry
+        uses: actions/cache@v5
         with:
-          workspaces: "."
+          path: |
-          prefix-key: "cache-v1.0"
+            .cargo/registry/cache
-          key: ${{ matrix.target }}_${{ matrix.os }}
+            .cargo/registry/index
-          cache-on-failure: true
+            .cargo/git/db
-          shared-key: "shared"
+            .cargo/bin
-          cache-all-crates: true
+            .cargo/.crates.toml
+            .cargo/.crates2.json
+          key: cargo-${{ runner.os }}-${{ env.RUST_TOOLCHAIN }}-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-${{ env.RUST_TOOLCHAIN }}-${{ matrix.target }}-
+
+      - name: Install Zig
+        if: runner.os == 'Linux' && !contains(matrix.target, 'windows')
+        uses: BloopAI/setup-zig@main
+        with:
+          version: 0.15.2
+
+      - name: Install cargo zigbuild
+        if: runner.os == 'Linux' && !contains(matrix.target, 'windows')
+        run: cargo install --locked cargo-zigbuild --version 0.20.1
+
+      - name: Install cargo xwin
+        if: runner.os == 'Linux' && contains(matrix.target, 'windows')
+        run: cargo install --locked cargo-xwin --version ${{ env.CARGO_XWIN_VERSION }}
+
+      - name: Cache xwin downloads
+        if: runner.os == 'Linux' && contains(matrix.target, 'windows')
+        uses: actions/cache@v5
+        with:
+          path: ${{ github.workspace }}/.xwin-cache
+          key: xwin-${{ runner.os }}-${{ matrix.target }}-cargo-xwin-${{ env.CARGO_XWIN_VERSION }}
+
+      - name: Cache target
+        uses: actions/cache@v5
+        with:
+          path: target
+          key: target-${{ runner.os }}-${{ env.RUST_TOOLCHAIN }}-${{ matrix.target }}-${{ github.ref_name }}-${{ github.sha }}
+          restore-keys: |
+            target-${{ runner.os }}-${{ env.RUST_TOOLCHAIN }}-${{ matrix.target }}-${{ github.ref_name }}-
+            target-${{ runner.os }}-${{ env.RUST_TOOLCHAIN }}-${{ matrix.target }}-
+
+      - name: Setup cargo-sweep
+        shell: bash
+        run: |
+          cargo install --locked cargo-sweep --version 0.8.0
 
       - name: Download frontend artifact
         uses: actions/download-artifact@v4
@@ -230,27 +288,40 @@ jobs:
           path: frontend/dist/
 
       - name: Build backend (Linux)
-        if: runner.os == 'Linux'
+        if: runner.os == 'Linux' && !contains(matrix.target, 'windows')
         run: |
-          cargo zigbuild --release --target ${{ matrix.target }} -p server
+          cargo zigbuild --release --target ${{ matrix.target }} -p server -p review --bin server --bin mcp_task_server --bin review
-          cargo zigbuild --release --target ${{ matrix.target }} --bin mcp_task_server
-          cargo zigbuild --release --target ${{ matrix.target }} -p review
         env:
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
           POSTHOG_API_ENDPOINT: ${{ secrets.POSTHOG_API_ENDPOINT }}
           VK_SHARED_API_BASE: ${{ secrets.VK_SHARED_API_BASE }}
 
-      - name: Build backend (non-Linux)
+      - name: Build backend (macOS)
-        if: runner.os != 'Linux'
+        if: runner.os == 'macOS'
         run: |
-          cargo build --release --target ${{ matrix.target }} -p server
+          if [[ "${{ matrix.target }}" == "x86_64-apple-darwin" ]]; then
-          cargo build --release --target ${{ matrix.target }} --bin mcp_task_server
+            export MACOSX_DEPLOYMENT_TARGET=10.12
-          cargo build --release --target ${{ matrix.target }} -p review
+          elif [[ "${{ matrix.target }}" == "aarch64-apple-darwin" ]]; then
+            export MACOSX_DEPLOYMENT_TARGET=11.0
+          fi
+          cargo build --release --target ${{ matrix.target }} -p server -p review --bin server --bin mcp_task_server --bin review
         env:
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
           POSTHOG_API_ENDPOINT: ${{ secrets.POSTHOG_API_ENDPOINT }}
           VK_SHARED_API_BASE: ${{ secrets.VK_SHARED_API_BASE }}
 
+      - name: Build backend (Windows)
+        if: runner.os == 'Linux' && contains(matrix.target, 'windows')
+        run: |
+          cargo xwin build --release --target ${{ matrix.target }} -p server -p review --bin server --bin mcp_task_server --bin review
+        env:
+          POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
+          POSTHOG_API_ENDPOINT: ${{ secrets.POSTHOG_API_ENDPOINT }}
+          VK_SHARED_API_BASE: ${{ secrets.VK_SHARED_API_BASE }}
+          # Avoid aws-lc-sys CMake failures when Rust's `release` profile includes debug info.
+          # Without this, cmake-rs selects RelWithDebInfo and CMake fails when ASM is enabled.
+          CARGO_PROFILE_RELEASE_DEBUG: 0
+
       - name: Setup Sentry CLI
         uses: matbour/setup-sentry-cli@v2
         with:
@@ -267,7 +338,7 @@ jobs:
         shell: bash
         run: |
           mkdir -p dist
-          if [[ "${{ matrix.os }}" == "windows-latest-l" ]]; then
+          if [[ "${{ matrix.name }}" == *"windows"* ]]; then
             cp target/${{ matrix.target }}/release/server.exe dist/vibe-kanban-${{ matrix.name }}.exe
             cp target/${{ matrix.target }}/release/mcp_task_server.exe dist/vibe-kanban-mcp-${{ matrix.name }}.exe
             cp target/${{ matrix.target }}/release/review.exe dist/vibe-kanban-review-${{ matrix.name }}.exe
@@ -291,7 +362,7 @@ jobs:
 
       - name: Sign main binary (macOS)
         if: runner.os == 'macOS'
-        uses: indygreg/apple-code-sign-action@v1
+        uses: BloopAI/apple-code-sign-action@v1
         with:
           input_path: target/${{ matrix.target }}/release/server
           output_path: vibe-kanban
@@ -304,19 +375,9 @@ jobs:
         if: runner.os == 'macOS'
         run: zip vibe-kanban.zip vibe-kanban
 
-      - name: Notarize signed binary (macOS)
-        if: runner.os == 'macOS'
-        uses: indygreg/apple-code-sign-action@v1
-        continue-on-error: true
-        with:
-          input_path: vibe-kanban.zip
-          sign: false
-          notarize: true
-          app_store_connect_api_key_json_file: app_store_key.json
-
       - name: Sign MCP binary (macOS)
         if: runner.os == 'macOS'
-        uses: indygreg/apple-code-sign-action@v1
+        uses: BloopAI/apple-code-sign-action@v1
         with:
           input_path: target/${{ matrix.target }}/release/mcp_task_server
           output_path: vibe-kanban-mcp
@@ -329,19 +390,9 @@ jobs:
         if: runner.os == 'macOS'
         run: zip vibe-kanban-mcp.zip vibe-kanban-mcp
 
-      - name: Notarize signed MCP binary (macOS)
-        if: runner.os == 'macOS'
-        uses: indygreg/apple-code-sign-action@v1
-        continue-on-error: true
-        with:
-          input_path: vibe-kanban-mcp.zip
-          sign: false
-          notarize: true
-          app_store_connect_api_key_json_file: app_store_key.json
-
       - name: Sign Review binary (macOS)
         if: runner.os == 'macOS'
-        uses: indygreg/apple-code-sign-action@v1
+        uses: BloopAI/apple-code-sign-action@v1
         with:
           input_path: target/${{ matrix.target }}/release/review
           output_path: vibe-kanban-review
@@ -354,12 +405,15 @@ jobs:
         if: runner.os == 'macOS'
         run: zip vibe-kanban-review.zip vibe-kanban-review
 
-      - name: Notarize signed Review binary (macOS)
+      - name: Notarize signed binaries (macOS)
         if: runner.os == 'macOS'
-        uses: indygreg/apple-code-sign-action@v1
+        uses: BloopAI/apple-code-sign-action@main
         continue-on-error: true
         with:
-          input_path: vibe-kanban-review.zip
+          input_path: |
+            vibe-kanban.zip
+            vibe-kanban-mcp.zip
+            vibe-kanban-review.zip
           sign: false
           notarize: true
           app_store_connect_api_key_json_file: app_store_key.json
@@ -385,6 +439,13 @@ jobs:
           path: dist/
           retention-days: 1
 
+      - name: Sweep Cargo target cache
+        shell: bash
+        run: |
+          cargo sweep --maxsize 10GB
+          cargo sweep --time 30
+
+
   package-npx-cli:
     needs: [bump-version, build-frontend, build-backend]
     runs-on: ubuntu-latest-m

Cargo.toml

@@ -19,7 +19,9 @@ tower-http = { version = "0.5", features = ["cors", "request-id", "trace", "fs"]
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["preserve_order"] }
 anyhow = "1.0"
-openssl-sys = { version = "0.9", features = ["vendored"] }
+git2 = { version = "0.20.3", default-features = false }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots-no-provider"] }
+rustls = { version = "0.23", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
 thiserror = "2.0.12"
 tracing = "0.1.43"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }
@@ -28,6 +30,6 @@ schemars = { version = "1.0.4", features = ["derive", "chrono04", "uuid1", "pres
 async-trait = "0.1"
 
 [profile.release]
-debug = true
+debug = 1
 split-debuginfo = "packed"
 strip = true

crates/db/Cargo.toml

@@ -11,7 +11,7 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }
-sqlx = { version = "0.8.6", features = ["runtime-tokio-rustls", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
+sqlx = { version = "0.8.6", features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1.0", features = ["v4", "serde"] }
 ts-rs = { workspace = true }

crates/deployment/Cargo.toml

@@ -15,7 +15,7 @@ tokio = { workspace = true }
 sqlx = "0.8.6"
 serde_json = { workspace = true }
 tracing = { workspace = true }
-git2 = "0.19"
+git2 = { workspace = true }
 futures = "0.3.31"
 axum = { workspace = true }
 

crates/local-deployment/Cargo.toml

@@ -14,15 +14,14 @@ bytes = "1.0"
 serde_json = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }
-sqlx = { version = "0.8.6", features = ["runtime-tokio-rustls", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
+sqlx = { version = "0.8.6", features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
 uuid = { version = "1.0", features = ["v4", "serde"] }
 async-trait = { workspace = true }
 thiserror = { workspace = true }
 command-group = { version = "5.0", features = ["with-tokio"] }
 nix = { version = "0.29", features = ["signal", "process"] }
-openssl-sys = { workspace = true }
+reqwest = { workspace = true }
-reqwest = { version = "0.12", features = ["json"] }
+sentry = { version = "0.41.0", default-features = false, features = ["anyhow", "backtrace", "panic", "debug-images", "reqwest"] }
-sentry = { version = "0.41.0", features = ["anyhow", "backtrace", "panic", "debug-images"] }
 futures = "0.3"
 json-patch = "2.0"
 tokio = { workspace = true }

crates/remote/Cargo.toml

@@ -12,13 +12,14 @@ aes-gcm = "0.10"
 chrono = { version = "0.4", features = ["serde"] }
 futures = "0.3"
 async-trait = "0.1"
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots-no-provider", "stream"] }
+rustls = { workspace = true }
 secrecy = "0.10.3"
-sentry = { version = "0.41.0", features = ["anyhow", "backtrace", "panic", "debug-images"] }
+sentry = { version = "0.41.0", default-features = false, features = ["anyhow", "backtrace", "panic", "debug-images", "reqwest"] }
-sentry-tracing = { version = "0.41.0", features = ["backtrace"] }
+sentry-tracing = { version = "0.41.0", default-features = false, features = ["backtrace"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
-sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio-rustls", "postgres", "uuid", "chrono", "json", "macros", "migrate", "ipnetwork"] }
+sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "postgres", "uuid", "chrono", "json", "macros", "migrate", "ipnetwork"] }
 ipnetwork = "0.20"
 tokio = { workspace = true }
 tokio-stream = { version = "0.1.17", features = ["sync"] }
@@ -30,7 +31,7 @@ thiserror = { workspace = true }
 ts-rs = { workspace = true }
 utils = { path = "../utils" }
 uuid = { version = "1", features = ["serde", "v4"] }
-jsonwebtoken = "9"
+jsonwebtoken = { version = "10.2.0", features = ["rust_crypto"] }
 rand = "0.9"
 sha2 = "0.10"
 hmac = "0.12"
@@ -39,8 +40,7 @@ hex = "0.4"
 urlencoding = "2.1"
 url = "2.5"
 base64 = "0.22"
-aws-config = { version = "1.5", default-features = false, features = ["behavior-version-latest", "rustls"] }
+aws-sdk-s3 = { version = "1.65", default-features = false, features = ["behavior-version-latest"] }
-aws-sdk-s3 = { version = "1.65", default-features = false, features = ["behavior-version-latest", "rustls"] }
 aws-credential-types = "1.2"
 tempfile = "3"
 tar = "0.4"

crates/review/Cargo.toml

@@ -11,7 +11,8 @@ path = "src/main.rs"
 [dependencies]
 clap = { version = "4", features = ["derive", "env"] }
 tokio = { workspace = true }
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots-no-provider", "stream"] }
+rustls = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tar = "0.4"

crates/review/src/main.rs

@@ -100,6 +100,11 @@ fn create_spinner(message: &str) -> ProgressBar {
 
 #[tokio::main]
 async fn main() -> Result<()> {
+    // Install rustls crypto provider before any TLS operations
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .expect("Failed to install rustls crypto provider");
+
     let args = Args::parse();
 
     // Initialize tracing

crates/server/Cargo.toml

@@ -24,23 +24,23 @@ serde_json = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
-sqlx = { version = "0.8.6", features = ["runtime-tokio-rustls", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
+sqlx = { version = "0.8.6", features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1.0", features = ["v4", "serde"] }
 ts-rs = { workspace = true }
 nix = { version = "0.29", features = ["signal", "process"] }
-openssl-sys = { workspace = true }
 rmcp = { version = "0.5.0", features = ["server", "transport-io"] }
 schemars = { workspace = true }
 secrecy = "0.10.3"
-sentry = { version = "0.41.0", features = ["anyhow", "backtrace", "panic", "debug-images"] }
+sentry = { version = "0.41.0", default-features = false, features = ["anyhow", "backtrace", "panic", "debug-images", "reqwest"] }
-reqwest = { version = "0.12", features = ["json"] }
+reqwest = { workspace = true }
+rustls = { workspace = true }
 strip-ansi-escapes = "0.2.1"
 thiserror = { workspace = true }
 os_info = "3.12.0"
 futures-util = "0.3"
 ignore = "0.4"
-git2 = "0.19"
+git2 = { workspace = true }
 mime_guess = "2.0"
 rust-embed = "8.2"
 url = "2.5"

crates/server/src/bin/mcp_task_server.rs

@@ -7,6 +7,11 @@ use utils::{
 };
 
 fn main() -> anyhow::Result<()> {
+    // Install rustls crypto provider before any TLS operations
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .expect("Failed to install rustls crypto provider");
+
     sentry_utils::init_once(SentrySource::Mcp);
     tokio::runtime::Builder::new_multi_thread()
         .enable_all()

crates/server/src/main.rs

@@ -27,6 +27,11 @@ pub enum VibeKanbanError {
 
 #[tokio::main]
 async fn main() -> Result<(), VibeKanbanError> {
+    // Install rustls crypto provider before any TLS operations
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .expect("Failed to install rustls crypto provider");
+
     sentry_utils::init_once(SentrySource::Backend);
 
     let log_level = std::env::var("RUST_LOG").unwrap_or_else(|_| "info".to_string());

crates/services/Cargo.toml

@@ -20,21 +20,20 @@ serde_json = { workspace = true }
 url = "2.5"
 anyhow = { workspace = true }
 tracing = { workspace = true }
-sqlx = { version = "0.8.6", features = ["runtime-tokio-rustls", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
+sqlx = { version = "0.8.6", features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "sqlite", "sqlite-preupdate-hook", "chrono", "uuid"] }
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1.0", features = ["v4", "serde"] }
 ts-rs = { workspace = true }
 dirs = "5.0"
-git2 = "0.19"
+git2 = { workspace = true }
 tempfile = "3.21"
-async-trait = { workspace = true } 
+async-trait = { workspace = true }
 rust-embed = "8.2"
 ignore = "0.4"
-openssl-sys = { workspace = true }
 regex = "1.11.1"
 notify-rust = "4.11"
 os_info = "3.12.0"
-reqwest = { version = "0.12", features = ["json"] }
+reqwest = { workspace = true }
 futures-util = "0.3"
 json-patch = "2.0"
 backon = "1.5.1"

crates/utils/Cargo.toml

@@ -19,8 +19,8 @@ rust-embed = "8.2"
 directories = "6.0.0"
 open = "5.3.2"
 regex = "1.11.1"
-sentry = { version = "0.41.0", features = ["anyhow", "backtrace", "panic", "debug-images"] }
+sentry = { version = "0.41.0", default-features = false, features = ["anyhow", "backtrace", "panic", "debug-images", "reqwest"] }
-sentry-tracing = { version = "0.41.0", features = ["backtrace"] }
+sentry-tracing = { version = "0.41.0", default-features = false, features = ["backtrace"] }
 futures-util = "0.3"
 json-patch = "2.0"
 jsonwebtoken = { version = "10.2.0", features = ["rust_crypto"] }
@@ -30,11 +30,11 @@ tokio-stream = { version = "0.1.17", features = ["sync"] }
 shellexpand = "3.1.1"
 which = "8.0.0"
 similar = "2"
-git2 = "0.19"
+git2 = { workspace = true }
 dirs = "5.0"
 thiserror = { workspace = true }
 url = "2.5"
-reqwest = { version = "0.12", features = ["json"] }
+reqwest = { workspace = true }
 sqlx = { version = "0.8.6", default-features = false, features = ["postgres", "uuid", "chrono"] }
 
 [target.'cfg(windows)'.dependencies]