fix(deps): pin external git dependencies

[bhavyajain0810]

What

• Pins mohu-compute to commit 9243ba1fcd292adf789b87ed7884f68ab3b6d9fb.
• Pins mohu-linalg to commit 2f4d83969b27a2d0e21f5c90ab92c2b078bb0844.
• Uses full 40-character commit SHAs to ensure deterministic and auditable Git dependency resolution.
• Keeps the change limited to the affected declarations in Cargo.toml.

Why

The two external workspace dependencies previously referenced only their Git repository URLs. This allowed Cargo to resolve newer commits whenever the repositories’ default branches advanced, reducing build reproducibility across development, CI, and future environments.

Pinning both dependencies with explicit rev values ensures that every environment resolves the same reviewed upstream commits.

Cargo.lock remains unchanged because these dependencies are declared in [workspace.dependencies] but are not currently inherited by any crate in the resolved workspace dependency graph.

Closes #272

How

• Retrieved the current full commit SHA from the main branch of each external repository.
• Added the corresponding rev field to both Git dependency declarations.
• Independently fetched both pinned commits to confirm that they exist and are accessible.
• Rebased the branch onto the latest upstream/main.
• Verified the change using Cargo metadata, formatting, Clippy, workspace tests, doctests, documentation generation, benchmark compilation, and unused-dependency analysis.

cargo deny check currently fails identically on an untouched upstream/main worktree because of the following pre-existing advisories:

• RUSTSEC-2026-0204 for crossbeam-epoch 0.9.18
• RUSTSEC-2026-0186 for memmap2 0.9.10

This PR does not modify Cargo.lock or either affected dependency.

Checklist

• cargo test --workspace passes
• cargo clippy --workspace -- -D warnings passes
• cargo fmt --all applied
• CHANGELOG.md updated (not required; this is not a user-facing change)
• Benchmarks added or updated (not applicable; this does not modify a performance-sensitive path, and all existing benchmarks compile successfully)

Summary by CodeRabbit

• Bug Fixes
  • Improved build consistency and reliability by locking external components to known versions.
  • Reduced the risk of unexpected changes from upstream updates.

[github-actions]

PR Check Summary

Item	Value
Branch	fix/pin-git-dependencies-272
Changed crates	none
Files changed	1

CI will run: build, test, clippy, fmt, cargo-deny, DCO, semver.
Reviewer assigned from CODEOWNERS.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c09001c-52e4-496e-911a-e0219b30b9d9

📥 Commits

Reviewing files that changed from the base of the PR and between 3c07775 and 838b18e.

📒 Files selected for processing (1)

• Cargo.toml

---

📝 Walkthrough

Walkthrough

The workspace pins the mohu-compute and mohu-linalg Git dependencies to explicit commit revisions in Cargo.toml.

Changes

Dependency pinning

Layer / File(s)	Summary
Pin Git dependency revisions Cargo.toml	Adds explicit rev constraints to the mohu-compute and mohu-linalg Git dependency declarations.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: bbn08, mugiwaraluffy56

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: pinning external Git dependencies.
Linked Issues check	✅ Passed	The PR pins mohu-compute and mohu-linalg to fixed commits, satisfying the reproducible-build requirement in #272.
Out of Scope Changes check	✅ Passed	The change is narrowly scoped to Cargo.toml dependency pinning with no unrelated edits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[bhavyajain0810]

Hi @Bbn08 ,

The failing Cargo Deny check is caused by pre-existing advisories in the repository’s current Cargo.lock:

• RUSTSEC-2026-0204 — crossbeam-epoch 0.9.18
• RUSTSEC-2026-0186 — memmap2 0.9.10

I reproduced cargo deny check against a clean detached worktree at the current upstream/main commit (3c07775), where it fails with the same advisories and exit code 1.

This PR changes only the two Git dependency declarations in Cargo.toml; it does not modify Cargo.lock, crossbeam-epoch, or memmap2.

All checks relevant to this change pass, including formatting, Clippy, documentation, benchmarks, MSRV, semver, unused dependencies, DCO, and the complete workspace test suite locally.

I have intentionally not included unrelated security dependency updates in this PR so that it remains focused on issue #272.