Consider pinning project dependencies

[tvpeter]

Description

Due to the Cargo caret requirement, dependencies are always updated to their semver-compatible versions. This at times leads to breaking the build or introducing Clippy errors that are difficult to detect or time-consuming to fix.

To prevent this scenario, we should consider either strict pinning of project dependencies or using the tilde requirement, which allows patch updates only.

Additional Context

See #252, #243

[va-an]

I'd prefer pinning to an exact version.

I ran into this issue firsthand while working on my feature branch - after regenerating Cargo.lock, cargo resolved bdk_wallet to 2.3.0 where SignOptions in the bdk_wallet::wallet::signer module was marked as deprecated (moved to bitcoin::psbt). This caused just pre-push and CI runs to fail due to the deprecated code being treated as an error.

While this specific deprecation has already been reverted, the revert hasn't been released yet, so CI will keep failing for anyone whose Cargo.lock resolves to the affected version.

Exact pinning (=2.1.0) avoids this class of issues where a semver-compatible minor bump introduces unexpected breakage.

[tvpeter]

Hello @va-an, while I had the same issue which led me to open this issue, the general consensus from the discussion we had was that it may not be beneficial to pin the dependencies (at least at this time). Therefore, I will be closing the issue for now. If you believe there are other factors we haven't considered or if we should re-evaluate it from a different perspective, please feel free to reopen the issue.
Thank you.