Bump versions/packages for compatibility with GHC 9.8.

cabal.project.common

@@ -14,6 +14,16 @@ allow-newer:
   -- was in 2018, so we may have to fork when breakage occurs
   , codec-rpm:attoparsec
 
+  -- transformers has a few breaking changes from 0.5 -> 0.6.
+  -- But the removed symbols were already deprecated in 0.5.
+  -- fused-effects-exceptions has a PR out: https://github.com/fused-effects/fused-effects-exceptions/pull/22
+  -- When that merges you should be able to remove it from here.
+  -- lzma-conduit seems kind of moribund.
+  -- I've left an issue checking for signs of life: https://github.com/alphaHeavy/lzma-conduit/issues/27
+  -- I'll make a PR if someone responds. The lib is small enough we could just vendor it if not.
+  , lzma-conduit:transformers
+  , fused-effects-exceptions:transformers
+
 -- the semver package only exposes lens-style accessors for its Version type;
 -- normal accessors are in an un-exposed Internal module. on master, the
 -- Internal module is exposed, but a new release hasn't been cut to hackage yet
@@ -55,6 +65,6 @@ source-repository-package
 source-repository-package
   type: git
   location: https://github.com/fossas/codec-rpm
-  tag: 0f7431423d47fdf36945e4ff31fbee76005b7e68
+  tag: 55e6cc0c0b7906ca257cb7c6268b2d99592bb30f
 
 index-state: hackage.haskell.org 2024-08-14T18:49:08Z

spectrometer.cabal

@@ -104,7 +104,7 @@ common deps
     , crypton                      ^>=1.0.0
     , crypton-connection           ^>=0.4.1
     , data-default-class           ^>=0.1.2.0
-    , deepseq                      ^>=1.4.8
+    , deepseq                      ^>= {1.4, 1.5}
     , direct-sqlite                ^>=2.3.27
     , directory                    ^>=1.3.6.1
     , either                       ^>=5.0.2
@@ -124,9 +124,9 @@ common deps
     , http-types                   ^>=0.12.3
     , lzma                         ^>=0.0.1.0
     , lzma-conduit                 ^>=1.2.1
-    , megaparsec                   ^>=9.4.0
+    , megaparsec                   ^>={9.4, 9.6}
     , modern-uri                   ^>=0.3.6
-    , mtl                          ^>=2.2.2
+    , mtl                          ^>={2.2, 2.3}
     , network                      ^>=3.1.2.0
     , network-uri                  ^>=2.6.4.0
     , optparse-applicative         ^>=0.18.0.0

src/App/Fossa/Reachability/Gradle.hs

@@ -10,7 +10,7 @@ import Control.Carrier.Reader (Reader, runReader)
 import Control.Effect.Diagnostics (Diagnostics, ToDiagnostic, context, errCtx, errHelp, errSupport, renderDiagnostic)
 import Control.Effect.Lift (sendIO)
 import Control.Effect.Path (withSystemTempDir)
-import Control.Monad.List (filterM)
+import Control.Monad (filterM)
 import Data.ByteString qualified as BS
 import Data.ByteString.Lazy qualified as BL
 import Data.Error (createErrataWithHeaderOnly)

src/App/Fossa/Reachability/Maven.hs

@@ -7,8 +7,7 @@ import App.Fossa.Reachability.Jar (callGraphFromJars, isValidJar)
 import App.Fossa.Reachability.Types (CallGraphAnalysis (..))
 import Control.Carrier.Lift (Lift)
 import Control.Effect.Diagnostics (Diagnostics, context, fromEither, recover)
-import Control.Monad (join)
-import Control.Monad.List (filterM)
+import Control.Monad (filterM, join)
 import Data.Map qualified as Map
 import Data.Maybe (catMaybes, fromMaybe)
 import Data.String.Conversion (ToText (toText))

src/Strategy/Cargo.hs

@@ -494,7 +494,7 @@ parsePkgSpec = eatSpaces (try longSpec <|> simplePkgSpec')
 --
 -- Package Spec: https://doc.rust-lang.org/cargo/reference/pkgid-spec.html
 parsePkgId :: MonadFail m => Text.Text -> m PackageId
-parsePkgId t = either fail pure $ oldPkgIdParser' t <|> parseNewSpec
+parsePkgId t = either fail pure $ oldPkgIdParser' t <> parseNewSpec
   where
     oldPkgIdParser' = first toString . oldPkgIdParser
 

test/App/Fossa/Report/AttributionSpec.hs

@@ -3,7 +3,7 @@ module App.Fossa.Report.AttributionSpec (
 ) where
 
 import App.Fossa.Report.Attribution
-import Control.Applicative (liftA2)
+import Control.Applicative ()
 import Data.Aeson
 import Data.Map.Strict (Map)
 import Data.Text (Text)

test/Test/Fixtures.hs

@@ -70,13 +70,13 @@ import App.Fossa.VendoredDependency (VendoredDependency (..))
 import App.Types (OverrideDynamicAnalysisBinary (..))
 import App.Types qualified as App
 import Control.Effect.FossaApiClient qualified as App
-import Control.Monad.RWS qualified as Set
 import Control.Timeout (Duration (MilliSeconds))
 import Data.ByteString.Lazy qualified as LB
 import Data.Flag (toFlag)
 import Data.List.NonEmpty (NonEmpty)
 import Data.List.NonEmpty qualified as NE
 import Data.Map.Strict qualified as Map
+import Data.Set qualified as Set
 import Data.Text (Text)
 import Data.Text.Encoding qualified as TL
 import Data.Text.Extra (showT)
@@ -511,7 +511,7 @@ vsiOptions :: VSI.VSIModeOptions
 vsiOptions =
   VSI.VSIModeOptions
     { vsiAnalysisEnabled = toFlag VSI.VSIAnalysis False
-    , vsiSkipSet = VSI.SkipResolution Set.mempty
+    , vsiSkipSet = VSI.SkipResolution Set.empty
     , iatAssertion = VSI.IATAssertion Nothing
     , dynamicLinkingTarget = VSI.DynamicLinkInspect Nothing
     , binaryDiscoveryEnabled = toFlag VSI.BinaryDiscovery False