I left this just in case:

{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    rust-overlay.url = "github:oxalica/rust-overlay";
    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = {
    nixpkgs,
    rust-overlay,
    ...
  } @ inputs: let
    system = "x86_64-linux";

    pkgs = import nixpkgs {
      inherit system;
      overlays = [inputs.rust-overlay.overlays.default];
    };
    inherit (pkgs) lib;
    pkgsWin = import nixpkgs {
      inherit system;
      crossSystem.config = "x86_64-w64-mingw32";
      overlays = [(import rust-overlay)];
    };

    rust-toolchain-linux = pkgs.rust-bin.stable.latest.default.override {
      extensions = ["rust-src" "rust-analyzer" "clippy"];
    };
    rust-toolchain-windows = pkgsWin.pkgsBuildHost.rust-bin.stable.latest.default.override {
      extensions = ["rust-src" "rust-analyzer" "clippy"];
      targets = ["x86_64-pc-windows-gnu"];
    };

    rustBuildInputs =
      [
        pkgs.openssl
        pkgs.libiconv
        pkgs.pkg-config
      ]
      ++ lib.optionals pkgs.stdenv.isLinux [
        pkgs.glib
        pkgs.gtk3
        pkgs.libsoup_3
        pkgs.webkitgtk_4_1
        pkgs.xdotool
      ]
      ++ lib.optionals pkgs.stdenv.isDarwin (with pkgs.darwin.apple_sdk.frameworks; [
        IOKit
        Carbon
        WebKit
        Security
        Cocoa
      ]);
  in {
    devShells.${system} = {
      default = pkgs.mkShell {
        buildInputs = rustBuildInputs;
        nativeBuildInputs = [rust-toolchain-linux];
      };
      windows = pkgsWin.mkShell {
        # https://discourse.nixos.org/t/cross-compile-rust-for-windows/9582/10
        buildInputs = with pkgsWin; [openssl libiconv];
        # At least misses the Edge WebView2 Runtime (that can be bundled).
        nativeBuildInputs = [rust-toolchain-windows pkgs.wine64];
      };
    };
  };
}

i can think of two options:

1. bug the maintainer to make a new release that fixes the crates.io lockfile (crates.io allows git dependencies in dev-dependencies)
2. something else

i guess checking in cargo.lock isn't that uncommon:

$ fd 'Cargo\.lock' | wc -l
110

i guess checking in cargo.lock isn't that uncommon:

$ fd '^Cargo\.lock$' | wc -l
97