From b34108fa240cfd728c262b4c523877a8b5a27b5e Mon Sep 17 00:00:00 2001 From: Luke Street Date: Fri, 10 Jul 2026 00:29:27 -0600 Subject: [PATCH] Bump a few more deps & fix advisories --- Cargo.lock | 219 +++++++++++++++----------- deny.toml | 10 +- objdiff-core/Cargo.toml | 4 +- objdiff-core/src/jobs/check_update.rs | 13 +- objdiff-core/src/jobs/update.rs | 11 +- objdiff-gui/src/update.rs | 20 +-- objdiff-gui/src/views/config.rs | 2 +- objdiff-wasm/Cargo.toml | 2 +- 8 files changed, 155 insertions(+), 126 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 1e3b163..ac8dea6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -505,6 +505,12 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" +[[package]] +name = "base64ct" +version = "1.8.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06" + [[package]] name = "bit-set" version = "0.5.3" @@ -834,19 +840,6 @@ dependencies = [ "crossbeam-utils", ] -[[package]] -name = "console" -version = "0.15.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8" -dependencies = [ - "encode_unicode", - "libc", - "once_cell", - "unicode-width", - "windows-sys 0.59.0", -] - [[package]] name = "console" version = "0.16.4" @@ -888,6 +881,35 @@ dependencies = [ "unicode-segmentation", ] +[[package]] +name = "cookie" +version = "0.18.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747" +dependencies = [ + "percent-encoding", + "time", + "version_check", +] + +[[package]] +name = "cookie_store" +version = "0.22.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "15b2c103cf610ec6cae3da84a766285b42fd16aad564758459e6ecf128c75206" +dependencies = [ + "cookie", + "document-features", + "idna", + "indexmap", + "log", + "serde", + "serde_derive", + "serde_json", + "time", + "url", +] + [[package]] name = "core-foundation" version = "0.9.4" @@ -1142,6 +1164,16 @@ version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4" +[[package]] +name = "der" +version = "0.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d" +dependencies = [ + "pem-rfc7468", + "zeroize", +] + [[package]] name = "deranged" version = "0.5.8" @@ -2505,7 +2537,6 @@ dependencies = [ "tokio", "tokio-rustls 0.26.4", "tower-service", - "webpki-roots 1.0.8", ] [[package]] @@ -2697,19 +2728,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "indicatif" -version = "0.17.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235" -dependencies = [ - "console 0.15.11", - "number_prefix", - "portable-atomic", - "unicode-width", - "web-time", -] - [[package]] name = "indoc" version = "2.0.7" @@ -2745,7 +2763,7 @@ version = "1.48.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82" dependencies = [ - "console 0.16.4", + "console", "once_cell", "similar 2.7.0", "tempfile", @@ -3473,12 +3491,6 @@ dependencies = [ "libc", ] -[[package]] -name = "number_prefix" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3" - [[package]] name = "objc" version = "0.2.7" @@ -4111,6 +4123,15 @@ dependencies = [ "prost-types", ] +[[package]] +name = "pem-rfc7468" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9" +dependencies = [ + "base64ct", +] + [[package]] name = "percent-encoding" version = "2.3.2" @@ -4472,15 +4493,6 @@ version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3" -[[package]] -name = "quick-xml" -version = "0.37.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb" -dependencies = [ - "memchr", -] - [[package]] name = "quick-xml" version = "0.39.4" @@ -4926,9 +4938,9 @@ dependencies = [ [[package]] name = "reqwest" -version = "0.12.28" +version = "0.13.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147" +checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3" dependencies = [ "base64 0.22.1", "bytes", @@ -4945,49 +4957,8 @@ dependencies = [ "hyper-util", "js-sys", "log", - "native-tls", - "percent-encoding", - "pin-project-lite", - "quinn", - "rustls 0.23.41", - "rustls-pki-types", - "serde", - "serde_json", - "serde_urlencoded", - "sync_wrapper 1.0.2", - "tokio", - "tokio-native-tls", - "tokio-rustls 0.26.4", - "tower", - "tower-http", - "tower-service", - "url", - "wasm-bindgen", - "wasm-bindgen-futures", - "web-sys", - "webpki-roots 1.0.8", -] - -[[package]] -name = "reqwest" -version = "0.13.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3" -dependencies = [ - "base64 0.22.1", - "bytes", - "futures-channel", - "futures-core", - "futures-util", - "http 1.4.2", - "http-body 1.0.1", - "http-body-util", - "hyper 1.10.1", - "hyper-rustls 0.27.9", - "hyper-util", - "js-sys", - "log", "mime_guess", + "native-tls", "percent-encoding", "pin-project-lite", "quinn", @@ -4998,6 +4969,7 @@ dependencies = [ "serde_json", "sync_wrapper 1.0.2", "tokio", + "tokio-native-tls", "tokio-rustls 0.26.4", "tower", "tower-http", @@ -5148,6 +5120,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f" dependencies = [ "aws-lc-rs", + "log", "once_cell", "ring", "rustls-pki-types", @@ -5337,20 +5310,20 @@ dependencies = [ [[package]] name = "self_update" -version = "0.42.0" +version = "1.0.0-rc.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d832c086ece0dacc29fb2947bb4219b8f6e12fe9e40b7108f9e57c4224e47b5c" +checksum = "0e408432f7c77ea6481c44379268b8beada0139c88c5024dc6d97b756cc96e65" dependencies = [ - "hyper 1.10.1", - "indicatif", + "http 1.4.2", "log", - "quick-xml 0.37.5", "regex", - "reqwest 0.12.28", + "reqwest 0.13.4", "self-replace", "semver", + "serde", "serde_json", "tempfile", + "ureq", "urlencoding", ] @@ -5664,6 +5637,17 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "socks" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0c3dbbd9ae980613c6dd8e28a9407b50509d3803b57624d5dfe8315218cd58b" +dependencies = [ + "byteorder", + "libc", + "winapi", +] + [[package]] name = "spin" version = "0.9.8" @@ -6454,6 +6438,43 @@ version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" +[[package]] +name = "ureq" +version = "3.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0" +dependencies = [ + "base64 0.22.1", + "cookie_store", + "der", + "encoding_rs", + "flate2", + "log", + "native-tls", + "percent-encoding", + "rustls 0.23.41", + "rustls-pki-types", + "serde", + "serde_json", + "socks", + "ureq-proto", + "utf8-zero", + "webpki-root-certs", + "webpki-roots 1.0.8", +] + +[[package]] +name = "ureq-proto" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c" +dependencies = [ + "base64 0.22.1", + "http 1.4.2", + "httparse", + "log", +] + [[package]] name = "url" version = "2.5.8" @@ -6473,6 +6494,12 @@ version = "2.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" +[[package]] +name = "utf8-zero" +version = "0.8.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e" + [[package]] name = "utf8_iter" version = "1.0.4" @@ -6806,7 +6833,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9c324a910fd86ebdc364a3e61ec1f11737d3b1d6c273c0239ee8ff4bc0d24b4a" dependencies = [ "proc-macro2", - "quick-xml 0.39.4", + "quick-xml", "quote", ] @@ -7619,9 +7646,9 @@ dependencies = [ [[package]] name = "wit-deps" -version = "0.5.0" +version = "0.6.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8148a419968e66a49be6cf233438b5675f05d43b36aef3f089948bac0c4ca32" +checksum = "bfd59c477054f61e2ec6e26c85e3273848abcac010b55963267b5c0b5c5f3a8b" dependencies = [ "anyhow", "async-compression", diff --git a/deny.toml b/deny.toml index a3e360d..66bac3f 100644 --- a/deny.toml +++ b/deny.toml @@ -75,9 +75,13 @@ ignore = [ #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" }, { id = "RUSTSEC-2024-0436", reason = "Unmaintained paste crate is an indirect dependency" }, { id = "RUSTSEC-2025-0052", reason = "Unmaintained async-std crate is an indirect dependency" }, - { id = "RUSTSEC-2025-0119", reason = "Unmaintained number_prefix crate is an indirect dependency" }, { id = "RUSTSEC-2025-0134", reason = "Unmaintained rustls-pemfile crate is an indirect dependency" }, - { id = "RUSTSEC-2026-0002", reason = "Unsound advisory in lru indirect dependency" }, + { id = "RUSTSEC-2026-0098", reason = "Build-time objdiff-wasm wit-deps dependency still uses reqwest 0.11; latest wit-deps has no safe upgrade path" }, + { id = "RUSTSEC-2026-0099", reason = "Build-time objdiff-wasm wit-deps dependency still uses reqwest 0.11; latest wit-deps has no safe upgrade path" }, + { id = "RUSTSEC-2026-0104", reason = "Build-time objdiff-wasm wit-deps dependency still uses reqwest 0.11; latest wit-deps has no safe upgrade path" }, + { id = "RUSTSEC-2026-0192", reason = "Unmaintained ttf-parser is an egui 0.33 indirect dependency; egui 0.35 requires raising MSRV from 1.88 to 1.92" }, + { id = "RUSTSEC-2026-0194", reason = "Build-time wayland-scanner dependency parses vendored protocol XML; no newer stable wayland-scanner release is available" }, + { id = "RUSTSEC-2026-0195", reason = "Build-time wayland-scanner dependency parses vendored protocol XML; no newer stable wayland-scanner release is available" }, ] # If this is true, then cargo deny will use the git executable to fetch advisory database. # If this is false, then it uses a built-in git library. @@ -245,8 +249,6 @@ allow-git = [] [sources.allow-org] # github.com organizations to allow git sources for github = [ - "encounter", - "gimli-rs", # gimli ] # gitlab.com organizations to allow git sources for gitlab = [] diff --git a/objdiff-core/Cargo.toml b/objdiff-core/Cargo.toml index 55bbb84..a0f4602 100644 --- a/objdiff-core/Cargo.toml +++ b/objdiff-core/Cargo.toml @@ -188,12 +188,12 @@ winapi = { version = "0.3", optional = true, features = ["winbase"] } # For Linux static binaries, use rustls [target.'cfg(target_os = "linux")'.dependencies] reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "multipart", "rustls"], optional = true } -self_update = { version = "0.42", default-features = false, features = ["rustls"], optional = true } +self_update = { version = "1.0.0-rc.3", default-features = false, features = ["reqwest", "rustls", "github"], optional = true } # For all other platforms, use native TLS [target.'cfg(not(target_os = "linux"))'.dependencies] reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "multipart", "default-tls"], optional = true } -self_update = { version = "0.42", optional = true } +self_update = { version = "1.0.0-rc.3", default-features = false, features = ["reqwest", "native-tls", "github"], optional = true } [build-dependencies] heck = { version = "0.5", optional = true } diff --git a/objdiff-core/src/jobs/check_update.rs b/objdiff-core/src/jobs/check_update.rs index 940e5fe..4012139 100644 --- a/objdiff-core/src/jobs/check_update.rs +++ b/objdiff-core/src/jobs/check_update.rs @@ -1,10 +1,7 @@ use std::{sync::mpsc::Receiver, task::Waker}; use anyhow::{Context, Result}; -use self_update::{ - cargo_crate_version, - update::{Release, ReleaseUpdate}, -}; +use self_update::update::{Release, ReleaseUpdate}; use crate::jobs::{Job, JobContext, JobResult, JobState, start_job, update_status}; @@ -26,13 +23,13 @@ fn run_check_update( ) -> Result> { update_status(context, "Fetching latest release".to_string(), 0, 1, &cancel)?; let updater = (config.build_updater)().context("Failed to create release updater")?; - let latest_release = updater.get_latest_release()?; - let update_available = - self_update::version::bump_is_greater(cargo_crate_version!(), &latest_release.version)?; + let releases = updater.get_latest_release()?; + let update_available = releases.is_update_available()?; + let latest_release = releases.latest().context("No release found")?.clone(); // Find the binary name in the release assets let mut found_binary = None; for bin_name in &config.bin_names { - if latest_release.assets.iter().any(|a| &a.name == bin_name) { + if latest_release.assets().iter().any(|a| a.name() == bin_name) { found_binary = Some(bin_name.clone()); break; } diff --git a/objdiff-core/src/jobs/update.rs b/objdiff-core/src/jobs/update.rs index b31ec02..529d7eb 100644 --- a/objdiff-core/src/jobs/update.rs +++ b/objdiff-core/src/jobs/update.rs @@ -28,18 +28,19 @@ fn run_update( ) -> Result> { update_status(status, "Fetching latest release".to_string(), 0, 3, &cancel)?; let updater = (config.build_updater)().context("Failed to create release updater")?; - let latest_release = updater.get_latest_release()?; + let releases = updater.get_latest_release()?; + let latest_release = releases.latest().context("No release found")?; let asset = - latest_release.assets.iter().find(|a| a.name == config.bin_name).ok_or_else(|| { + latest_release.assets().iter().find(|a| a.name() == config.bin_name).ok_or_else(|| { anyhow::Error::msg(format!("No release asset for {}", config.bin_name)) })?; update_status(status, "Downloading release".to_string(), 1, 3, &cancel)?; let tmp_dir = tempfile::Builder::new().prefix("update").tempdir_in(current_dir()?)?; - let tmp_path = tmp_dir.path().join(&asset.name); + let tmp_path = tmp_dir.path().join(asset.name()); let tmp_file = File::create(&tmp_path)?; - self_update::Download::from_url(&asset.download_url) - .set_header(reqwest::header::ACCEPT, "application/octet-stream".parse()?) + self_update::Download::from_url(asset.download_url()) + .request_header(self_update::http::header::ACCEPT, "application/octet-stream") .download_to(tmp_file)?; update_status(status, "Extracting release".to_string(), 2, 3, &cancel)?; diff --git a/objdiff-gui/src/update.rs b/objdiff-gui/src/update.rs index bc3a346..53defc2 100644 --- a/objdiff-gui/src/update.rs +++ b/objdiff-gui/src/update.rs @@ -29,13 +29,15 @@ pub const RELEASE_URL: &str = formatcp!("https://github.com/{}/{}/releases/latest", GITHUB_USER, GITHUB_REPO); pub fn build_updater() -> Result> { - Ok(self_update::backends::github::Update::configure() - .repo_owner(GITHUB_USER) - .repo_name(GITHUB_REPO) - // bin_name is required, but unused? - .bin_name(BIN_NAME_NEW) - .no_confirm(true) - .show_output(false) - .current_version(cargo_crate_version!()) - .build()?) + Ok(Box::new( + self_update::backends::github::Update::configure() + .repo_owner(GITHUB_USER) + .repo_name(GITHUB_REPO) + // bin_name is required, but unused? + .bin_name(BIN_NAME_NEW) + .no_confirm(true) + .show_output(false) + .current_version(cargo_crate_version!()) + .build()?, + )) } diff --git a/objdiff-gui/src/views/config.rs b/objdiff-gui/src/views/config.rs index 6f76feb..32786ee 100644 --- a/objdiff-gui/src/views/config.rs +++ b/objdiff-gui/src/views/config.rs @@ -182,7 +182,7 @@ pub fn config_ui( } ui.label(format!("Current version: {}", env!("CARGO_PKG_VERSION"))); if let Some(result) = &config_state.check_update { - ui.label(format!("Latest version: {}", result.latest_release.version)); + ui.label(format!("Latest version: {}", result.latest_release.version())); if result.update_available { ui.colored_label(appearance.insert_color, "Update available"); ui.horizontal(|ui| { diff --git a/objdiff-wasm/Cargo.toml b/objdiff-wasm/Cargo.toml index dc0a5b4..3d3f619 100644 --- a/objdiff-wasm/Cargo.toml +++ b/objdiff-wasm/Cargo.toml @@ -35,4 +35,4 @@ features = ["arm", "arm64", "mips", "ppc", "superh", "x86", "dwarf"] talc = { version = "4.4", default-features = false, features = ["lock_api"] } [build-dependencies] -wit-deps = "0.5" +wit-deps = "0.6"