Bump a few more deps & fix advisories

Cargo.lock

@@ -505,6 +505,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bit-set"
 version = "0.5.3"
@@ -834,19 +840,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "console"
-version = "0.15.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
-dependencies = [
- "encode_unicode",
- "libc",
- "once_cell",
- "unicode-width",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "console"
 version = "0.16.4"
@@ -888,6 +881,35 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "cookie_store"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b2c103cf610ec6cae3da84a766285b42fd16aad564758459e6ecf128c75206"
+dependencies = [
+ "cookie",
+ "document-features",
+ "idna",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "url",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1142,6 +1164,16 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4"
 
+[[package]]
+name = "der"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d"
+dependencies = [
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -2505,7 +2537,6 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.4",
  "tower-service",
- "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -2697,19 +2728,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "indicatif"
-version = "0.17.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
-dependencies = [
- "console 0.15.11",
- "number_prefix",
- "portable-atomic",
- "unicode-width",
- "web-time",
-]
-
 [[package]]
 name = "indoc"
 version = "2.0.7"
@@ -2745,7 +2763,7 @@ version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "86f0f8fee8c926415c58d6ae43a08523a26faccb2323f5e6b644fe7dd4ef6b82"
 dependencies = [
- "console 0.16.4",
+ "console",
  "once_cell",
  "similar 2.7.0",
  "tempfile",
@@ -3473,12 +3491,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "number_prefix"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
-
 [[package]]
 name = "objc"
 version = "0.2.7"
@@ -4111,6 +4123,15 @@ dependencies = [
  "prost-types",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -4472,15 +4493,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
-[[package]]
-name = "quick-xml"
-version = "0.37.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "quick-xml"
 version = "0.39.4"
@@ -4926,9 +4938,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.28"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -4945,49 +4957,8 @@ dependencies = [
  "hyper-util",
  "js-sys",
  "log",
- "native-tls",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls 0.23.41",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper 1.0.2",
- "tokio",
- "tokio-native-tls",
- "tokio-rustls 0.26.4",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots 1.0.8",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.13.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "http 1.4.2",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.10.1",
- "hyper-rustls 0.27.9",
- "hyper-util",
- "js-sys",
- "log",
  "mime_guess",
+ "native-tls",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -4998,6 +4969,7 @@ dependencies = [
  "serde_json",
  "sync_wrapper 1.0.2",
  "tokio",
+ "tokio-native-tls",
  "tokio-rustls 0.26.4",
  "tower",
  "tower-http",
@@ -5148,6 +5120,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
  "aws-lc-rs",
+ "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
@@ -5337,20 +5310,20 @@ dependencies = [
 
 [[package]]
 name = "self_update"
-version = "0.42.0"
+version = "1.0.0-rc.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d832c086ece0dacc29fb2947bb4219b8f6e12fe9e40b7108f9e57c4224e47b5c"
+checksum = "0e408432f7c77ea6481c44379268b8beada0139c88c5024dc6d97b756cc96e65"
 dependencies = [
- "hyper 1.10.1",
+ "http 1.4.2",
- "indicatif",
  "log",
- "quick-xml 0.37.5",
  "regex",
- "reqwest 0.12.28",
+ "reqwest 0.13.4",
  "self-replace",
  "semver",
+ "serde",
  "serde_json",
  "tempfile",
+ "ureq",
  "urlencoding",
 ]
 
@@ -5664,6 +5637,17 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "socks"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c3dbbd9ae980613c6dd8e28a9407b50509d3803b57624d5dfe8315218cd58b"
+dependencies = [
+ "byteorder",
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -6454,6 +6438,43 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
+[[package]]
+name = "ureq"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
+dependencies = [
+ "base64 0.22.1",
+ "cookie_store",
+ "der",
+ "encoding_rs",
+ "flate2",
+ "log",
+ "native-tls",
+ "percent-encoding",
+ "rustls 0.23.41",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "socks",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-root-certs",
+ "webpki-roots 1.0.8",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+dependencies = [
+ "base64 0.22.1",
+ "http 1.4.2",
+ "httparse",
+ "log",
+]
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -6473,6 +6494,12 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -6806,7 +6833,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c324a910fd86ebdc364a3e61ec1f11737d3b1d6c273c0239ee8ff4bc0d24b4a"
 dependencies = [
  "proc-macro2",
- "quick-xml 0.39.4",
+ "quick-xml",
  "quote",
 ]
 
@@ -7619,9 +7646,9 @@ dependencies = [
 
 [[package]]
 name = "wit-deps"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8148a419968e66a49be6cf233438b5675f05d43b36aef3f089948bac0c4ca32"
+checksum = "bfd59c477054f61e2ec6e26c85e3273848abcac010b55963267b5c0b5c5f3a8b"
 dependencies = [
  "anyhow",
  "async-compression",

deny.toml

@@ -75,9 +75,13 @@ ignore = [
     #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" },
     { id = "RUSTSEC-2024-0436", reason = "Unmaintained paste crate is an indirect dependency" },
     { id = "RUSTSEC-2025-0052", reason = "Unmaintained async-std crate is an indirect dependency" },
-    { id = "RUSTSEC-2025-0119", reason = "Unmaintained number_prefix crate is an indirect dependency" },
     { id = "RUSTSEC-2025-0134", reason = "Unmaintained rustls-pemfile crate is an indirect dependency" },
-    { id = "RUSTSEC-2026-0002", reason = "Unsound advisory in lru indirect dependency" },
+    { id = "RUSTSEC-2026-0098", reason = "Build-time objdiff-wasm wit-deps dependency still uses reqwest 0.11; latest wit-deps has no safe upgrade path" },
+    { id = "RUSTSEC-2026-0099", reason = "Build-time objdiff-wasm wit-deps dependency still uses reqwest 0.11; latest wit-deps has no safe upgrade path" },
+    { id = "RUSTSEC-2026-0104", reason = "Build-time objdiff-wasm wit-deps dependency still uses reqwest 0.11; latest wit-deps has no safe upgrade path" },
+    { id = "RUSTSEC-2026-0192", reason = "Unmaintained ttf-parser is an egui 0.33 indirect dependency; egui 0.35 requires raising MSRV from 1.88 to 1.92" },
+    { id = "RUSTSEC-2026-0194", reason = "Build-time wayland-scanner dependency parses vendored protocol XML; no newer stable wayland-scanner release is available" },
+    { id = "RUSTSEC-2026-0195", reason = "Build-time wayland-scanner dependency parses vendored protocol XML; no newer stable wayland-scanner release is available" },
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.
@@ -245,8 +249,6 @@ allow-git = []
 [sources.allow-org]
 # github.com organizations to allow git sources for
 github = [
-    "encounter",
-    "gimli-rs",  # gimli
 ]
 # gitlab.com organizations to allow git sources for
 gitlab = []

objdiff-core/Cargo.toml

@@ -188,12 +188,12 @@ winapi = { version = "0.3", optional = true, features = ["winbase"] }
 # For Linux static binaries, use rustls
 [target.'cfg(target_os = "linux")'.dependencies]
 reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "multipart", "rustls"], optional = true }
-self_update = { version = "0.42", default-features = false, features = ["rustls"], optional = true }
+self_update = { version = "1.0.0-rc.3", default-features = false, features = ["reqwest", "rustls", "github"], optional = true }
 
 # For all other platforms, use native TLS
 [target.'cfg(not(target_os = "linux"))'.dependencies]
 reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "multipart", "default-tls"], optional = true }
-self_update = { version = "0.42", optional = true }
+self_update = { version = "1.0.0-rc.3", default-features = false, features = ["reqwest", "native-tls", "github"], optional = true }
 
 [build-dependencies]
 heck = { version = "0.5", optional = true }

objdiff-core/src/jobs/check_update.rs

@@ -1,10 +1,7 @@
 use std::{sync::mpsc::Receiver, task::Waker};
 
 use anyhow::{Context, Result};
-use self_update::{
+use self_update::update::{Release, ReleaseUpdate};
-    cargo_crate_version,
-    update::{Release, ReleaseUpdate},
-};
 
 use crate::jobs::{Job, JobContext, JobResult, JobState, start_job, update_status};
 
@@ -26,13 +23,13 @@ fn run_check_update(
 ) -> Result<Box<CheckUpdateResult>> {
     update_status(context, "Fetching latest release".to_string(), 0, 1, &cancel)?;
     let updater = (config.build_updater)().context("Failed to create release updater")?;
-    let latest_release = updater.get_latest_release()?;
+    let releases = updater.get_latest_release()?;
-    let update_available =
+    let update_available = releases.is_update_available()?;
-        self_update::version::bump_is_greater(cargo_crate_version!(), &latest_release.version)?;
+    let latest_release = releases.latest().context("No release found")?.clone();
     // Find the binary name in the release assets
     let mut found_binary = None;
     for bin_name in &config.bin_names {
-        if latest_release.assets.iter().any(|a| &a.name == bin_name) {
+        if latest_release.assets().iter().any(|a| a.name() == bin_name) {
             found_binary = Some(bin_name.clone());
             break;
         }

objdiff-core/src/jobs/update.rs

@@ -28,18 +28,19 @@ fn run_update(
 ) -> Result<Box<UpdateResult>> {
     update_status(status, "Fetching latest release".to_string(), 0, 3, &cancel)?;
     let updater = (config.build_updater)().context("Failed to create release updater")?;
-    let latest_release = updater.get_latest_release()?;
+    let releases = updater.get_latest_release()?;
+    let latest_release = releases.latest().context("No release found")?;
     let asset =
-        latest_release.assets.iter().find(|a| a.name == config.bin_name).ok_or_else(|| {
+        latest_release.assets().iter().find(|a| a.name() == config.bin_name).ok_or_else(|| {
             anyhow::Error::msg(format!("No release asset for {}", config.bin_name))
         })?;
 
     update_status(status, "Downloading release".to_string(), 1, 3, &cancel)?;
     let tmp_dir = tempfile::Builder::new().prefix("update").tempdir_in(current_dir()?)?;
-    let tmp_path = tmp_dir.path().join(&asset.name);
+    let tmp_path = tmp_dir.path().join(asset.name());
     let tmp_file = File::create(&tmp_path)?;
-    self_update::Download::from_url(&asset.download_url)
+    self_update::Download::from_url(asset.download_url())
-        .set_header(reqwest::header::ACCEPT, "application/octet-stream".parse()?)
+        .request_header(self_update::http::header::ACCEPT, "application/octet-stream")
         .download_to(tmp_file)?;
 
     update_status(status, "Extracting release".to_string(), 2, 3, &cancel)?;

objdiff-gui/src/update.rs

@@ -29,13 +29,15 @@ pub const RELEASE_URL: &str =
     formatcp!("https://github.com/{}/{}/releases/latest", GITHUB_USER, GITHUB_REPO);
 
 pub fn build_updater() -> Result<Box<dyn ReleaseUpdate>> {
-    Ok(self_update::backends::github::Update::configure()
+    Ok(Box::new(
-        .repo_owner(GITHUB_USER)
+        self_update::backends::github::Update::configure()
-        .repo_name(GITHUB_REPO)
+            .repo_owner(GITHUB_USER)
-        // bin_name is required, but unused?
+            .repo_name(GITHUB_REPO)
-        .bin_name(BIN_NAME_NEW)
+            // bin_name is required, but unused?
-        .no_confirm(true)
+            .bin_name(BIN_NAME_NEW)
-        .show_output(false)
+            .no_confirm(true)
-        .current_version(cargo_crate_version!())
+            .show_output(false)
-        .build()?)
+            .current_version(cargo_crate_version!())
+            .build()?,
+    ))
 }

objdiff-gui/src/views/config.rs

@@ -182,7 +182,7 @@ pub fn config_ui(
     }
     ui.label(format!("Current version: {}", env!("CARGO_PKG_VERSION")));
     if let Some(result) = &config_state.check_update {
-        ui.label(format!("Latest version: {}", result.latest_release.version));
+        ui.label(format!("Latest version: {}", result.latest_release.version()));
         if result.update_available {
             ui.colored_label(appearance.insert_color, "Update available");
             ui.horizontal(|ui| {

objdiff-wasm/Cargo.toml

@@ -35,4 +35,4 @@ features = ["arm", "arm64", "mips", "ppc", "superh", "x86", "dwarf"]
 talc = { version = "4.4", default-features = false, features = ["lock_api"] }
 
 [build-dependencies]
-wit-deps = "0.5"
+wit-deps = "0.6"