[github-actions]

Automated dependency refresh.

What ran

• cargo audit fix — raises version requirements that an advisory needs (experimental).
• cargo update — refreshes Cargo.lock within the existing semver ranges.
• cargo fmt --check, cargo clippy -D warnings, cargo test — all green before this PR opened.

Changes

diff --git a/Cargo.lock b/Cargo.lock
index 206dd52..102085b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -560,9 +560,9 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.2"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055"
 dependencies = [
  "cfg-if",
 ]
@@ -2699,9 +2699,9 @@ checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
 [[package]]
 name = "plist"
-version = "1.10.1"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2896bade328c13f7042a297ea5ac5b0951f6cf989dea5f32c2fd98da398195cb"
+checksum = "65dca778f41c79ebbe8b2b2139fee86f01b766b67130d108c7c2b8ffbd949f77"
 dependencies = [
  "base64 0.23.1",
  "indexmap 2.14.2",
@@ -3127,9 +3127,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4201,9 +4201,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 
 [[package]]
 name = "tokio"
-version = "1.53.3"
+version = "1.54.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e"
+checksum = "a0c168a474b95bfecfe908a65d4bdffc523144b649a74c09c286afb35d53e0bc"
 dependencies = [
  "bytes",
  "libc",
@@ -4764,9 +4764,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
  "rustls-pki-types",
 ]

Advisories after the update

    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1345 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (516 crate dependencies)
Crate:     zip
Version:   4.6.1
Title:     zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
Date:      2026-10-09
ID:        RUSTSEC-2026-0368
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0368
Solution:  Upgrade to >=9.0.0

Crate:     zip
Version:   4.6.1
Title:     ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
Date:      2026-10-10
ID:        RUSTSEC-2026-0369
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0369
Severity:  9.1 (critical)
Solution:  Upgrade to >=9.0.0

Crate:     zip
Version:   4.6.1
Title:      Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
Date:      2026-10-09
ID:        RUSTSEC-2026-0367
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0367
Severity:  7.3 (high)
Solution:  Upgrade to >=9.0.0

error: 3 vulnerabilities found!

_{Opened by the Dependency auto-fix workflow. Both blocks are truncated at
the size GitHub will render; run the commands locally for the full output.}