[adarwoo]

Supersedes #6, #7, #8, #10 and #11.

Four of the five were red on CI for reasons that had nothing to do with the bump, which made this look like four problems rather than one:

PR	Bump	CI failure	Real?
#8	base64 0.22→0.23	none	already green
#11	image 0.24→0.25	windows	yes — ExtendedColorType
#10	jsonschema 0.28→0.50	all platforms	no — crates.io outage, but it hid a real API break
#7	rfd 0.15→0.17	deny	no — old deny.toml rejected k2g's own GPL-3.0-only (fixed in 26da706)
#6	pulldown-cmark 0.12→0.13	advisories, deny, linux	no — a rand RUSTSEC, the same deny.toml, and an unrelated update test

The two that needed code

IcoFrame::as_png now takes ExtendedColorType — a rename at the call site in build.rs.

jsonschema moved resources off the options and into a referencing::Registry built up front: with_resource is gone, Resource::from_contents is infallible, Retrieve takes Uri<String>, and instance_path is a method. NoRemoteRefs is now installed on both the registry and the options — they retrieve at different moments and neither covers the other: the registry resolves refs between the bundled schemas, the options' retriever is what a ref in the untrusted document reaches for.

default-features = false on jsonschema

Its default resolve-http is the network $ref fetch that NoRemoteRefs exists to refuse. Left on, it cost a second HTTP stack beside our own — reqwest 0.13 next to the 0.12 the update check uses, plus rustls-platform-verifier and the C/assembly aws-lc-sys. A new native build dependency and a second set of trust decisions, in service of a code path this application has deliberately disabled.

That also made the note beside reqwest wrong ("already in the tree via jsonschema"), so it is corrected rather than left to mislead.

Net effect

Lockfile loses 31 packages (705 → 674): rfd 0.17 drops the whole zbus/async-io stack (36 crates), and the duplicate image, rfd, gif and tiff entries go. No aws-lc-sys, no rustls-platform-verifier; reqwest, rustls and ring each stay at a single version.

Verification (locally, on Windows)

• 1051 tests pass, 0 fail
• cargo check --workspace --all-targets --release clean
• cargo deny --all-features check → advisories ok, bans ok, licenses ok, sources ok
• The guards on the code path this touches all still pass: a_remote_ref_is_refused_rather_than_fetched, an_off_machine_reference_is_refused_rather_than_fetched, refs_between_registered_schemas_still_resolve, cross_file_references_resolve_from_the_embedded_set

The Linux and macOS legs are what CI adds here — rfd 0.17 dropping the zbus stack is Linux-facing and I could not exercise it locally.

🤖 Generated with Claude Code