From 2f5fd494b6f1c16028c8dcd93000567993b04534 Mon Sep 17 00:00:00 2001
From: adarwoo <44254473+adarwoo@users.noreply.github.com>
Date: Sat, 12 Sep 2026 12:18:43 +0200
Subject: [PATCH] Take the five open dependency bumps as one change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dependabot had five major bumps open, four of them red on CI for reasons that
had nothing to do with the bump. Worth recording which was which, because the
red ticks made this look like four problems rather than one:

  * rfd 0.15 -> 0.17 and pulldown-cmark 0.12 -> 0.13 failed against an August
    base — the deny.toml that rejected k2g's *own* GPL-3.0-only (fixed in
    26da706), a rand advisory, and an unrelated update test. No code change.
  * jsonschema 0.28 -> 0.50 failed on a crates.io outage, which hid a real API
    break underneath.
  * image 0.24 -> 0.25 was the one genuine compile error.
  * base64 0.22 -> 0.23 was already green.

The two that needed code:

`IcoFrame::as_png` now takes `ExtendedColorType`, a rename at the call site.

jsonschema moved resources off the options and into a `referencing::Registry`
built up front: `with_resource` is gone, `Resource::from_contents` is
infallible, `Retrieve` takes `Uri<String>`, and `instance_path` is a method.
`NoRemoteRefs` is now installed on *both* the registry and the options — they
retrieve at different moments and neither covers the other, the registry for
refs between the bundled schemas and the options for a ref in the untrusted
document. The tests that pin the refusal and the cross-file resolution still
pass, which is the point of touching this code path carefully.

`default-features = false` on jsonschema, because its default `resolve-http` is
the network fetch `NoRemoteRefs` exists to refuse. Left on it cost a second HTTP
stack beside our own — reqwest 0.13 next to the 0.12 the update check uses, plus
`rustls-platform-verifier` and the C/assembly `aws-lc-sys` — a new native build
dependency and a second set of trust decisions, for a code path deliberately
disabled. That also makes the note beside `reqwest` wrong, since jsonschema no
longer supplies one; corrected rather than left to mislead.

Net the lockfile loses 31 packages (705 -> 674): rfd 0.17 drops the whole
zbus/async-io stack, and the duplicate image, rfd, gif and tiff entries go.

1051 tests pass, the release profile checks, and cargo-deny reports advisories,
bans, licenses and sources all ok.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 Cargo.lock                       | 653 ++++++-------------------------
 Cargo.toml                       |  24 +-
 build.rs                         |   8 +-
 crates/datastore/Cargo.toml      |   4 +-
 crates/datastore/src/parse.rs    |   2 +-
 crates/datastore/src/schema.rs   |  38 +-
 src/catalog_io/validator.rs      |  36 +-
 src/runtime/kicad_integration.rs |   2 +-
 8 files changed, 205 insertions(+), 562 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f361d1a..4c678cf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -50,6 +50,12 @@ dependencies = [
  "equator",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.6"
@@ -97,170 +103,6 @@ dependencies = [
  "stable_deref_trait",
 ]
 
-[[package]]
-name = "ashpd"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f3f79755c74fd155000314eb349864caa787c6592eace6c6882dad873d9c39"
-dependencies = [
- "async-fs",
- "async-net",
- "enumflags2",
- "futures-channel",
- "futures-util",
- "rand 0.9.5",
- "raw-window-handle 0.6.2",
- "serde",
- "serde_repr",
- "url",
- "wayland-backend",
- "wayland-client",
- "wayland-protocols",
- "zbus",
-]
-
-[[package]]
-name = "async-broadcast"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
-dependencies = [
- "event-listener",
- "event-listener-strategy",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-channel"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
-dependencies = [
- "concurrent-queue",
- "event-listener-strategy",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-executor"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
-dependencies = [
- "async-task",
- "concurrent-queue",
- "fastrand",
- "futures-lite",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "async-fs"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
-dependencies = [
- "async-lock",
- "blocking",
- "futures-lite",
-]
-
-[[package]]
-name = "async-io"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
-dependencies = [
- "autocfg",
- "cfg-if",
- "concurrent-queue",
- "futures-io",
- "futures-lite",
- "parking",
- "polling",
- "rustix",
- "slab",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "async-lock"
-version = "3.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
-dependencies = [
- "event-listener",
- "event-listener-strategy",
- "pin-project-lite",
-]
-
-[[package]]
-name = "async-net"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
-dependencies = [
- "async-io",
- "blocking",
- "futures-lite",
-]
-
-[[package]]
-name = "async-process"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
-dependencies = [
- "async-channel",
- "async-io",
- "async-lock",
- "async-signal",
- "async-task",
- "blocking",
- "cfg-if",
- "event-listener",
- "futures-lite",
- "rustix",
-]
-
-[[package]]
-name = "async-recursion"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "async-signal"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
-dependencies = [
- "async-io",
- "async-lock",
- "atomic-waker",
- "cfg-if",
- "futures-core",
- "futures-io",
- "rustix",
- "signal-hook-registry",
- "slab",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "async-task"
-version = "4.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
-
 [[package]]
 name = "async-trait"
 version = "0.1.92"
@@ -356,6 +198,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -425,19 +273,6 @@ dependencies = [
  "objc2",
 ]
 
-[[package]]
-name = "blocking"
-version = "1.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
-dependencies = [
- "async-channel",
- "async-task",
- "futures-io",
- "futures-lite",
- "piper",
-]
-
 [[package]]
 name = "borrow-or-share"
 version = "0.2.4"
@@ -668,15 +503,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -1152,7 +978,7 @@ checksum = "236deb81f1a04de704fb80cf7838c65607441c76914de2e036709540c540a39d"
 dependencies = [
  "anyhow",
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "cocoa",
  "core-foundation",
@@ -1171,7 +997,7 @@ dependencies = [
  "futures-util",
  "generational-box",
  "global-hotkey",
- "image 0.25.10",
+ "image",
  "infer",
  "jni 0.21.1",
  "lazy-js-bundle",
@@ -1184,7 +1010,7 @@ dependencies = [
  "objc_id",
  "percent-encoding",
  "rand 0.9.5",
- "rfd 0.17.2",
+ "rfd",
  "rustc-hash 2.1.3",
  "serde",
  "serde_json",
@@ -1556,33 +1382,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "endi"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
-
-[[package]]
-name = "enumflags2"
-version = "0.7.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
-dependencies = [
- "enumflags2_derive",
- "serde",
-]
-
-[[package]]
-name = "enumflags2_derive"
-version = "0.7.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "enumset"
 version = "1.1.14"
@@ -1650,26 +1449,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "event-listener"
-version = "5.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
-dependencies = [
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "event-listener-strategy"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
-dependencies = [
- "event-listener",
- "pin-project-lite",
-]
-
 [[package]]
 name = "exr"
 version = "1.74.2"
@@ -1689,9 +1468,9 @@ dependencies = [
 
 [[package]]
 name = "fancy-regex"
-version = "0.14.0"
+version = "0.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e24cb5a94bcae1e5408b0effca5cd7172ea3c5755049c5f3af4cd283a165298"
+checksum = "52e0387578e845beb7a1acff126228499f26cb18edf12919cc513bb863266464"
 dependencies = [
  "bit-set",
  "regex-automata",
@@ -1747,9 +1526,9 @@ dependencies = [
 
 [[package]]
 name = "fluent-uri"
-version = "0.3.2"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1918b65d96df47d3591bed19c5cca17e3fa5d0707318e4b5ef2eae01764df7e5"
+checksum = "bc74ac4d8359ae70623506d512209619e5cf8f347124910440dbc221714b328e"
 dependencies = [
  "borrow-or-share",
  "ref-cast",
@@ -1762,6 +1541,12 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -1815,12 +1600,12 @@ dependencies = [
 
 [[package]]
 name = "fraction"
-version = "0.15.4"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e076045bb43dac435333ed5f04caf35c7463631d0dae2deb2638d94dd0a5b872"
+checksum = "33fee0259ffdc3d7bd64438b6b08437884d4df5700f9cb8a23b079c3958ae578"
 dependencies = [
- "lazy_static",
  "num",
+ "num-bigint",
 ]
 
 [[package]]
@@ -1866,19 +1651,6 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
-[[package]]
-name = "futures-lite"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
-dependencies = [
- "fastrand",
- "futures-core",
- "futures-io",
- "parking",
- "pin-project-lite",
-]
-
 [[package]]
 name = "futures-macro"
 version = "0.3.34"
@@ -2073,9 +1845,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2092,16 +1866,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "gif"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ae047235e33e2829703574b54fdec96bfbad892062d97fed2f76022287de61b"
-dependencies = [
- "color_quant",
- "weezl",
-]
-
 [[package]]
 name = "gif"
 version = "0.14.2"
@@ -2307,6 +2071,11 @@ name = "hashbrown"
 version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
 
 [[package]]
 name = "heck"
@@ -2320,18 +2089,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hermit-abi"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -2434,7 +2191,7 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-util",
@@ -2591,24 +2348,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd62e6b5e86ea8eeeb8db1de02880a6abc01a397b2ebb64b5d74ac255318f5cb"
 
-[[package]]
-name = "image"
-version = "0.24.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
-dependencies = [
- "bytemuck",
- "byteorder",
- "color_quant",
- "exr",
- "gif 0.13.3",
- "jpeg-decoder",
- "num-traits",
- "png 0.17.16",
- "qoi",
- "tiff 0.9.1",
-]
-
 [[package]]
 name = "image"
 version = "0.25.10"
@@ -2619,7 +2358,7 @@ dependencies = [
  "byteorder-lite",
  "color_quant",
  "exr",
- "gif 0.14.2",
+ "gif",
  "image-webp",
  "moxcms",
  "num-traits",
@@ -2628,7 +2367,7 @@ dependencies = [
  "ravif",
  "rayon",
  "rgb",
- "tiff 0.11.3",
+ "tiff",
  "zune-core",
  "zune-jpeg",
 ]
@@ -2837,15 +2576,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "jpeg-decoder"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00810f1d8b74be64b13dbf3db89ac67740615d6c891f0e7b6179326533011a07"
-dependencies = [
- "rayon",
-]
-
 [[package]]
 name = "js-sys"
 version = "0.3.104"
@@ -2859,34 +2589,61 @@ dependencies = [
 
 [[package]]
 name = "jsonschema"
-version = "0.28.3"
+version = "0.50.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f66fe41fa46a5c83ed1c717b7e0b4635988f427083108c8cf0a882cc13441"
+checksum = "29b6bb4e22283b09119c671e57ac6a185e9a0c70c31585e56b729b626d877753"
 dependencies = [
  "ahash",
- "base64",
  "bytecount",
+ "data-encoding",
  "email_address",
  "fancy-regex",
  "fraction",
+ "getrandom 0.3.4",
  "idna",
  "itoa",
+ "jsonschema-regex",
+ "jsonschema-value",
  "num-cmp",
- "once_cell",
+ "num-traits",
  "percent-encoding",
  "referencing",
- "regex-syntax",
- "reqwest",
+ "regex",
  "serde",
  "serde_json",
+ "strum",
+ "unicode-general-category",
  "uuid-simd",
 ]
 
+[[package]]
+name = "jsonschema-regex"
+version = "0.50.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "497fbf3b1ca53b1e23a253f636e88e7a2031387388b8140199a0f240fcadf647"
+dependencies = [
+ "regex-syntax",
+]
+
+[[package]]
+name = "jsonschema-value"
+version = "0.50.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b84ca3f39446973a810fc90fc2645ada8c24284f6deb009c78b776813973887d"
+dependencies = [
+ "ahash",
+ "bytecount",
+ "fraction",
+ "num-cmp",
+ "num-traits",
+ "serde_json",
+]
+
 [[package]]
 name = "k2g"
 version = "0.15.0"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "chrono",
  "datastore",
  "dioxus",
@@ -2894,7 +2651,7 @@ dependencies = [
  "dirs",
  "gtk",
  "gtl",
- "image 0.24.9",
+ "image",
  "jsonschema",
  "log",
  "minisign",
@@ -2903,7 +2660,7 @@ dependencies = [
  "pcb",
  "pulldown-cmark",
  "reqwest",
- "rfd 0.15.4",
+ "rfd",
  "rhai",
  "serde",
  "serde_json",
@@ -3283,6 +3040,12 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "micromap"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a86d3146ed3995b5913c414f6664344b9617457320782e64f0bb44afd49d74"
+
 [[package]]
 name = "minisign"
 version = "0.9.1"
@@ -3772,16 +3535,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
-[[package]]
-name = "ordered-stream"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
-dependencies = [
- "futures-core",
- "pin-project-lite",
-]
-
 [[package]]
 name = "outref"
 version = "0.5.2"
@@ -3813,12 +3566,6 @@ dependencies = [
  "system-deps",
 ]
 
-[[package]]
-name = "parking"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
-
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -4027,17 +3774,6 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
-[[package]]
-name = "piper"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
-dependencies = [
- "atomic-waker",
- "fastrand",
- "futures-io",
-]
-
 [[package]]
 name = "pkg-config"
 version = "0.3.34"
@@ -4070,20 +3806,6 @@ dependencies = [
  "miniz_oxide",
 ]
 
-[[package]]
-name = "polling"
-version = "3.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
-dependencies = [
- "cfg-if",
- "concurrent-queue",
- "hermit-abi",
- "pin-project-lite",
- "rustix",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "pollster"
 version = "0.4.0"
@@ -4259,9 +3981,9 @@ dependencies = [
 
 [[package]]
 name = "pulldown-cmark"
-version = "0.12.2"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f86ba2052aebccc42cbbb3ed234b8b13ce76f75c3551a303cb2bcffcff12bb14"
+checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
 dependencies = [
  "bitflags 2.13.1",
  "memchr",
@@ -4680,13 +4402,17 @@ dependencies = [
 
 [[package]]
 name = "referencing"
-version = "0.28.3"
+version = "0.50.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0dcb5ab28989ad7c91eb1b9531a37a1a137cc69a0499aee4117cae4a107c464"
+checksum = "7a0a32a2a2c2d7dd0ee54705b5fd641be73037271928f68e9b0e7205b71c9d30"
 dependencies = [
  "ahash",
  "fluent-uri",
- "once_cell",
+ "getrandom 0.3.4",
+ "hashbrown",
+ "itoa",
+ "micromap",
+ "parking_lot",
  "percent-encoding",
  "serde_json",
 ]
@@ -4726,7 +4452,7 @@ version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
@@ -4760,30 +4486,6 @@ dependencies = [
  "webpki-roots",
 ]
 
-[[package]]
-name = "rfd"
-version = "0.15.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef2bee61e6cffa4635c72d7d81a84294e28f0930db0ddcb0f66d10244674ebed"
-dependencies = [
- "ashpd",
- "block2",
- "dispatch2",
- "js-sys",
- "log",
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-foundation",
- "pollster",
- "raw-window-handle 0.6.2",
- "urlencoding",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rfd"
 version = "0.17.2"
@@ -4804,6 +4506,9 @@ dependencies = [
  "raw-window-handle 0.6.2",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
  "web-sys",
  "windows-sys 0.61.2",
 ]
@@ -5424,6 +5129,27 @@ dependencies = [
  "quote",
 ]
 
+[[package]]
+name = "strum"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "subsecond"
 version = "0.7.10"
@@ -5672,17 +5398,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "tiff"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1310fcea54c6a9a4fd1aad794ecc02c31682f6bfbecdf460bf19533eed1e3e"
-dependencies = [
- "flate2",
- "jpeg-decoder",
- "weezl",
-]
-
 [[package]]
 name = "tiff"
 version = "0.11.3"
@@ -6062,23 +5777,18 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
-[[package]]
-name = "uds_windows"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
-dependencies = [
- "memoffset",
- "tempfile",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "unicase"
 version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
 
+[[package]]
+name = "unicode-general-category"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -6133,15 +5843,8 @@ dependencies = [
  "idna",
  "percent-encoding",
  "serde",
- "serde_derive",
 ]
 
-[[package]]
-name = "urlencoding"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
-
 [[package]]
 name = "utf-8"
 version = "0.7.6"
@@ -6162,7 +5865,6 @@ checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
- "serde_core",
  "sha1_smol",
  "wasm-bindgen",
 ]
@@ -6174,7 +5876,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23b082222b4f6619906941c17eb2297fff4c2fb96cb60164170522942a200bd8"
 dependencies = [
  "outref",
- "uuid",
  "vsimd",
 ]
 
@@ -7014,7 +6715,7 @@ version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "728b7d4c8ec8d81cab295e0b5b8a4c263c0d41a785fb8f8c4df284e5411140a2"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "block2",
  "cookie",
  "crossbeam-channel",
@@ -7135,76 +6836,6 @@ dependencies = [
  "synstructure",
 ]
 
-[[package]]
-name = "zbus"
-version = "5.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db4be7c075cb421e4b7ee645541604239bd243ba7c357511f4ff3a74b555907"
-dependencies = [
- "async-broadcast",
- "async-executor",
- "async-io",
- "async-lock",
- "async-process",
- "async-recursion",
- "async-task",
- "async-trait",
- "blocking",
- "enumflags2",
- "event-listener",
- "futures-core",
- "futures-lite",
- "hex",
- "libc",
- "ordered-stream",
- "rustix",
- "serde",
- "serde_repr",
- "tracing",
- "uds_windows",
- "uuid",
- "windows-sys 0.61.2",
- "winnow 1.0.4",
- "zbus_macros",
- "zbus_names",
- "zvariant",
-]
-
-[[package]]
-name = "zbus_macros"
-version = "5.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2990635d09ade6df1868f72f8cac69a876a90981e8bd3c40b1be413f8dc88f40"
-dependencies = [
- "proc-macro-crate 3.5.0",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "zbus_names",
- "zvariant",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zbus_names"
-version = "4.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8bf88b4a3ff53e883001e0e0115b297a9d53c31b9c1edd2bfdd853e3428624e"
-dependencies = [
- "serde",
- "winnow 1.0.4",
- "zvariant",
-]
-
-[[package]]
-name = "zcheapstr"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1afec51604565183aeb5c54c20aeab286120d4e4460f7f76e3e8bb8c0d99473"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "zerocopy"
 version = "0.8.56"
@@ -7314,45 +6945,3 @@ checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
 dependencies = [
  "zune-core",
 ]
-
-[[package]]
-name = "zvariant"
-version = "5.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e28c25bd8bb8da5a1f3e7065d0c156b9ee9a7973adf78b0e35eaefdf3b1b5c"
-dependencies = [
- "endi",
- "enumflags2",
- "serde",
- "url",
- "winnow 1.0.4",
- "zcheapstr",
- "zvariant_derive",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zvariant_derive"
-version = "5.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d496a145685283b67e232bd9e47377f6b60ad9d51e3601b23867f77c42477f96"
-dependencies = [
- "proc-macro-crate 3.5.0",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "zvariant_utils",
-]
-
-[[package]]
-name = "zvariant_utils"
-version = "4.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "629d80ece222cad20fe0e8741be493c4ab166acf3b85341bdc2cdbcfd8f3c2d6"
-dependencies = [
- "proc-macro2",
- "quote",
- "serde",
- "syn 3.0.3",
- "winnow 1.0.4",
-]
diff --git a/Cargo.toml b/Cargo.toml
index 8104426..4948f80 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -79,15 +79,22 @@ rhai = "1"
 thiserror = "2"
 serde_json = "1"
 serde_yaml = "0.9"
-jsonschema = "0.28"
+# `default-features = false` drops `resolve-http`, which is the feature that would
+# let a `$ref` be fetched over the network — the exact thing `NoRemoteRefs` exists to
+# refuse (`catalog_io::validator`, `datastore::schema`). Leaving it on cost a second
+# HTTP stack beside our own: reqwest 0.13 alongside the 0.12 the update check uses,
+# plus `rustls-platform-verifier` and the C/assembly `aws-lc-sys`. That is a new
+# native build dependency and a second set of trust decisions, in service of a code
+# path this application has deliberately disabled.
+jsonschema = { version = "0.50", default-features = false }
 log = "0.4"
-image = "0.24"
-base64 = "0.22"
-rfd = "0.15"
+image = "0.25"
+base64 = "0.23"
+rfd = "0.17"
 # Resolves the host's default save location (Windows Downloads known folder,
 # XDG_DOWNLOAD_DIR on Linux) for the first G-code save.
 dirs = "6"
-pulldown-cmark = { version = "0.12", default-features = false, features = ["html"] }
+pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
 uuid = { version = "1", features = ["v5", "v7"] }
 dioxus-logger = "0.7.9"
 tracing = "0.1.44"
@@ -98,7 +105,10 @@ synoptic = "2"
 # `rustls-tls` rather than the default `native-tls`: one TLS stack whose trust
 # decisions are the same on every platform, and no OpenSSL to track advisories for.
 # Blocking, because the check runs on its own thread rather than in an async runtime.
-# `reqwest` is already in the tree via `jsonschema`, so this adds no new supply chain.
+# This is now the *only* thing in the tree pulling `reqwest`: `jsonschema` used to bring
+# one too, and no longer does since its `resolve-http` was turned off above. So the
+# update check owns this HTTP/TLS stack outright rather than sharing one already present
+# — which is the preferable direction, but it does mean reqwest's advisories are ours.
 reqwest = { version = "0.12", default-features = false, features = [
     "blocking",
     "json",
@@ -187,4 +197,4 @@ windows-sys = { version = "0.61", features = [
 winresource = "0.1"
 # Renders the multi-size `.ico` from the single PNG source, so there is no second
 # icon file to keep in sync.
-image = "0.24"
+image = "0.25"
diff --git a/build.rs b/build.rs
index 17264db..9239f90 100644
--- a/build.rs
+++ b/build.rs
@@ -208,7 +208,11 @@ mod windows_icon {
 
     use image::codecs::ico::{IcoEncoder, IcoFrame};
     use image::imageops::FilterType;
-    use image::ColorType;
+    // `ExtendedColorType`, not `ColorType`: since image 0.25 the encoders take the
+    // wider enum — it can name layouts (packed / sub-byte formats) that `ColorType`,
+    // which only describes buffers image itself can hold in memory, cannot. `Rgba8`
+    // exists in both, so this is a rename at the call site and nothing more.
+    use image::ExtendedColorType;
 
     /// Source artwork — the same file `Dioxus.toml` points the bundler at.
     const ICON_PNG: &str = "assets/icons/icon.png";
@@ -267,7 +271,7 @@ mod windows_icon {
                 // Lanczos3 holds the artwork's edges together at 16px, where a cheaper
                 // filter turns fine detail to mush.
                 let scaled = image::imageops::resize(&source, size, size, FilterType::Lanczos3);
-                IcoFrame::as_png(scaled.as_raw(), size, size, ColorType::Rgba8)
+                IcoFrame::as_png(scaled.as_raw(), size, size, ExtendedColorType::Rgba8)
                     .map_err(|e| format!("cannot encode the {size}px frame: {e}"))
             })
             .collect::<Result<Vec<_>, _>>()?;
diff --git a/crates/datastore/Cargo.toml b/crates/datastore/Cargo.toml
index db3550e..248e739 100644
--- a/crates/datastore/Cargo.toml
+++ b/crates/datastore/Cargo.toml
@@ -12,7 +12,9 @@ description = "Generic schema-driven data store: validate, default, type units/i
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["preserve_order"] }
 serde_yaml = "0.9"
-jsonschema = "0.28"
+# See the note in the workspace root: `resolve-http` is the network `$ref` fetch that
+# `NoRemoteRefs` refuses, and it drags in a second HTTP/TLS stack to do it.
+jsonschema = { version = "0.50", default-features = false }
 uuid = { version = "1", features = ["v7"] }
 thiserror = "2"
 indexmap = { version = "2", features = ["serde"] }
diff --git a/crates/datastore/src/parse.rs b/crates/datastore/src/parse.rs
index 95ed8b0..1e33f5f 100644
--- a/crates/datastore/src/parse.rs
+++ b/crates/datastore/src/parse.rs
@@ -115,7 +115,7 @@ pub(crate) fn parse_document(
             errors.push(DataError::new(
                 schema_id,
                 &source,
-                error.instance_path.to_string(),
+                error.instance_path().to_string(),
                 DataErrorKind::Validation,
                 error.to_string(),
             ));
diff --git a/crates/datastore/src/schema.rs b/crates/datastore/src/schema.rs
index 75beb0a..66fd978 100644
--- a/crates/datastore/src/schema.rs
+++ b/crates/datastore/src/schema.rs
@@ -12,7 +12,7 @@
 use std::collections::HashMap;
 
 use indexmap::IndexMap;
-use jsonschema::{options, Resource, Validator};
+use jsonschema::{options, Registry, Resource, Validator};
 use serde_json::Value;
 
 use crate::error::SchemaError;
@@ -200,7 +200,7 @@ pub(crate) struct NoRemoteRefs;
 impl jsonschema::Retrieve for NoRemoteRefs {
     fn retrieve(
         &self,
-        uri: &jsonschema::Uri<&str>,
+        uri: &jsonschema::Uri<String>,
     ) -> Result<Value, Box<dyn std::error::Error + Send + Sync>> {
         Err(format!(
             "refusing to fetch the external schema reference '{uri}'. k2g validates \
@@ -215,14 +215,36 @@ impl jsonschema::Retrieve for NoRemoteRefs {
 /// cross-file `$ref`s (`units.yaml#/...`) resolve without external retrieval — and
 /// with [`NoRemoteRefs`] installed so an unregistered one fails instead of fetching.
 fn compile_with_resources(schemas: &IndexMap<String, RawSchema>, root: &Value) -> Result<Validator, String> {
-    let mut opts = options();
-    opts.with_retriever(NoRemoteRefs);
+    // Since jsonschema 0.50 the resources live in a `Registry` built up front rather than
+    // being pushed one at a time onto the options: `with_resource` is gone, and the
+    // builders take `self` by value instead of `&mut self`. Same two registrations per
+    // schema as before — the bare id and the `json-schema:///` URI form — because a
+    // `$ref` is written the first way and the resolver normalizes it to the second.
+    let mut resources = Vec::with_capacity(schemas.len() * 2);
     for (id, raw) in schemas {
-        let resource = Resource::from_contents(raw.value.clone()).map_err(|e| e.to_string())?;
-        opts.with_resource(id.clone(), resource.clone());
-        opts.with_resource(format!("json-schema:///{id}"), resource);
+        // `Resource::from_contents` no longer returns a `Result`; the draft is detected
+        // from the contents and falls back to the default rather than failing.
+        let resource = Resource::from_contents(raw.value.clone());
+        resources.push((id.clone(), resource.clone()));
+        resources.push((format!("json-schema:///{id}"), resource));
     }
-    opts.build(root).map_err(|e| e.to_string())
+
+    // `NoRemoteRefs` goes on both halves, because they retrieve at different moments and
+    // neither covers the other: the registry resolves the `$ref`s *between* the schemas
+    // registered here, while the options' retriever is what a `$ref` in `root` — the
+    // untrusted half — reaches for when it names something the registry does not hold.
+    let registry = Registry::new()
+        .retriever(NoRemoteRefs)
+        .extend(resources)
+        .map_err(|e| e.to_string())?
+        .prepare()
+        .map_err(|e| e.to_string())?;
+
+    options()
+        .with_registry(&registry)
+        .with_retriever(NoRemoteRefs)
+        .build(root)
+        .map_err(|e| e.to_string())
 }
 
 /// Parses YAML (BOM-tolerant) into a JSON value.
diff --git a/src/catalog_io/validator.rs b/src/catalog_io/validator.rs
index a405b9f..815b85a 100644
--- a/src/catalog_io/validator.rs
+++ b/src/catalog_io/validator.rs
@@ -1,4 +1,4 @@
-use jsonschema::{options, Resource, Validator};
+use jsonschema::{options, Registry, Resource, Validator};
 use serde_json::Value;
 use super::error::ConfigError;
 
@@ -18,7 +18,7 @@ struct NoRemoteRefs;
 impl jsonschema::Retrieve for NoRemoteRefs {
     fn retrieve(
         &self,
-        uri: &jsonschema::Uri<&str>,
+        uri: &jsonschema::Uri<String>,
     ) -> Result<Value, Box<dyn std::error::Error + Send + Sync>> {
         Err(format!(
             "refusing to fetch the external schema reference '{uri}'. k2g validates \
@@ -49,22 +49,38 @@ impl SchemaValidator {
     /// published separately and never loaded back — see
     /// [`crate::data::schema_export`].
     pub fn new(schema: &Value, refs: &[(&str, &str)]) -> Result<Self, ConfigError> {
-        let mut opts = options();
-        opts.with_retriever(NoRemoteRefs);
-
+        // Since jsonschema 0.50 the resources are collected into a `Registry` up front
+        // rather than pushed one at a time onto the options: `with_resource` is gone, and
+        // the builders take `self` by value instead of `&mut self`.
+        let mut resources = Vec::with_capacity(refs.len() * 2);
         for (file_name, text) in refs {
             let yaml_value: serde_yaml::Value = serde_yaml::from_str(text)
                 .map_err(|e| ConfigError::SchemaParse(e.to_string()))?;
             let json_value: Value = serde_json::to_value(yaml_value)
                 .map_err(|e| ConfigError::SchemaParse(e.to_string()))?;
-            let resource = Resource::from_contents(json_value)
-                .map_err(|e| ConfigError::SchemaParse(e.to_string()))?;
+            // `Resource::from_contents` is infallible now — the draft is detected from
+            // the contents and falls back to the default rather than erroring.
+            let resource = Resource::from_contents(json_value);
 
-            opts.with_resource((*file_name).to_string(), resource.clone());
-            opts.with_resource(format!("json-schema:///{file_name}"), resource);
+            resources.push(((*file_name).to_string(), resource.clone()));
+            resources.push((format!("json-schema:///{file_name}"), resource));
         }
 
-        let compiled = opts
+        // `NoRemoteRefs` is installed on both halves, because they retrieve at different
+        // moments and neither covers the other: the registry resolves the `$ref`s between
+        // the embedded schemas, while the options' retriever is what a `$ref` in `schema`
+        // — the catalog-supplied, untrusted half — reaches for when it names something the
+        // registry does not hold. The test below pins that second one.
+        let registry = Registry::new()
+            .retriever(NoRemoteRefs)
+            .extend(resources)
+            .map_err(|e| ConfigError::SchemaParse(e.to_string()))?
+            .prepare()
+            .map_err(|e| ConfigError::SchemaParse(e.to_string()))?;
+
+        let compiled = options()
+            .with_registry(&registry)
+            .with_retriever(NoRemoteRefs)
             .build(schema)
             .map_err(|e| ConfigError::SchemaParse(e.to_string()))?;
         Ok(Self { compiled })
diff --git a/src/runtime/kicad_integration.rs b/src/runtime/kicad_integration.rs
index 2e5ebe1..2795ee2 100644
--- a/src/runtime/kicad_integration.rs
+++ b/src/runtime/kicad_integration.rs
@@ -731,7 +731,7 @@ mod tests {
         let instance = manifest(&launcher_file_name());
         let errors: Vec<String> = validator
             .iter_errors(&instance)
-            .map(|error| format!("{}: {error}", error.instance_path))
+            .map(|error| format!("{}: {error}", error.instance_path()))
             .collect();
 
         assert!(