From da318490ad248fb273b9e286311df833f46f8cb2 Mon Sep 17 00:00:00 2001
From: Young Joon Lee <entelecheia@hotmail.com>
Date: Tue, 10 Nov 2026 21:37:54 +0900
Subject: [PATCH] build(deps): bump getrandom, resvg, base64, zip and
 lzma-rust2

Combines Dependabot PRs #459, #458, #457 and #438 on current main, since
each rewrote Cargo.lock from an older base.

- getrandom 0.3 -> 0.4
- resvg =0.47.0 -> =0.49.0 (exact pin kept)
- base64 0.22.1 -> 0.23.1 (dev-dependency)
- zip 9.1.2 -> 9.4.2, lzma-rust2 0.23 -> 0.25 (cargo-minor-patch group)

Claude-Session: 0ad4399f-1a01-44fe-89e3-a51586564caa
---
 Cargo.lock | 60 +++++++++++++++++++++++++++++++++---------------------
 Cargo.toml |  6 +++---
 2 files changed, 40 insertions(+), 26 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 389ee6db..1dca787a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,6 +17,7 @@ dependencies = [
  "cipher",
  "cpubits",
  "cpufeatures",
+ "zeroize",
 ]
 
 [[package]]
@@ -122,6 +123,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -787,13 +794,13 @@ version = "1.5.0"
 dependencies = [
  "aes",
  "anyhow",
- "base64",
+ "base64 0.23.1",
  "cbc",
  "cfb",
  "clap",
  "encoding_rs",
  "flate2",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "hmac",
  "httparse",
  "hwp-convert",
@@ -890,7 +897,7 @@ name = "hwpx"
 version = "1.5.0"
 dependencies = [
  "aes",
- "base64",
+ "base64 0.23.1",
  "cbc",
  "encoding_rs",
  "flate2",
@@ -1054,9 +1061,9 @@ dependencies = [
 
 [[package]]
 name = "imagesize"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09e54e57b4c48b40f7aec75635392b12b3421fa26fe8b4332e63138ed278459c"
+checksum = "65b27460c2c92b037f3f94c538ed9a3342f3fdf923606781629ccb35f82d042a"
 
 [[package]]
 name = "indexmap"
@@ -1133,7 +1140,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d46662859bc5f60a145b75f4632fbadc84e829e45df6c5de74cfc8e05acb96b5"
 dependencies = [
  "ahash",
- "base64",
+ "base64 0.22.1",
  "bytecount",
  "email_address",
  "fancy-regex",
@@ -1223,9 +1230,9 @@ checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 
 [[package]]
 name = "lzma-rust2"
-version = "0.23.0"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1c46f3fcd2e888afdb01a07efc071cb21300e07c68d32c3e8b01b5c8cb1fcaa"
+checksum = "ef1d73c59a56771343712b22ea5615092c612c16ba291c0979e3105dfeec4890"
 dependencies = [
  "sha2",
 ]
@@ -1723,10 +1730,11 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "resvg"
-version = "0.47.0"
+version = "0.49.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9be183ad6a216aa96f33e4c8033b0988b8b3ea6fd2359d19af5bac4643fd8e81"
+checksum = "1572844b6727a1bf842190e9947641a68ac44bed83f50afb4bd1407a2564bee8"
 dependencies = [
+ "bytemuck",
  "log",
  "pico-args",
  "rgb",
@@ -2267,13 +2275,11 @@ checksum = "b39abd59bf32521c7f2301b52d05a6a2c975b6003521cbd0c6dc1582f0a22104"
 
 [[package]]
 name = "usvg"
-version = "0.47.0"
+version = "0.49.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d46cf96c5f498d36b7a9693bc6a7075c0bb9303189d61b2249b0dc3d309c07de"
+checksum = "d09b73ee83641d390ad7ffd9000f347b16eb128e437675b6ff277ea5c7fcf22c"
 dependencies = [
- "base64",
  "data-url",
- "flate2",
  "imagesize",
  "kurbo",
  "log",
@@ -2284,7 +2290,6 @@ dependencies = [
  "strict-num",
  "svgtypes",
  "tiny-skia-path",
- "xmlwriter",
 ]
 
 [[package]]
@@ -2591,12 +2596,6 @@ version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
-[[package]]
-name = "xmlwriter"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
-
 [[package]]
 name = "yoke"
 version = "0.8.3"
@@ -2666,6 +2665,20 @@ name = "zeroize"
 version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
 
 [[package]]
 name = "zerotrie"
@@ -2702,9 +2715,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "9.1.2"
+version = "9.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec2e3161de27091f18a831d9494e9c53378a34833af5c1dda35ad85849da18d6"
+checksum = "df3845f734baabdd02de353a20580e30ceccd03897def44a4eb8e9654992e294"
 dependencies = [
  "aes",
  "bzip2",
@@ -2715,6 +2728,7 @@ dependencies = [
  "getrandom 0.4.2",
  "hmac",
  "indexmap",
+ "libc",
  "lzma-rust2",
  "memchr",
  "nix",
diff --git a/Cargo.toml b/Cargo.toml
index 5c22ad17..56832009 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,7 +28,7 @@ cfb = "0.16"
 flate2 = "1"
 quick-xml = "0.42"
 libc = "0.2"
-resvg = { version = "=0.47.0", default-features = false }
+resvg = { version = "=0.49.0", default-features = false }
 regex = "1.11"
 zip = "9"
 # Checksum verification for self-update (hwp update) release archives — already
@@ -38,7 +38,7 @@ sha2 = "0.11"
 # GATE-01) — already pulled in via zip's AES-encrypted-archive support, so the
 # dependency graph does not grow.
 aes = "0.9.1"
-getrandom = "0.3"
+getrandom = "0.4"
 pulldown-cmark = { version = "0.13.6", default-features = false }
 # `hwp serve` HTTP adapter (issue #312, decision record in doc 22 §4) — a
 # synchronous thread model, so no tokio. httparse owns request-head parsing
@@ -64,7 +64,7 @@ subsetter = "0.2"
 insta = { version = "1", features = ["json"] }
 proptest = "1"
 jsonschema = { version = "0.33", default-features = false }
-base64 = "0.22.1"
+base64 = "0.23.1"
 cbc = "0.2.1"
 hmac = "0.13.0"
 pbkdf2 = "0.13.0"