build(deps): Bump self_update from 1.0.0-rc.6 to 1.3.0

[dependabot]

Bumps self_update from 1.0.0-rc.6 to 1.3.0.

Changelog

Sourced from self_update's changelog.

[1.3.0]

Additive over 1.2.0: a proxy setter for corporate networks, plus an archive-lookup fix. No API breaks, no migration needed.

Added

• proxy(url) on every backend's Update / ReleaseList builder and on Download: route every request (release listing and asset download alike) through an HTTP proxy, with credentials allowed in the URL (http://user:pass@proxy.corp:8080) and sent to the proxy as Proxy-Authorization. HTTP_PROXY / HTTPS_PROXY / NO_PROXY already covered the unauthenticated case; a proxy demanding a password previously forced callers to add reqwest or ureq as a direct dependency purely to build a client with a proxy on it. Applied to the same crate-built client as add_root_certificate, so an intercepting proxy that also needs a private CA is one client. An injected client (http_client / reqwest_client / ureq_agent) owns its own proxy config and is unaffected. On reqwest the configured proxy is applied alongside the env vars (first match wins); on a ureq-only build it replaces the env-var proxy (single proxy slot). Only HTTP CONNECT proxies are supported.
• Error::InvalidProxy { source }: an unparseable proxy URL, surfaced from build() / download_to / download_to_async. The password embedded in a proxy URL is redacted from this error (including from the wrapped client error) and from every Debug rendering of the config, so it cannot leak into logs.

Changed

• The publish workflow now runs only when the crate version is not yet on crates.io, instead of on every push to master. A push that does not bump the version no longer spends a full CI run in release.yml (build.yml already covers it) and no longer requests release-environment approval. The workflow also skips itself on forks, where it could only fail for lack of publish credentials, and gains a workflow_dispatch trigger for re-running a release that failed partway.

Fixed

• Extract::extract_file (and so bin_path_in_archive on the update path) now finds an entry stored with a leading ./. tar -czf app.tar.gz -C dir . names every entry that way, and the lookup was an exact match, so such an archive failed with "Could not find the required path in the archive" even though the file was present. A ./-prefixed request now also matches a plainly-named entry. Only a leading ./ is ignored; interior components are still compared exactly, so a same-named file in a subdirectory cannot be selected by accident. Reported in #27.

Removed

[1.2.0]

Additive over 1.1.0: one opt-in feature for the ureq client's trust store. No API breaks, no migration needed.

Added

• native-certs feature: the crate-built ureq client verifies against the OS trust store (RootCerts::PlatformVerifier) instead of Mozilla's bundled roots (RootCerts::WebPki). Needed behind a TLS-intercepting corporate proxy, whose CA is installed on the machine and is absent from the bundled set, so every request otherwise fails to verify. Off by default, so the ureq client's trust store is unchanged unless asked for. No effect on reqwest (its rustls setup already uses rustls-platform-verifier) or on an injected ureq::Agent, which owns its own TLS config.

... (truncated)

Commits

• fc84045 release: bump version to 1.3.0 (#213)
• 7d2bb14 trigger the publish workflow on an unpublished version (#212)
• 9558822 match ./-prefixed archive entries in extract_file (#211)
• b779866 add a proxy() setter with credential support (#210)
• 0d70f4f Trust the OS certificate store on ureq (native-certs), release 1.2.0 (#209)
• 1775cc2 release: bump version to 1.1.0 (#208)
• 5c57fe7 add a verify_archive hook and checksum_from_asset (#207)
• f7b3dd2 fix stale method names in the spec prose (#206)
• 6519f80 release: bump version to 1.0.0 (#205)
• 1226c65 cite specs by symbol, add check/specs to enforce it (#204)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)