fix cargo-deny, update cg_pqp deps to what cg_ssa uses

crates/rustc_codegen_spirv/Cargo.toml

@@ -42,8 +42,8 @@ rustix = { version = "1.0.8", features = ["all-apis"] }
 
 # HACK(eddyb) deps of `rustc_codegen_ssa`, for `pqp_cg_ssa` (see `build.rs`),
 # that cannot be handled with just `extern crate` pulling out of the sysroot.
-object = { version = "0.37.1", default-features = false, features = ["read_core", "elf", "macho", "pe", "xcoff", "unaligned", "archive", "write", "wasm"] }
-thorin-dwp = "0.9.0"
+object = { version = "0.38.1", default-features = false, features = ["read_core", "elf", "macho", "pe", "xcoff", "unaligned", "archive", "write", "wasm"] }
+thorin-dwp = "0.10"
 
 # Normal dependencies.
 ar = "0.9.0"

deny.toml

@@ -14,6 +14,10 @@ ignore = [
     "RUSTSEC-2026-0249",
     # `anymap2` is unmaintained, cargo-generate depends on it
     "RUSTSEC-2026-0319",
+    # Decompression bomb in `ruzstd`: a tiny input can exhaust memory
+    # `ruzstd` is also built as a dependency of the Rust standard library via `rustc-dep-of-std`;
+    # in the toolchain it is used only to load zstd-compressed debug symbols, so the toolchain-side impact is limited.
+    "RUSTSEC-2026-0344",
 ]
 
 # This section is considered when running `cargo deny check bans`.