chore(deps): update compatible crates and migrate to ureq 3

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## Unreleased
+
+### Dependencies
+
+- Updated the semver-compatible dependency graph with `cargo update` and bumped the manifest floors for `clap`, `console`, `image`, `serde`, `serde_json` and `wat`.
+- Migrated from `ureq` 2.12 to 3.5.1. The updater, public IP probe and wasm HTTP host now use `Agent::config_builder`, `Error::StatusCode`, `Body` readers and request-level timeouts. No user-facing behavior change is intended.
+
 ## 2026-11-03 — v1.0.2
 
 ### Security

Cargo.toml

@@ -23,17 +23,17 @@ flate2 = { version = "1", optional = true }
 semver = { version = "1", optional = true }
 sha2 = "0.11"
 tar = { version = "0.4", optional = true }
-clap = { version = "4.5.54", features = ["derive"] }
-console = "0.16.2"
+clap = { version = "4.6.7", features = ["derive"] }
+console = "0.16.6"
 crossterm = "0.29.0"
 dirs = "7.0.0"
-image = { version = "0.25.9", default-features = false, features = ["png", "jpeg", "gif", "bmp", "ico", "webp", "tiff"] }
+image = { version = "0.25.10", default-features = false, features = ["png", "jpeg", "gif", "bmp", "ico", "webp", "tiff"] }
 json_comments = "0.2.2"
 libc = "0.2"
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.148"
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.154"
 sysinfo = "0.40.1"
-ureq = { version = "2.12", features = ["tls"] }
+ureq = "3.5.1"
 url = { version = "2", optional = true }
 viuer = { version = "0.11.0", default-features = false }
 wasmtime = { version = "50.0.1", optional = true, default-features = false, features = [
@@ -69,4 +69,4 @@ windows-sys = { version = "0.61", features = [
 ] }
 
 [dev-dependencies]
-wat = "1"
+wat = "1.263.0"

src/info/system.rs

@@ -1,4 +1,3 @@
-use std::io::Read;
 use std::net::IpAddr;
 use std::sync::LazyLock;
 use std::thread;
@@ -61,11 +60,12 @@ pub fn get_ipv6_info(networks: &Networks) -> String {
 /// No redirects: the IP endpoints serve the address directly, and a
 /// redirect to plaintext HTTP would silently downgrade the request.
 static AGENT: LazyLock<Agent> = LazyLock::new(|| {
-    ureq::AgentBuilder::new()
-        .timeout_connect(Duration::from_secs(3))
-        .timeout_read(Duration::from_secs(5))
-        .redirects(0)
-        .build()
+    let config = Agent::config_builder()
+        .timeout_connect(Some(Duration::from_secs(3)))
+        .timeout_per_read(Some(Duration::from_secs(5)))
+        .max_redirects(0)
+        .build();
+    config.into()
 });
 
 /// Validates the response body is a real IP address. Stricter than the old
@@ -81,12 +81,12 @@ fn parse_public_ip(body: &str) -> Option<IpAddr> {
 
 fn fetch_public_ip_from(host: &str) -> Option<String> {
     // Cap the body at 64 bytes: a public IP is at most 45 chars.
-    let response = AGENT.get(&format!("https://{host}/")).call().ok()?;
-    let mut body = String::new();
-    response
-        .into_reader()
-        .take(64)
-        .read_to_string(&mut body)
+    let mut response = AGENT.get(&format!("https://{host}/")).call().ok()?;
+    let body = response
+        .body_mut()
+        .with_config()
+        .limit(64)
+        .read_to_string()
         .ok()?;
     parse_public_ip(&body).map(|ip| ip.to_string())
 }