Merge branch 'update-boringtun'

14 files changed, 211 insertions, 139 deletions

diff --git a/.github/workflows/clippy.yml b/.github/workflows/clippy.yml
index 75b1bfa978..0c35a4d6d4 100644
--- a/.github/workflows/clippy.yml
+++ b/.github/workflows/clippy.yml
@@ -65,6 +65,8 @@ jobs:
       - name: Install latest zig
         if: matrix.os == 'windows-latest'
         uses: mlugg/setup-zig@v2
+        with:
+          version: 0.14.1
 
       - name: Install Go
         uses: actions/setup-go@v5
diff --git a/.github/workflows/downloader.yml b/.github/workflows/downloader.yml
index 54efd57a14..841c1f5d6b 100644
--- a/.github/workflows/downloader.yml
+++ b/.github/workflows/downloader.yml
@@ -63,7 +63,7 @@ jobs:
     env:
       # If the file is larger than this, a regression has probably been introduced.
       # You should think twice before increasing this limit.
-      MAX_BINARY_SIZE: 3196928
+      MAX_BINARY_SIZE: 3210000
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
diff --git a/Cargo.lock b/Cargo.lock
index 10bb02092d..967f5e4081 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -275,7 +275,7 @@ dependencies = [
  "pin-project-lite",
  "rustversion",
  "serde",
- "sync_wrapper 1.0.1",
+ "sync_wrapper",
  "tower 0.4.13",
  "tower-layer",
  "tower-service",
@@ -296,7 +296,7 @@ dependencies = [
  "mime",
  "pin-project-lite",
  "rustversion",
- "sync_wrapper 1.0.1",
+ "sync_wrapper",
  "tower-layer",
  "tower-service",
 ]
@@ -455,7 +455,7 @@ dependencies = [
 [[package]]
 name = "boringtun"
 version = "0.6.0"
-source = "git+https://github.com/mullvad/boringtun?rev=82166463940bb76ac9917ded1fdf663ed6ece40e#82166463940bb76ac9917ded1fdf663ed6ece40e"
+source = "git+https://github.com/mullvad/boringtun?rev=83b3b5bb1bf3ec8b9849cc0d250d96d623b6181f#83b3b5bb1bf3ec8b9849cc0d250d96d623b6181f"
 dependencies = [
  "aead",
  "async-trait",
@@ -464,6 +464,7 @@ dependencies = [
  "blake2",
  "bytes",
  "chacha20poly1305",
+ "duplicate",
  "either",
  "eyre",
  "hex",
@@ -475,6 +476,7 @@ dependencies = [
  "nix 0.30.1",
  "parking_lot",
  "pnet_packet 0.35.0",
+ "rand 0.9.2",
  "rand_core 0.6.4",
  "ring",
  "socket2 0.4.10",
@@ -1116,6 +1118,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
 [[package]]
+name = "duplicate"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97af9b5f014e228b33e77d75ee0e6e87960124f0f4b16337b586a6bec91867b1"
+
+[[package]]
 name = "ecdsa"
 version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1912,13 +1920,14 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.4.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "futures-channel",
- "futures-util",
+ "futures-core",
  "h2 0.4.4",
  "http 1.1.0",
  "http-body",
@@ -1926,6 +1935,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
+ "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -1964,18 +1974,23 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.9"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41296eb09f183ac68eec06e03cdbea2e759633d4067b2f6552fc2e009bcad08b"
+checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e"
 dependencies = [
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
+ "futures-core",
  "futures-util",
  "http 1.1.0",
  "http-body",
  "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.8",
+ "socket2 0.6.0",
  "tokio",
  "tower-service",
  "tracing",
@@ -2354,6 +2369,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "iri-string"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
 name = "is-terminal"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2878,7 +2903,7 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.0",
  "tokio-socks",
- "tower 0.5.1",
+ "tower 0.5.2",
  "uuid",
  "vec1",
 ]
@@ -3022,7 +3047,7 @@ dependencies = [
  "talpid-types",
  "tokio",
  "tonic",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tunnel-obfuscation",
 ]
 
@@ -3085,7 +3110,7 @@ dependencies = [
  "tokio",
  "tonic",
  "tonic-build",
- "tower 0.5.1",
+ "tower 0.5.2",
  "vec1",
 ]
 
@@ -4348,7 +4373,7 @@ dependencies = [
  "bytes",
  "getrandom 0.3.2",
  "lru-slab",
- "rand 0.9.0",
+ "rand 0.9.2",
  "ring",
  "rustc-hash",
  "rustls 0.23.18",
@@ -4415,13 +4440,12 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.0"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
- "zerocopy",
 ]
 
 [[package]]
@@ -4581,44 +4605,40 @@ checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "reqwest"
-version = "0.12.9"
+version = "0.12.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77c62af46e79de0a562e1a9849205ffcb7fc1238876e9bd743357570e04046f"
+checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-core",
- "futures-util",
  "http 1.1.0",
  "http-body",
  "http-body-util",
  "hyper",
  "hyper-rustls",
  "hyper-util",
- "ipnet",
  "js-sys",
  "log",
- "mime",
- "once_cell",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
  "rustls 0.23.18",
- "rustls-pemfile 2.1.3",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 1.0.1",
+ "sync_wrapper",
  "tokio",
  "tokio-rustls 0.26.0",
+ "tower 0.5.2",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 0.26.7",
- "windows-registry",
+ "webpki-roots 1.0.2",
 ]
 
 [[package]]
@@ -5181,6 +5201,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "socket2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
 name = "spin"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5268,12 +5298,6 @@ dependencies = [
 
 [[package]]
 name = "sync_wrapper"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
-
-[[package]]
-name = "sync_wrapper"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
@@ -5340,7 +5364,7 @@ dependencies = [
  "pcap",
  "pfctl",
  "pnet_packet 0.35.0",
- "rand 0.9.0",
+ "rand 0.9.2",
  "resolv-conf",
  "serde",
  "serde_json",
@@ -5462,7 +5486,7 @@ dependencies = [
  "tokio",
  "tonic",
  "tonic-build",
- "tower 0.5.1",
+ "tower 0.5.2",
  "winapi",
  "windows-sys 0.52.0",
  "winres",
@@ -5545,7 +5569,7 @@ dependencies = [
  "tokio",
  "tonic",
  "tonic-build",
- "tower 0.5.1",
+ "tower 0.5.2",
  "windows-sys 0.52.0",
  "zeroize",
 ]
@@ -5978,14 +6002,33 @@ dependencies = [
 
 [[package]]
 name = "tower"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2873938d487c3cfb9aed7546dc9f2711d867c9f90c46b889989a2cb84eba6b4f"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper 0.1.2",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+dependencies = [
+ "bitflags 2.9.0",
+ "bytes",
+ "futures-util",
+ "http 1.1.0",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
 ]
@@ -6448,6 +6491,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "webpki-roots"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
 name = "which"
 version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -6614,17 +6666,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows-registry"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e400001bb720a623c1c69032f8e3e4cf09984deec740f007dd2b03ec864804b0"
-dependencies = [
- "windows-result 0.2.0",
- "windows-strings 0.1.0",
- "windows-targets 0.52.6",
-]
-
-[[package]]
 name = "windows-result"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/Cargo.toml b/Cargo.toml
index 515d8de0bf..c01852c345 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -102,6 +102,7 @@ pnet_packet = "0.35.0"
 ipnetwork = "0.20"
 tun = { version = "0.5.5", features = ["async"] }
 socket2 = "0.5.7"
+reqwest = { version = "0.12.23", default-features = false, features = ["rustls-tls"] }
 
 # Hickory & DNS
 hickory-proto = "0.24.3"
diff --git a/deny.toml b/deny.toml
index afd648074c..d8aff0dbd1 100644
--- a/deny.toml
+++ b/deny.toml
@@ -53,7 +53,8 @@ allow = [
     "CC0-1.0",
     "Unicode-DFS-2016",
     "Zlib",
-    "Unicode-3.0"
+    "Unicode-3.0",
+    "CDLA-Permissive-2.0"
 ]
 
 [licenses.private]
diff --git a/installer-downloader/Cargo.toml b/installer-downloader/Cargo.toml
index 411f3815de..0a5f306a3d 100644
--- a/installer-downloader/Cargo.toml
+++ b/installer-downloader/Cargo.toml
@@ -25,7 +25,7 @@ fern = { workspace = true }
 hex = "0.4"
 log = { workspace = true }
 rand = { version = "0.8.5" }
-reqwest = { version = "0.12.9", default-features = false, features = ["rustls-tls"] }
+reqwest = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 tokio = { workspace = true, features = ["rt-multi-thread", "fs"] }
 
diff --git a/mullvad-leak-checker/Cargo.toml b/mullvad-leak-checker/Cargo.toml
index 6e5a8af832..1c39168284 100644
--- a/mullvad-leak-checker/Cargo.toml
+++ b/mullvad-leak-checker/Cargo.toml
@@ -20,7 +20,7 @@ futures.workspace = true
 serde = { workspace = true, features = ["derive"] }
 clap = { workspace = true, features = ["derive"] }
 
-reqwest = { version = "0.12.9", optional = true, default-features = false, features = ["json", "rustls-tls"] }
+reqwest = { workspace = true, optional = true, features = ["json"] }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["full"] }
diff --git a/mullvad-update/Cargo.toml b/mullvad-update/Cargo.toml
index 419d999319..d3ca75da4a 100644
--- a/mullvad-update/Cargo.toml
+++ b/mullvad-update/Cargo.toml
@@ -27,7 +27,7 @@ zeroize = { version = "1.8", features = ["zeroize_derive"] }
 log = { workspace = true }
 itertools = { workspace = true }
 
-reqwest = { version = "0.12.9", default-features = false, features = ["rustls-tls"], optional = true }
+reqwest = { workspace = true, optional = true }
 sha2 = { workspace = true, optional = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "fs", "process", "macros"], optional = true }
 vec1 = { workspace = true }
diff --git a/mullvad-update/mullvad-release/Cargo.toml b/mullvad-update/mullvad-release/Cargo.toml
index e85db1cb46..89608d8c82 100644
--- a/mullvad-update/mullvad-release/Cargo.toml
+++ b/mullvad-update/mullvad-release/Cargo.toml
@@ -16,7 +16,7 @@ chrono = { workspace = true, features = ["serde", "now"] }
 clap = { workspace = true }
 hex = { version = "0.4" }
 rand = { version = "0.8.5" }
-reqwest = { version = "0.12.9", default-features = false, features = ["rustls-tls"] }
+reqwest = { workspace = true }
 serde_json = { workspace = true }
 serde = { workspace = true }
 sha2 = { workspace = true }
diff --git a/talpid-wireguard/Cargo.toml b/talpid-wireguard/Cargo.toml
index 1122494716..2bfea215a7 100644
--- a/talpid-wireguard/Cargo.toml
+++ b/talpid-wireguard/Cargo.toml
@@ -46,7 +46,7 @@ tokio-stream = { version = "0.1", features = ["io-util"] }
 optional = true
 features = ["device", "tun"]
 git = "https://github.com/mullvad/boringtun"
-rev = "82166463940bb76ac9917ded1fdf663ed6ece40e"
+rev = "83b3b5bb1bf3ec8b9849cc0d250d96d623b6181f"
 
 [target.'cfg(unix)'.dependencies]
 nix = { workspace = true, features = ["fs"] }
diff --git a/talpid-wireguard/src/boringtun/mod.rs b/talpid-wireguard/src/boringtun/mod.rs
index e790ef70f9..f4ba01f089 100644
--- a/talpid-wireguard/src/boringtun/mod.rs
+++ b/talpid-wireguard/src/boringtun/mod.rs
@@ -11,7 +11,10 @@ use boringtun::{
         api::{ApiClient, ApiServer, command::*},
         peer::AllowedIP,
     },
-    udp::{UdpSocketFactory, channel::PacketChannel},
+    udp::{
+        UdpSocketFactory,
+        channel::{PacketChannelUdp, TunChannelRx, TunChannelTx, get_packet_channels},
+    },
 };
 #[cfg(not(target_os = "android"))]
 use ipnetwork::IpNetwork;
@@ -34,8 +37,8 @@ type UdpFactory = AndroidUdpSocketFactory;
 type UdpFactory = UdpSocketFactory;
 
 type SinglehopDevice = DeviceHandle<(UdpFactory, Arc<tun07::AsyncDevice>, Arc<tun07::AsyncDevice>)>;
-type EntryDevice = DeviceHandle<(UdpFactory, PacketChannel, PacketChannel)>;
-type ExitDevice = DeviceHandle<(PacketChannel, Arc<AsyncDevice>, Arc<AsyncDevice>)>;
+type EntryDevice = DeviceHandle<(UdpFactory, TunChannelTx, TunChannelRx)>;
+type ExitDevice = DeviceHandle<(PacketChannelUdp, Arc<AsyncDevice>, Arc<AsyncDevice>)>;
 
 const PACKET_CHANNEL_CAPACITY: usize = 100;
 
@@ -104,12 +107,13 @@ struct AndroidUdpSocketFactory {
 #[cfg(target_os = "android")]
 impl UdpTransportFactory for AndroidUdpSocketFactory {
     type Send = <UdpSocketFactory as UdpTransportFactory>::Send;
-    type Recv = <UdpSocketFactory as UdpTransportFactory>::Recv;
+    type RecvV4 = <UdpSocketFactory as UdpTransportFactory>::RecvV4;
+    type RecvV6 = <UdpSocketFactory as UdpTransportFactory>::RecvV6;
 
     async fn bind(
         &mut self,
         params: &boringtun::udp::UdpTransportFactoryParams,
-    ) -> std::io::Result<((Self::Send, Self::Recv), (Self::Send, Self::Recv))> {
+    ) -> std::io::Result<((Self::Send, Self::RecvV4), (Self::Send, Self::RecvV6))> {
         let ((udp_v4_tx, udp_v4_rx), (udp_v6_tx, udp_v6_rx)) =
             UdpSocketFactory.bind(params).await?;
 
@@ -216,25 +220,32 @@ async fn create_devices(
     if let Some(exit_peer) = &config.exit_peer {
         // multihop
 
-        let source_v4 = config.tunnel.addresses.iter().find_map(|ip| match ip {
-            &IpAddr::V4(ipv4_addr) => Some(ipv4_addr),
-            IpAddr::V6(..) => None,
-        });
+        let source_v4 = config
+            .tunnel
+            .addresses
+            .iter()
+            .find_map(|ip| match ip {
+                &IpAddr::V4(ipv4_addr) => Some(ipv4_addr),
+                IpAddr::V6(..) => None,
+            })
+            .unwrap_or(Ipv4Addr::UNSPECIFIED);
 
-        let source_v6 = config.tunnel.addresses.iter().find_map(|ip| match ip {
-            &IpAddr::V6(ipv6_addr) => Some(ipv6_addr),
-            IpAddr::V4(..) => None,
-        });
+        let source_v6 = config
+            .tunnel
+            .addresses
+            .iter()
+            .find_map(|ip| match ip {
+                &IpAddr::V6(ipv6_addr) => Some(ipv6_addr),
+                IpAddr::V4(..) => None,
+            })
+            .unwrap_or(Ipv6Addr::UNSPECIFIED);
 
-        let channel = PacketChannel::new(
-            PACKET_CHANNEL_CAPACITY,
-            source_v4.unwrap_or(Ipv4Addr::UNSPECIFIED), // HACK: unwrap_or
-            source_v6.unwrap_or(Ipv6Addr::UNSPECIFIED), // HACK: unwrap_or
-        );
+        let (tun_tx, tun_rx, udp_channels) =
+            get_packet_channels(PACKET_CHANNEL_CAPACITY, source_v4, source_v6);
 
         let (exit_api, exit_api_server) = ApiServer::new();
-        let exit_device = DeviceHandle::<(PacketChannel, Arc<AsyncDevice>, Arc<AsyncDevice>)>::new(
-            channel.clone(),
+        let exit_device = ExitDevice::new(
+            udp_channels,
             async_tun.clone(),
             async_tun,
             DeviceConfig {
@@ -249,8 +260,7 @@ async fn create_devices(
         #[cfg(not(target_os = "android"))]
         let factory = UdpSocketFactory;
 
-        let entry_device =
-            EntryDevice::new(factory, channel.clone(), channel, boringtun_entry_config).await;
+        let entry_device = EntryDevice::new(factory, tun_tx, tun_rx, boringtun_entry_config).await;
 
         let private_key = &config.tunnel.private_key;
         let peer = &config.entry_peer;
diff --git a/test/Cargo.lock b/test/Cargo.lock
index af17315717..bcd4ba6412 100644
--- a/test/Cargo.lock
+++ b/test/Cargo.lock
@@ -227,7 +227,7 @@ dependencies = [
  "pin-project-lite",
  "rustversion",
  "serde",
- "sync_wrapper 1.0.1",
+ "sync_wrapper",
  "tower 0.4.13",
  "tower-layer",
  "tower-service",
@@ -248,7 +248,7 @@ dependencies = [
  "mime",
  "pin-project-lite",
  "rustversion",
- "sync_wrapper 1.0.1",
+ "sync_wrapper",
  "tower-layer",
  "tower-service",
 ]
@@ -1385,13 +1385,14 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "1.4.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "futures-channel",
- "futures-util",
+ "futures-core",
  "h2 0.4.6",
  "http 1.1.0",
  "http-body",
@@ -1399,6 +1400,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
+ "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -1438,18 +1440,23 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.9"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41296eb09f183ac68eec06e03cdbea2e759633d4067b2f6552fc2e009bcad08b"
+checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e"
 dependencies = [
+ "base64 0.22.0",
  "bytes",
  "futures-channel",
+ "futures-core",
  "futures-util",
  "http 1.1.0",
  "http-body",
  "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.8",
+ "socket2 0.6.0",
  "tokio",
  "tower-service",
  "tracing",
@@ -1731,6 +1738,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "iri-string"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
 name = "itertools"
 version = "0.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2117,7 +2134,7 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.0",
  "tokio-socks",
- "tower 0.5.1",
+ "tower 0.5.2",
  "uuid",
  "vec1",
 ]
@@ -2167,7 +2184,7 @@ dependencies = [
  "tokio",
  "tonic",
  "tonic-build",
- "tower 0.5.1",
+ "tower 0.5.2",
  "vec1",
 ]
 
@@ -3011,9 +3028,9 @@ checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "reqwest"
-version = "0.12.9"
+version = "0.12.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77c62af46e79de0a562e1a9849205ffcb7fc1238876e9bd743357570e04046f"
+checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
 dependencies = [
  "base64 0.22.0",
  "bytes",
@@ -3026,30 +3043,27 @@ dependencies = [
  "hyper",
  "hyper-rustls",
  "hyper-util",
- "ipnet",
  "js-sys",
  "log",
- "mime",
- "once_cell",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
  "rustls 0.23.18",
- "rustls-pemfile 2.1.3",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 1.0.1",
+ "sync_wrapper",
  "tokio",
  "tokio-rustls 0.26.0",
+ "tower 0.5.2",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 0.26.6",
- "windows-registry",
+ "webpki-roots 1.0.2",
 ]
 
 [[package]]
@@ -3500,6 +3514,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "socket2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
 name = "socks-server"
 version = "0.0.0"
 dependencies = [
@@ -3605,12 +3629,6 @@ dependencies = [
 
 [[package]]
 name = "sync_wrapper"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
-
-[[package]]
-name = "sync_wrapper"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
@@ -3776,7 +3794,7 @@ dependencies = [
  "tokio-serial",
  "tokio-util",
  "tonic",
- "tower 0.5.1",
+ "tower 0.5.2",
  "tun",
  "uuid",
 ]
@@ -4188,14 +4206,33 @@ dependencies = [
 
 [[package]]
 name = "tower"
-version = "0.5.1"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2873938d487c3cfb9aed7546dc9f2711d867c9f90c46b889989a2cb84eba6b4f"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper 0.1.2",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+dependencies = [
+ "bitflags 2.6.0",
+ "bytes",
+ "futures-util",
+ "http 1.1.0",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower 0.5.2",
  "tower-layer",
  "tower-service",
 ]
@@ -4545,6 +4582,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "webpki-roots"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
 name = "widestring"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4591,26 +4637,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows-registry"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e400001bb720a623c1c69032f8e3e4cf09984deec740f007dd2b03ec864804b0"
-dependencies = [
- "windows-result",
- "windows-strings",
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
 name = "windows-service"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4622,16 +4648,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "windows-strings"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
-dependencies = [
- "windows-result",
- "windows-targets 0.52.6",
-]
-
-[[package]]
 name = "windows-sys"
 version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/test/connection-checker/Cargo.toml b/test/connection-checker/Cargo.toml
index 9ab2b3fb5b..a0b5e7fbae 100644
--- a/test/connection-checker/Cargo.toml
+++ b/test/connection-checker/Cargo.toml
@@ -15,6 +15,6 @@ clap = { workspace = true, features = ["derive"] }
 color-eyre = "0.6.2"
 eyre = "0.6.12"
 ping = "0.5.2"
-reqwest = { version = "0.12.7", default-features = false, features = ["blocking", "rustls-tls", "json"] }
+reqwest = { version = "0.12.23", default-features = false, features = ["blocking", "rustls-tls", "json"] }
 serde = { workspace = true, features = ["derive"] }
 socket2 = { workspace = true, features = ["all"] }
diff --git a/test/deny.toml b/test/deny.toml
index 70584012e1..643fa355c5 100644
--- a/test/deny.toml
+++ b/test/deny.toml
@@ -44,7 +44,8 @@ allow = [
     "LicenseRef-ring",
     "Unicode-DFS-2016",
     "Zlib",
-    "Unicode-3.0"
+    "Unicode-3.0",
+    "CDLA-Permissive-2.0"
 ]
 
 [[licenses.clarify]]