build: bump to 2.0.3 and update dependencies

Clear the advisories that cargo audit reports against the lockfile.

- Update rustls, quinn-proto and ctutils to their fixed releases.
- Move zip to 9, whose ZipFile::name() now returns a Result.
- Add the 2.0.3 entry to the changelog.

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.0.3] - 2026-11-04
+
+### Changed
+- Updated dependencies, including `zip` 9.
+
+### Security
+- Updated `rustls`, `quinn-proto` and `ctutils` to releases that fix known vulnerabilities.
+- Moved to `zip` 9, which fixes known vulnerabilities in archive extraction. `selfupdate` reads the binary out of the archive directly and was not affected.
+
 ## [2.0.2] - 2026-09-04
 
 ### Added

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mdrs-client-rust"
-version = "2.0.2"
+version = "2.0.3"
 edition = "2024"
 license = "MIT"
 authors = ["Neuroinformatics Unit, RIKEN CBS"]
@@ -32,5 +32,5 @@ unicode-normalization = "0.1"
 self-replace = "1"
 tar = "0.4.46"
 flate2 = "1"
-zip = "8.6.0"
+zip = "9.3.0"
 tempfile = "3"

src/commands/selfupdate.rs

@@ -103,7 +103,7 @@ fn extract_from_zip(archive_path: &Path, bin_name: &str, dest_path: &Path) -> an
 
     for i in 0..archive.len() {
         let mut entry = archive.by_index(i)?;
-        let entry_name = entry.name().to_owned();
+        let entry_name = entry.name()?.into_owned();
         let file_name = Path::new(&entry_name)
             .file_name()
             .and_then(|n| n.to_str())