diff --git a/.buildkite/linux/entrypoint b/.buildkite/linux/entrypoint
index 4c656aa5c..9ac2d6f84 100755
--- a/.buildkite/linux/entrypoint
+++ b/.buildkite/linux/entrypoint
@@ -23,7 +23,7 @@ echo "--- Ensure libs importable"
 SKIP_RUN=1 ./run
 
 echo "--- Check Rust libs"
-cargo install cargo-deny --version 0.14.24
+cargo install cargo-deny --version 0.18.6
 cargo deny check
 
 echo "--- Cleanup"
diff --git a/.deny.toml b/.deny.toml
index 7cdf0cf99..6d060caf7 100644
--- a/.deny.toml
+++ b/.deny.toml
@@ -7,6 +7,8 @@ db-urls = ["https://github.com/rustsec/advisory-db"]
 ignore = [
   # burn depends on an unmaintained package 'paste'
   "RUSTSEC-2024-0436",
+  # removing rustls-pemfile requires an update to our linkcheck fork
+  "RUSTSEC-2025-0134",
 ]
 
 [licenses]
diff --git a/Cargo.lock b/Cargo.lock
index e9c74f6ea..0e727627a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -115,6 +115,8 @@ dependencies = [
  "hex",
  "htmlescape",
  "hyper 1.7.0",
+ "icu_properties",
+ "icu_properties_data",
  "id_tree",
  "inflections",
  "itertools 0.14.0",
@@ -133,9 +135,9 @@ dependencies = [
  "rand 0.9.2",
  "rayon",
  "regex",
- "reqwest 0.12.23",
+ "reqwest 0.12.28",
  "rusqlite",
- "rustls-pemfile 2.2.0",
+ "rustls-pki-types",
  "scopeguard",
  "serde",
  "serde-aux",
@@ -153,7 +155,6 @@ dependencies = [
  "tracing",
  "tracing-appender",
  "tracing-subscriber",
- "unic-ucd-category",
  "unicase",
  "unicode-normalization",
  "windows 0.61.3",
@@ -3191,9 +3192,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -3204,9 +3205,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -3217,11 +3218,10 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
 dependencies = [
- "displaydoc",
  "icu_collections",
  "icu_normalizer_data",
  "icu_properties",
@@ -3232,42 +3232,38 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
 
 [[package]]
 name = "icu_properties"
-version = "2.0.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "016c619c1eeb94efb86809b015c58f479963de65bdb6253345c1a1276f22e32b"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
 dependencies = [
- "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
  "icu_provider",
- "potential_utf",
  "zerotrie",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_properties_data"
-version = "2.0.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "298459143998310acd25ffe6810ed544932242d3f07083eee1084d83a71bd632"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
 
 [[package]]
 name = "icu_provider"
-version = "2.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
- "stable_deref_trait",
- "tinystr",
  "writeable",
  "yoke 0.8.0",
  "zerofrom",
@@ -3672,7 +3668,7 @@ dependencies = [
  "itertools 0.14.0",
  "linkcheck",
  "regex",
- "reqwest 0.12.23",
+ "reqwest 0.12.28",
  "strum 0.27.2",
  "tokio",
 ]
@@ -3856,12 +3852,6 @@ dependencies = [
  "regex-automata",
 ]
 
-[[package]]
-name = "matches"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
-
 [[package]]
 name = "matchit"
 version = "0.8.4"
@@ -4136,7 +4126,7 @@ dependencies = [
  "maplit",
  "num_cpus",
  "regex",
- "reqwest 0.12.23",
+ "reqwest 0.12.28",
  "serde_json",
  "sha2",
  "walkdir",
@@ -5408,7 +5398,7 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls-pemfile 1.0.4",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -5426,9 +5416,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.12.23"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d429f34c8092b2d42c7c93cec323bb4adeb7c67698f70839adec842ec10c7ceb"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -5556,7 +5546,7 @@ dependencies = [
  "clap",
  "flate2",
  "junction",
- "reqwest 0.12.23",
+ "reqwest 0.12.28",
  "sha2",
  "tar",
  "termcolor",
@@ -5656,20 +5646,11 @@ dependencies = [
  "base64 0.21.7",
 ]
 
-[[package]]
-name = "rustls-pemfile"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "rustls-pki-types"
-version = "1.12.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
+checksum = "21e6f2ab2928ca4291b86736a8bd920a277a399bba1589409d72154ff87c1282"
 dependencies = [
  "web-time",
  "zeroize",
@@ -5807,10 +5788,11 @@ checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
 dependencies = [
+ "serde_core",
  "serde_derive",
 ]
 
@@ -5846,10 +5828,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde_derive"
-version = "1.0.219"
+name = "serde_core"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6667,9 +6658,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
  "bitflags 2.9.3",
  "bytes",
@@ -6844,27 +6835,6 @@ dependencies = [
  "yoke 0.7.5",
 ]
 
-[[package]]
-name = "unic-char-property"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221"
-dependencies = [
- "unic-char-range",
-]
-
-[[package]]
-name = "unic-char-range"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc"
-
-[[package]]
-name = "unic-common"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc"
-
 [[package]]
 name = "unic-langid"
 version = "0.9.6"
@@ -6908,27 +6878,6 @@ dependencies = [
  "unic-langid-impl",
 ]
 
-[[package]]
-name = "unic-ucd-category"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8d4591f5fcfe1bd4453baaf803c40e1b1e69ff8455c47620440b46efef91c0"
-dependencies = [
- "matches",
- "unic-char-property",
- "unic-char-range",
- "unic-ucd-version",
-]
-
-[[package]]
-name = "unic-ucd-version"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4"
-dependencies = [
- "unic-common",
-]
-
 [[package]]
 name = "unicase"
 version = "2.6.0"
@@ -7971,9 +7920,9 @@ dependencies = [
 
 [[package]]
 name = "writeable"
-version = "0.6.1"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 
 [[package]]
 name = "xattr"
@@ -8029,7 +7978,6 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
 dependencies = [
- "serde",
  "stable_deref_trait",
  "yoke-derive 0.8.0",
  "zerofrom",
diff --git a/Cargo.toml b/Cargo.toml
index fe7f5acd5..fc9a6cdf2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -85,6 +85,8 @@ globset = "0.4.16"
 hex = "0.4.3"
 htmlescape = "0.3.1"
 hyper = "1"
+icu_properties = "2.1.2"
+icu_properties_data = "2.1.2"
 id_tree = "1.8.0"
 inflections = "1.1.1"
 intl-memoizer = "0.5.3"
@@ -112,9 +114,9 @@ pyo3 = { version = "0.25.1", features = ["extension-module", "abi3", "abi3-py39"
 rand = "0.9.1"
 rayon = "1.10.0"
 regex = "1.11.1"
-reqwest = { version = "0.12.20", default-features = false, features = ["json", "socks", "stream", "multipart"] }
+reqwest = { version = "0.12.28", default-features = false, features = ["json", "socks", "stream", "multipart"] }
 rusqlite = { version = "0.36.0", features = ["trace", "functions", "collation", "bundled"] }
-rustls-pemfile = "2.2.0"
+rustls-pki-types = "1.13.2"
 scopeguard = "1.2.0"
 serde = { version = "1.0.219", features = ["derive"] }
 serde-aux = "4.7.0"
@@ -136,7 +138,6 @@ tracing = { version = "0.1.41", features = ["max_level_trace", "release_max_leve
 tracing-appender = "0.2.3"
 tracing-subscriber = { version = "0.3.20", features = ["fmt", "env-filter"] }
 unic-langid = { version = "0.9.6", features = ["macros"] }
-unic-ucd-category = "0.9.0"
 unicode-normalization = "0.1.24"
 walkdir = "2.5.0"
 which = "8.0.0"
diff --git a/cargo/licenses.json b/cargo/licenses.json
index 53b832fda..f50fae00a 100644
--- a/cargo/licenses.json
+++ b/cargo/licenses.json
@@ -2215,14 +2215,6 @@
     "name": "matchers",
     "repository": "https://github.com/hawkw/matchers"
   },
-  {
-    "authors": null,
-    "description": "A macro to evaluate, as a boolean, whether an expression matches a pattern.",
-    "license": "MIT",
-    "license_file": null,
-    "name": "matches",
-    "repository": "https://github.com/SimonSapin/rust-std-candidates"
-  },
   {
     "authors": "Ibraheem Ahmed <ibraheem@ibraheem.ca>",
     "description": "A high performance, zero-copy URL router.",
@@ -3263,14 +3255,6 @@
     "name": "rustls-native-certs",
     "repository": "https://github.com/rustls/rustls-native-certs"
   },
-  {
-    "authors": null,
-    "description": "Basic .pem file parser for keys and certificates",
-    "license": "Apache-2.0 OR ISC OR MIT",
-    "license_file": null,
-    "name": "rustls-pemfile",
-    "repository": "https://github.com/rustls/pemfile"
-  },
   {
     "authors": null,
     "description": "Shared types for the rustls PKI ecosystem",
@@ -3431,6 +3415,14 @@
     "name": "serde_bytes",
     "repository": "https://github.com/serde-rs/bytes"
   },
+  {
+    "authors": "Erick Tryzelaar <erick.tryzelaar@gmail.com>|David Tolnay <dtolnay@gmail.com>",
+    "description": "Serde traits only, with no support for derive -- use the `serde` crate instead",
+    "license": "Apache-2.0 OR MIT",
+    "license_file": null,
+    "name": "serde_core",
+    "repository": "https://github.com/serde-rs/serde"
+  },
   {
     "authors": "Erick Tryzelaar <erick.tryzelaar@gmail.com>|David Tolnay <dtolnay@gmail.com>",
     "description": "Macros 1.1 implementation of #[derive(Serialize, Deserialize)]",
@@ -4071,30 +4063,6 @@
     "name": "ug",
     "repository": "https://github.com/LaurentMazare/ug"
   },
-  {
-    "authors": "The UNIC Project Developers",
-    "description": "UNIC — Unicode Character Tools — Character Property taxonomy, contracts and build macros",
-    "license": "Apache-2.0 OR MIT",
-    "license_file": null,
-    "name": "unic-char-property",
-    "repository": "https://github.com/open-i18n/rust-unic/"
-  },
-  {
-    "authors": "The UNIC Project Developers",
-    "description": "UNIC — Unicode Character Tools — Character Range and Iteration",
-    "license": "Apache-2.0 OR MIT",
-    "license_file": null,
-    "name": "unic-char-range",
-    "repository": "https://github.com/open-i18n/rust-unic/"
-  },
-  {
-    "authors": "The UNIC Project Developers",
-    "description": "UNIC — Common Utilities",
-    "license": "Apache-2.0 OR MIT",
-    "license_file": null,
-    "name": "unic-common",
-    "repository": "https://github.com/open-i18n/rust-unic/"
-  },
   {
     "authors": "Zibi Braniecki <gandalf@mozilla.com>",
     "description": "API for managing Unicode Language Identifiers",
@@ -4127,22 +4095,6 @@
     "name": "unic-langid-macros-impl",
     "repository": "https://github.com/zbraniecki/unic-locale"
   },
-  {
-    "authors": "The UNIC Project Developers",
-    "description": "UNIC — Unicode Character Database — General Category",
-    "license": "Apache-2.0 OR MIT",
-    "license_file": null,
-    "name": "unic-ucd-category",
-    "repository": "https://github.com/open-i18n/rust-unic/"
-  },
-  {
-    "authors": "The UNIC Project Developers",
-    "description": "UNIC — Unicode Character Database — Version",
-    "license": "Apache-2.0 OR MIT",
-    "license_file": null,
-    "name": "unic-ucd-version",
-    "repository": "https://github.com/open-i18n/rust-unic/"
-  },
   {
     "authors": "Sean McArthur <sean@seanmonstar.com>",
     "description": "A case-insensitive wrapper around strings.",
diff --git a/rslib/Cargo.toml b/rslib/Cargo.toml
index 9be9e8d87..4c06a0afd 100644
--- a/rslib/Cargo.toml
+++ b/rslib/Cargo.toml
@@ -68,6 +68,8 @@ futures.workspace = true
 hex.workspace = true
 htmlescape.workspace = true
 hyper.workspace = true
+icu_properties.workspace = true
+icu_properties_data.workspace = true
 id_tree.workspace = true
 itertools.workspace = true
 nom.workspace = true
@@ -85,7 +87,7 @@ rayon.workspace = true
 regex.workspace = true
 reqwest.workspace = true
 rusqlite.workspace = true
-rustls-pemfile.workspace = true
+rustls-pki-types.workspace = true
 scopeguard.workspace = true
 serde.workspace = true
 serde-aux.workspace = true
@@ -102,7 +104,6 @@ tower-http.workspace = true
 tracing.workspace = true
 tracing-appender.workspace = true
 tracing-subscriber.workspace = true
-unic-ucd-category.workspace = true
 unicase.workspace = true
 unicode-normalization.workspace = true
 zip.workspace = true
diff --git a/rslib/src/backend/mod.rs b/rslib/src/backend/mod.rs
index d15652675..d68ac2dcd 100644
--- a/rslib/src/backend/mod.rs
+++ b/rslib/src/backend/mod.rs
@@ -140,10 +140,9 @@ impl Backend {
 
     #[cfg(feature = "rustls")]
     fn set_custom_certificate_inner(&self, cert_str: String) -> Result<()> {
-        use std::io::Cursor;
-        use std::io::Read;
-
         use reqwest::Certificate;
+        use rustls_pki_types::pem::PemObject;
+        use rustls_pki_types::PrivateKeyDer;
 
         let mut web_client = self.web_client.lock().unwrap();
 
@@ -152,7 +151,7 @@ impl Backend {
             return Ok(());
         }
 
-        if rustls_pemfile::read_all(Cursor::new(cert_str.as_bytes()).by_ref()).count() != 1 {
+        if PrivateKeyDer::from_pem_slice(cert_str.as_bytes()).is_err() {
             return Err(AnkiError::InvalidCertificateFormat);
         }
 
diff --git a/rslib/src/media/files.rs b/rslib/src/media/files.rs
index b098eb19e..0b22471eb 100644
--- a/rslib/src/media/files.rs
+++ b/rslib/src/media/files.rs
@@ -18,11 +18,12 @@ use anki_io::write_file;
 use anki_io::FileIoError;
 use anki_io::FileIoSnafu;
 use anki_io::FileOp;
+use icu_properties::props::EnumeratedProperty;
+use icu_properties::props::GeneralCategory;
 use regex::Regex;
 use sha1::Digest;
 use sha1::Sha1;
 use tracing::debug;
-use unic_ucd_category::GeneralCategory;
 use unicode_normalization::is_nfc;
 use unicode_normalization::UnicodeNormalization;
 
@@ -76,7 +77,7 @@ fn disallowed_char(char: char) -> bool {
         '[' | ']' | '<' | '>' | ':' | '"' | '/' | '?' | '*' | '^' | '\\' | '|' => true,
         c if c.is_ascii_control() => true,
         // Macs do not allow invalid Unicode characters like 05F8 to be in a filename.
-        c if GeneralCategory::of(c) == GeneralCategory::Unassigned => true,
+        c if GeneralCategory::for_char(c) == GeneralCategory::Unassigned => true,
         _ => false,
     }
 }
diff --git a/rslib/src/typeanswer.rs b/rslib/src/typeanswer.rs
index 9bf3dc47c..81dfa0296 100644
--- a/rslib/src/typeanswer.rs
+++ b/rslib/src/typeanswer.rs
@@ -5,8 +5,10 @@ use std::borrow::Cow;
 use std::sync::LazyLock;
 
 use difflib::sequencematcher::SequenceMatcher;
+use icu_properties::props::EnumeratedProperty;
+use icu_properties::props::GeneralCategory;
+use icu_properties::props::GeneralCategoryGroup;
 use regex::Regex;
-use unic_ucd_category::GeneralCategory;
 use unicode_normalization::char::is_combining_mark;
 use unicode_normalization::UnicodeNormalization;
 
@@ -140,7 +142,7 @@ fn isolate_leading_mark(text: &str) -> Cow<'_, str> {
     if text
         .chars()
         .next()
-        .is_some_and(|c| GeneralCategory::of(c).is_mark())
+        .is_some_and(|c| GeneralCategoryGroup::Mark.contains(GeneralCategory::for_char(c)))
     {
         Cow::Owned(format!("\u{a0}{text}"))
     } else {