fix: align with magellan 4.13 (schema v20, MIR extraction)

- Bump magellan dependency 4.8.0 -> 4.13
- Bump version 1.9.1 -> 1.10.0
- Ignore RUSTSEC-2026-0190 (thiserror v1 transitive, unreachable path)

Author: oldnordic

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Mirage are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.10.0] - 2026-07-03
+
+### Changed
+
+- **Dependency: magellan 4.8.0 → 4.13** (`Cargo.toml`): aligns mirage with
+  the current magellan release (4.13.0 — content search FTS5, MIR-based Rust
+  CFG extraction, schema v20). Mirage reads magellan DBs via `CodeGraph::open()`
+  which auto-migrates the schema; no code changes needed for v20 compatibility.
+- **cargo-deny: ignore RUSTSEC-2026-0190** (`deny.toml`): thiserror v1.0.69
+  `downcast_mut()` unsoundness. Pulled transitively via magellan; we use
+  thiserror v2 and never call `downcast_mut()`.
+
 ## [Unreleased]
 
 ## [1.9.1] - 2026-06-22

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "mirage-analyzer"
-version = "1.9.1"
+version = "1.10.0"
 edition = "2021"
 rust-version = "1.70"
 authors = ["Mirage Contributors"]
@@ -28,7 +28,7 @@ clap = { version = "4.5", features = ["derive", "env"] }
 rusqlite = { version = "0.31", features = ["bundled"] }
 
 # Magellan for inter-procedural analysis (required for CFG data)
-magellan = { version = "4.8.0", default-features = false, features = ["sqlite-backend"] }
+magellan = { version = "4.13", default-features = false, features = ["sqlite-backend"] }
 
 # sqlitegraph for GraphBackend trait
 sqlitegraph = { version = "3.3.1", default-features = false, features = ["sqlite-backend"] }

Cargo.toml

@@ -30,6 +30,10 @@ ignore = [
     "RUSTSEC-2026-0008",
     "RUSTSEC-2025-0141",
     "RUSTSEC-2025-0119",
+    # RUSTSEC-2026-0190: thiserror v1.0.69 Error::downcast_mut() unsoundness
+    #   We never call downcast_mut on error types. thiserror v1 is pulled in
+    #   transitively via magellan; our own code uses thiserror v2.
+    "RUSTSEC-2026-0190",
 ]
 
 [licenses]