[dependabot]

Bumps the all group with 6 updates:

Package	From	To
harfrust	0.13.3	0.15.0
accesskit	0.25.1	0.25.2
objc2	0.6.4	0.6.5
accesskit_macos	0.27.1	0.27.2
accesskit_windows	0.35.1	0.35.2
ksni	0.3.6	0.3.7

Updates harfrust from 0.13.3 to 0.15.0

Release notes

Sourced from harfrust's releases.

0.15.0

This release matches HarfBuzz v15.0.0, and has an MSRV (minimum supported Rust version) of 1.85.

Breaking changes

• Update read-fonts to 0.46. Font and the rest of the font model that HarfRust re-exports come from that release.
• ShapePlanKey::new borrows the font for the lifetime of the key. A plan built for a font with lookup variations matches only keys at the same location.

Added

• Shape fonts with more than 65,535 glyphs, as specified by ISO/IEC 14496-22:2026: GSUB and GPOS 1.2, GDEF 1.4, the 24-bit coverage and class definition formats, and the extended format of every lookup subtable.
• Apply FeatureVariations 1.1 lookup variations.
• Select feature variations at the default location, whose zero coordinates can satisfy a condition.
• Add opt-in tracing support with Buffer::set_message_function callbacks and hr-shape --trace output, including intermediate Unicode and glyph contents. Tracing also works without std and compiles out when disabled.
• Extend the C API with subsetting backed by Skera (the subset feature), glyph drawing and painting backed by Skrifa (draw and paint), HarfBuzz C++ ownership helpers, MATH and baseline queries, the set and map APIs, OpenType tag conversion, glyph collection for sets and lookups, face metadata and table enumeration, UTF-16 and Latin-1 buffer input, and batched nominal glyph callbacks.

Changed

• Parse each lookup once per font and keep it, with the font's GSUB, GPOS, GDEF and AAT tables, alongside the font data. Creating a ShaperFont reads no tables.
• Keep parsed morx, mort, kern and kerx subtables with the font's tables, and build each AAT table's cache when it is first applied. AAT shaping is 5 to 13% faster.
• Bound the preprocessing of a font's lookups by work and memory budgets that scale with the size of its layout tables and are shared by GSUB, GPOS and GDEF. Long contextual coverage arrays are read on demand.
• Reduce code size by replacing the standard library sorts with small heap and insertion sorts, sharing AAT class-set collection, and returning Option from buffer lookups instead of panicking.

Fixed

• Reject GSUB/GPOS lookups with an out-of-range lookupType instead of truncating it to u8. A malformed font could have e.g. type 3586 dispatched as MultipleSubst, expanding a single character into thousands of glyphs and costing up to a second per shape call. HarfBuzz rejects such tables.

... (truncated)

Changelog

Sourced from harfrust's changelog.

[0.15.0] - 2026-10-21

This release matches HarfBuzz v15.0.0, and has an MSRV (minimum supported Rust version) of 1.85.

Breaking changes

• Update read-fonts to 0.46. Font and the rest of the font model that HarfRust re-exports come from that release.
• ShapePlanKey::new borrows the font for the lifetime of the key. A plan built for a font with lookup variations matches only keys at the same location.

Added

• Shape fonts with more than 65,535 glyphs, as specified by ISO/IEC 14496-22:2026: GSUB and GPOS 1.2, GDEF 1.4, the 24-bit coverage and class definition formats, and the extended format of every lookup subtable.
• Apply FeatureVariations 1.1 lookup variations.
• Select feature variations at the default location, whose zero coordinates can satisfy a condition.
• Add opt-in tracing support with Buffer::set_message_function callbacks and hr-shape --trace output, including intermediate Unicode and glyph contents. Tracing also works without std and compiles out when disabled.
• Extend the C API with subsetting backed by Skera (the subset feature), glyph drawing and painting backed by Skrifa (draw and paint), HarfBuzz C++ ownership helpers, MATH and baseline queries, the set and map APIs, OpenType tag conversion, glyph collection for sets and lookups, face metadata and table enumeration, UTF-16 and Latin-1 buffer input, and batched nominal glyph callbacks.

Changed

• Parse each lookup once per font and keep it, with the font's GSUB, GPOS, GDEF and AAT tables, alongside the font data. Creating a ShaperFont reads no tables.
• Keep parsed morx, mort, kern and kerx subtables with the font's tables, and build each AAT table's cache when it is first applied. AAT shaping is 5 to 13% faster.
• Bound the preprocessing of a font's lookups by work and memory budgets that scale with the size of its layout tables and are shared by GSUB, GPOS and GDEF. Long contextual coverage arrays are read on demand.
• Reduce code size by replacing the standard library sorts with small heap and insertion sorts, sharing AAT class-set collection, and returning Option from buffer lookups instead of panicking.

Fixed

• Reject GSUB/GPOS lookups with an out-of-range lookupType instead of truncating it to u8. A malformed font could have e.g. type 3586 dispatched

... (truncated)

Commits

• 71d9651 Release 0.15.0 (#564)
• ae198ac Fix clippy without the tracing feature, and lint that build in CI (#563)
• 9959177 Merge pull request #542 from harfbuzz/feat/beyond-64k
• 88d8525 [ot] Charge boxed subtable payloads to the preprocessing budget
• f32b9c1 [aat] Keep deleted glyphs in the buffer accelerators
• fbdb8b5 [aat] Keep parsed subtables with the font's tables
• 6b7e16e [tests] Regenerate shaping tests from HarfBuzz main
• 10b4a42 Apply lookup variations, with feature variations from read-fonts
• 8001cea Support beyond-64K fonts with read-fonts 0.46
• dfa9693 [shape] Select feature variations at the default location (#560)
• Additional commits viewable in compare view

Updates accesskit from 0.25.1 to 0.25.2

Release notes

Sourced from accesskit's releases.

accesskit: v0.25.2

0.25.2 (2026-10-25)

Bug Fixes

• Avoid disclosing the content of password inputs (#841) (d62a496)

Commits

• f302622 chore: release main (#814)
• 2b57c6f chore: Pin GitHub Actions to commit hashes (#842)
• d62a496 fix: Avoid disclosing the content of password inputs (#841)
• 9671c2d fix: Fully drop iOS SubclassingAdapter if KVO is detected (#839)
• bcfd3de deps: Update tokio to 1.54.1, tokio-stream to 1.0.19 (#838)
• 451885c fix: Fully drop macOS SubclassingAdapter if KVO is detected (#835)
• a39329d chore: Ignore some unmaintained dependencies of zbus (#834)
• d410563 chore: Clarify the contributing process in the README (#833)
• 0342036 chore: Explain the new contributing rules (#832)
• 8f44f1c chore: Expand the shared example into a realistic application (#825)
• Additional commits viewable in compare view

Updates objc2 from 0.6.4 to 0.6.5

Commits

• d7d2fa2 Bump objc2 0.6.4 -> 0.6.5
• ed5d37c Cherry-pick #862 for objc2 v0.6.5
• See full diff in compare view

Updates accesskit_macos from 0.27.1 to 0.27.2

Release notes

Sourced from accesskit_macos's releases.

accesskit_macos: v0.27.2

0.27.2 (2026-10-25)

Bug Fixes

• Fully drop macOS SubclassingAdapter if KVO is detected (#835) (451885c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • accesskit bumped from 0.25.1 to 0.25.2
    • accesskit_consumer bumped from 0.39.1 to 0.39.2

Commits

• f302622 chore: release main (#814)
• 2b57c6f chore: Pin GitHub Actions to commit hashes (#842)
• d62a496 fix: Avoid disclosing the content of password inputs (#841)
• 9671c2d fix: Fully drop iOS SubclassingAdapter if KVO is detected (#839)
• bcfd3de deps: Update tokio to 1.54.1, tokio-stream to 1.0.19 (#838)
• 451885c fix: Fully drop macOS SubclassingAdapter if KVO is detected (#835)
• a39329d chore: Ignore some unmaintained dependencies of zbus (#834)
• d410563 chore: Clarify the contributing process in the README (#833)
• 0342036 chore: Explain the new contributing rules (#832)
• 8f44f1c chore: Expand the shared example into a realistic application (#825)
• Additional commits viewable in compare view

Updates accesskit_windows from 0.35.1 to 0.35.2

Release notes

Sourced from accesskit_windows's releases.

accesskit_windows: v0.35.2

0.35.2 (2026-10-25)

Bug Fixes

• Avoid disclosing the content of password inputs (#841) (d62a496)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • accesskit bumped from 0.25.1 to 0.25.2
    • accesskit_consumer bumped from 0.39.1 to 0.39.2

Commits

• f302622 chore: release main (#814)
• 2b57c6f chore: Pin GitHub Actions to commit hashes (#842)
• d62a496 fix: Avoid disclosing the content of password inputs (#841)
• 9671c2d fix: Fully drop iOS SubclassingAdapter if KVO is detected (#839)
• bcfd3de deps: Update tokio to 1.54.1, tokio-stream to 1.0.19 (#838)
• 451885c fix: Fully drop macOS SubclassingAdapter if KVO is detected (#835)
• a39329d chore: Ignore some unmaintained dependencies of zbus (#834)
• d410563 chore: Clarify the contributing process in the README (#833)
• 0342036 chore: Explain the new contributing rules (#832)
• 8f44f1c chore: Expand the shared example into a realistic application (#825)
• Additional commits viewable in compare view

Updates ksni from 0.3.6 to 0.3.7

Changelog

Sourced from ksni's changelog.

0.3.7 (2026-10-20)

Added

• ksni::current_xdg_activation_token, returns the XDG activation token of the current event

Commits

• 2397cc2 Enable node feature in docs.rs
• fa5bafd Update gtk4 requirement from 0.9 to 0.11
• 47d2334 Add token retry to example and doc
• cd9b7cc Add comment references
• 4e6d84d Bump version to 0.3.7, update CHANGELOG
• 7bb0c8f Fix CI
• ccc3cb0 Add XDG activation token example
• 6183720 Filter out old tokens
• 57b274d Fix the doc about XDG token in GNOME
• 0347682 Remove unused task local var
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions