build(deps): bump the cargo-minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the cargo-minor-and-patch group with 5 updates in the / directory:

Package	From	To
serde	1.0.228	1.0.229
blake3	1.8.4	1.8.7
chrono	0.4.44	0.4.45
dioxus	0.7.4	0.7.10
serde_json	1.0.149	1.0.151

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates blake3 from 1.8.4 to 1.8.7

Release notes

Sourced from blake3's releases.

1.8.7

version 1.8.7

Changes since 1.8.6:

• Remove the arrayref dependency. Unfortunately the crates.io owner was compromised.

1.8.6

version 1.8.6

Changes since 1.8.5:

• update_mmap and update_mmap_rayon (and by extension b3sum) now use seek rather than metadata to get the length of a file/mapping, and they tolerate mmap failures. That means b3sum will now memory map e.g. Linux block devices, which support mapping despite reporting length 0 in metadata. Hashing NUL files on Windows also works now, where previously it was an error unless you used --no-mmap or <. This change was originally proposed by @​nabijaczleweli.

1.8.5

version 1.8.5

Changes since 1.8.4:

• Forcibly disable LTO when compiling C intrinsics from the Rust build. This fixes a build break on Arch Linux ARM: BLAKE3-team/BLAKE3#550

Commits

• f3149ec version 1.8.7
• b65bcb7 add #[allow(deprecated)] annotations to fix nightly/beta warnings
• 483a220 fix warnings related to not using MAX constants
• ba02549 Codex: remove arrayref
• 77b257e version 1.8.6
• 83b1746 use seek instead of metadata to establish mmap length (#570)
• 9eac279 use vswhere to find Visual Studio in CI
• fc3d0e9 Fix path to Visual Studio toolchain in CI
• 8aa5145 a few more colons
• 6bb9773 use cargo:: build script syntax
• Additional commits viewable in compare view

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in chronotope/chrono#1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in chronotope/chrono#1789

Commits

• 1703382 Prepare 0.4.45 release
• 881f9ab tz_data: fix tzdata locations on Android
• f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
• c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
• 120686c Bump codecov/codecov-action from 5 to 6
• See full diff in compare view

Updates dioxus from 0.7.4 to 0.7.10

Release notes

Sourced from dioxus's releases.

v0.7.10

What's Changed

• [v0.7] Fix hotpatching when the bin target's crate name differs from the package name by @​nicoburns in DioxusLabs/dioxus#5720

Full Changelog: DioxusLabs/dioxus@v0.7.9...v0.7.10

v0.7.9

This release fixes an issue where dx --version would use an outdated git SHA, and dioxus-cli installed from cargo install would not have a version at all, preventing self-update from functioning properly.

Full Changelog: DioxusLabs/dioxus@v0.7.8...v0.7.9

v0.7.8

This release fixes a few small bugs discovered while working on v0.8. We decided the backport these to bring out fixes faster.

What's Changed

• Fix macos signing/notarization (0.7 backport) by @​nicoburns in DioxusLabs/dioxus#5528
• fix: toctou in wasm hotpatch apply_patch causing UB by @​jkelleyrtp in DioxusLabs/dioxus#5534
• backport iframe fix to v0.7 by @​jkelleyrtp in DioxusLabs/dioxus#5535

Full Changelog: DioxusLabs/dioxus@v0.7.7...v0.7.8

v0.7.7

This release fixes a regression with JS bundling where DX would always bundle JS snippets as ESM, even though they might be CJS, UMD, or a generic JS snippet. We now properly detect the js module type and then run esbuild with the appropriate flags.

What's Changed

• autodetect js module type - only bundle esm by @​jkelleyrtp in DioxusLabs/dioxus#5515

Full Changelog: DioxusLabs/dioxus@v0.7.6...v0.7.7

v0.7.6

Dioxus v0.7.6

This release solves a large number of bugs and adds a few new features! We intend for it to be the final release of 0.7 - our git repo will now ship breaking changes in prep for 0.8.

• Shell-completions for dx using dx completions
• Much faster dev server starts for dx serve --hotpatch
• Dioxus web apps that panic while handling events will no longer brick the webpage
• 20+ new code examples
• cursor editor debug support
• Windows app icon bundling in dx serve and dx bundle

What's Changed

• Fix too restrictive Clone bounds in props with generics by @​Gohla in DioxusLabs/dioxus#5451
• fix: ensure file type bit is set for rpm bundle by @​acrilique in DioxusLabs/dioxus#5459
• Fix autofill event downcast - ignore events of the wrong type by @​ealmloff in DioxusLabs/dioxus#5379
• Add shell-completions for dx by @​sermuns in DioxusLabs/dioxus#5232
• fix(autofmt): add support for handling comments in various expression types by @​jkelleyrtp in DioxusLabs/dioxus#5461
• fix: Content-hash-based filename when bundling with wasm_split by @​SuperKenVery in DioxusLabs/dioxus#5340
• feat: add blanket IntoAttributeValue impl for references by @​tmchow in DioxusLabs/dioxus#5447

... (truncated)

Commits

• 57d6794 release v0.7.10
• fda083b Fix hotpatching when the bin target's crate name differs from the package nam...
• 3e43ffa release v0.7.9
• bfcc111 fix: git sha for cli
• d1ead87 fix: make instantiate async
• f5be0ea release v0.7.8
• f1a0124 backport iframe fix to v0.7 (#5535)
• 003ec32 fix: toctou in wasm apply_patch causing UB (#5534)
• 83f492d Fix macos signing/notarization (0.7 backport) (#5528)
• a7c0e3b release v0.7.7
• Additional commits viewable in compare view

Updates serde_json from 1.0.149 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• Additional commits viewable in compare view

[sanity]

Closing: This bump changes the compiled WASM of a deployed contract/delegate, which changes its key and orphans existing users' data unless a migration ships. It needs to be done deliberately via the app's migration process (see freenet-app-migration), not as an automated dependency bump. The repo's own key/WASM stability check (or the absence of one for the compiled dependency tree) means this cannot be merged automatically.

[AI-assisted - Claude]

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml