build(deps): bump the cargo-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the cargo-dependencies group with 9 updates in the / directory:

Package	From	To
clap	4.6.1	4.6.6
globset	0.4.18	0.4.20
ignore	0.4.26	0.4.33
json5	0.4.1	1.3.1
noyalib	0.0.8	0.0.28
regex	1.12.4	1.13.1
serde	1.0.228	1.0.229
serde_json	1.0.150	1.0.151
toml	1.1.2+spec-1.1.0	1.1.4+spec-1.1.0

Updates clap from 4.6.1 to 4.6.6

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Commits

• 348cff3 chore: Release
• d478377 docs: Update changelog
• 04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
• 7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
• f90a966 fix(complete): Use spaces for indentation in fish
• dd4997b fix(complete): Don't glob-expand bash positionals
• 8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
• 8141e11 chore(deps): Update compatible (dev) (#6398)
• 8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
• 71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
• Additional commits viewable in compare view

Updates globset from 0.4.18 to 0.4.20

Commits

• 5055264 globset-0.4.20
• 020687a ignore,globset: increase pool capacity
• 5ed408e ignore-0.4.32
• 435f59f ignore: skip loading unreachable ignore files
• f9c05a9 index: remove incorrect README
• 8372866 index: add some initial indexing scaffolding
• d99ac34 core: add index module
• 2ed0c00 flags: disable many flags when indexing is enabled
• 59e318f ignore-0.4.31
• a9dc222 cargo: set rust-version on all crates
• Additional commits viewable in compare view

Updates ignore from 0.4.26 to 0.4.33

Commits

• 3fce3b5 ignore-0.4.33
• 5055264 globset-0.4.20
• 020687a ignore,globset: increase pool capacity
• 5ed408e ignore-0.4.32
• 435f59f ignore: skip loading unreachable ignore files
• f9c05a9 index: remove incorrect README
• 8372866 index: add some initial indexing scaffolding
• d99ac34 core: add index module
• 2ed0c00 flags: disable many flags when indexing is enabled
• 59e318f ignore-0.4.31
• Additional commits viewable in compare view

Updates json5 from 0.4.1 to 1.3.1

Release notes

Sourced from json5's releases.

1.3.0

What's Changed

• fix: support utf-16 surrogate pair in string escape by @​zonyitoo in callum-oakley/json5-rs#53

Full Changelog: callum-oakley/json5-rs@1.2.0...1.3.0

1.2.0

Also serialize u128/i128

Full Changelog: callum-oakley/json5-rs@1.1.0...1.2.0

1.1.0

u128/i128 support

Full Changelog: callum-oakley/json5-rs@1.0.0...1.1.0

1.0.0

Full Changelog: callum-oakley/json5-rs@0.4.1...1.0.0

Commits

• 6905ad2 expose char
• 9c8dcc9 enum representation tests
• 691cf04 more benchmarks
• f22f424 formatting
• 643ca75 benchmarks
• 9214f35 1.3.0
• 435e3bb defer to char::decode_utf16
• 6f2f03e Merge pull request #53 from zonyitoo/main
• d65920b fix: support utf-16 surrogate pair in string escape
• b8af7e3 also serialize u64/i64
• Additional commits viewable in compare view

Updates noyalib from 0.0.8 to 0.0.28

Release notes

Sourced from noyalib's releases.

noyalib v0.0.28

What's Changed

• chore(release): v0.0.28 — implicit null: writing into one, and reading one at EOF (#314) (0a0c75f)
• fix(scanner): treat : at end of input as a value indicator (#313) (1557d1b)
• fix(cst): write into an implicit null instead of denying it exists (#311) (97bc013)
• docs(ecosystem): regenerate the scorecard — A+ (98.4%) (#309) (ac6c0b6)
• fix(scorecard): score dependency closure only where it propagates (#308) (712e6d5)
• docs(ecosystem): regenerate the scorecard against released v0.0.27 (#307) (c0a3b37)

Checksums

9f075ef19fa3bcf8697c0ef96c37d5c435d339a40ab8081cae3aac3a4e7fee9a  noyalib-0.0.28.crate

noyalib v0.0.27

What's Changed

• chore(release): v0.0.27 — alias resolution and plain-only merge keys (#306) (499d114)
• fix(loader): only a plain << scalar is a merge key (#305) (049c9aa)
• fix(streaming): resolve aliases on the replay branch too (closes #301) (#304) (138fb7a)
• fix(ci): the duration gate reported Windows runner variance as regression (#303) (9cb1c0f)
• fix(ser): write no trailing whitespace that is not string content — closes #297 (#298) (d24d8d4)
• fix(release): tolerate an already-published version, as the satellites do (#302) (4858779)

Checksums

db7cb50aa7b401e6520d3ef64e0f782f010e2c4e0ee4c31a5fce58d2fa322f29  noyalib-0.0.27.crate

noyalib v0.0.26

What's Changed

• chore(release): v0.0.26 — @​zoosky's wrapped-flow fix (#300) (7e36e1a)
• test(cst): cover @​zoosky's #294 fix, and document it (#299) (f2bf5f5)
• fix(cst): a flow member alone on its line takes the line with it — closes #294 (#296) (ab4c235)
• docs(ecosystem): add a measurement harness and derive the rating from it (#295) (0841b27)
• docs(changelog): record the fuzz invariant fix under v0.0.25 (#293) (e1c2baf)

Checksums

eaf7471054ff3fcc857fe8c5c674df7d107d2cb3072ac664a244f20b6d8dae01  noyalib-0.0.26.crate

noyalib v0.0.25

What's Changed

• chore(reuse): add the SPDX header to the new regression test (0022c13)
• docs: move release notes into doc/release-notes/ and repair stale links (234b629)
• fix(cst): refuse to remove an alias-valued entry; repair the fuzz build (2ff34f9)

... (truncated)

Changelog

Sourced from noyalib's changelog.

[v0.0.28] - 2026-08-23

Two CST and scanner correctness fixes, both about an implicit null — a mapping entry whose value is absent. One could not be written to; the other was not recognised at end of input.

Fixed

• Inserting over an implicit null appended a duplicate key (#310, fixed in #311). a: followed by an insertion emitted a second a entry rather than filling the empty one. The load-back oracle could not see it: the loader resolves duplicates last-wins, so the document round-tripped to the right value while the bytes carried a duplicate. It also relocated the entry to the end of the mapping, which stranded any trailing comment on the key it had just shadowed.

• A : at end of input was not read as a mapping indicator (#312, fixed in #313). a: and a:\n are the same document one byte apart — the trailing newline is not content — yet the first loaded as the scalar "a:" and the second as {a: null}. The plain-scalar scanner substituted a NUL for the absent byte after the colon, and NUL is not in IS_BLANK_OR_BREAK, so the scalar swallowed the colon instead of stopping at it.

  Four faces, all now matching PyYAML and Psych:

  Input	Before	After
  "a:"	String("a:")	{a: null}
  "a: 1\nb:"	parse error	{a: 1, b: null}
  "p:\n a:"	{p: String("a:")}	{p: {a: null}}
  "- a:"	[String("a:")]	[{a: null}]

  The second was a hard parse error on valid YAML and is the one most likely to be hit — it needs only a mapping with a blank last value and no trailing newline, which printf without \n, heredocs and generated fragments all produce. The other three were silent wrong values.

No public API change. No MSRV change (still 1.86.0).

[v0.0.27] - 2026-08-21

Two correctness fixes in alias and merge-key handling, both found by consumers pointing a real workload at a published release.

Fixed

• An alias used as a value beside a merge key came back unresolved (#301, reported and diagnosed by

... (truncated)

Commits

• 0a0c75f chore(release): v0.0.28 — implicit null: writing into one, and reading one at...
• 1557d1b fix(scanner): treat : at end of input as a value indicator (#313)
• 97bc013 fix(cst): write into an implicit null instead of denying it exists (#311)
• ac6c0b6 docs(ecosystem): regenerate the scorecard — A+ (98.4%) (#309)
• 712e6d5 fix(scorecard): score dependency closure only where it propagates (#308)
• c0a3b37 docs(ecosystem): regenerate the scorecard against released v0.0.27 (#307)
• 499d114 chore(release): v0.0.27 — alias resolution and plain-only merge keys (#306)
• 049c9aa fix(loader): only a plain << scalar is a merge key (#305)
• 138fb7a fix(streaming): resolve aliases on the replay branch too (closes #301) (#304)
• 9cb1c0f fix(ci): the duration gate reported Windows runner variance as regression (#303)
• Additional commits viewable in compare view

Updates regex from 1.12.4 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

• #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

Commits

• 2b52759 1.13.1, redux
• 40e9823 1.13.1
• 75fcb96 changelog: 1.13.1
• 64ad0b6 automata: fix bug in reverse suffix/inner optimization
• fa91c31 automata: fix a bug caught by Codex review
• 30390ec automata: formatting tweaks
• 821a8eb automata: refactor reverse suffix/inner search slightly
• 10afd70 automata: expose the extracted literals for inner literal extraction
• 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
• 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
• Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• See full diff in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.4+spec-1.1.0

Commits

• beee9fe chore: Release
• 16e2ac1 docs: Update changelog
• 89f5541 fix(toml): preserve datetimes when deserializing Value (#1194)
• 534039c fix(serde): Deserialize Value datetimes into typed targets
• 6e45cef test(serde): Reproduce Value datetime deserialization error
• 4ec099f chore: Release
• 5a47a51 docs: Update changelog
• da0911f perf(parser): Reduce over allocation by better tokens/byte ratio (#1193)
• 26eb157 perf(parser): Reduce over allocation by better tokens/byte ratio
• ca4c7bf chore(deps): Update Prek to v0.4.11 (#1191)
• Additional commits viewable in compare view