[dependabot]

Bumps the rust-dependencies group with 6 updates in the / directory:

Package	From	To
serde_json	1.0.151	1.0.154
rusqlite	0.37.0	0.40.2
cpal	0.16.0	0.18.2
sha2	0.10.9	0.11.0
tiny-skia	0.11.4	0.12.0
svgtypes	0.15.3	0.16.1

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates rusqlite from 0.37.0 to 0.40.2

Release notes

Sourced from rusqlite's releases.

0.40.2

What's Changed

• Lower MSRV to 1.88.0

Full Changelog: rusqlite/rusqlite@v0.40.1...v0.40.2

0.40.1

What's Changed

• Fix clippy warnings #1852
• Bump bundled SQLite version to 3.53.2 #1853
• Bump hashlink version #1855
• Fix SQL injection when SAVEPOINT name is tainted #1854

Full Changelog: rusqlite/rusqlite@v0.40.0...v0.40.1

0.40.0

What's Changed

• Breaking changes: Replace VTab macros by constructors #1823
• Breaking changes: Fix VTab::best_index #1824
• Asserts on VTab::connect aux and args #1825
• Breaking changes: Fix VTab::connect / create #1826
• Breaking changes: Allow opting out of using sqlite-wasm-rs on wasm32-unknown-unknown #1828, #1829
• Derive Default for SeriesTabCursor/ArrayTabCursor #1830
• Update link to pre-update hook #1831
• Breaking changes: Fix VTab::connect #1832
• impl From for FromSqlError #1833
• Breaking changes: Fix vtab::dequote #1835
• Bump bundled SQLCipher to version 4.14.0 #1837
• sqlite3_set_errmsg #1752
• Bump sqlite3-parser version #1838
• Fix UB in ToSqlOutput::from_rc #1839
• Ensure miri doesn't complain #1840
• Bump to actions/checkout@v6 #1842
• Add support to UtcDateTime #1843, #1844
• Bump bundled SQLite version to 3.53.1 #1848
• Replace some cfg(not by cfg_select #1850

Full Changelog: rusqlite/rusqlite@v0.39.0...v0.40.0

0.39.0

What's Changed

• Fix constraints on VTab Aux data #1778, #1771
• Fix docs.rs generation #1779
• Fix a small typo in rollback_hook docstring #1780
• Fix some warnings from Intellij #1781
• Minimal doc for features #1783
• Clear hooks only for owning connections #1785, #1784
• Fix link to SQLite C Interface, Prepare Flags #1787
• Comment functions which are not usable from a loadable extension #1789
• Factorize code #1792

... (truncated)

Commits

• e88f112 Prepare release
• d11c76e Update main.yml
• c922ca5 Lower MSRV to 1.88.0
• 6d3c282 Merge pull request #1856 from gwenn/0.40.1
• 2ba28b7 Prepare next release
• a021dc7 Merge pull request #1854 from gwenn/savepoint
• 534a149 Merge pull request #1855 from gwenn/hashlink
• 6d9764f Bump hashlink version
• fa574eb Use sqlite3_keyword_check
• 15385cc Fix SQL injection when SAVEPOINT name is tainted
• Additional commits viewable in compare view

Updates cpal from 0.16.0 to 0.18.2

Release notes

Sourced from cpal's releases.

cpal 0.18.2

Added

• AAudio: Xruns are now reported as ErrorKind::Xrun.
• CoreAudio: Xruns are now reported as ErrorKind::Xrun.
• PipeWire: Xruns are now reported as ErrorKind::Xrun.
• WASAPI: Capture xruns are now reported as ErrorKind::Xrun.

Changed

• BSD: Clarify that realtime-dbus has no effect there.
• CoreAudio: Bump objc2-core-foundation dependency lower bound to 0.3.1.
• iOS: Timestamps now include hardware latency and update when the audio route changes.
• JACK: Timestamps now include port latency.
• Linux: Clarify that realtime alone is a no-op without realtime-dbus.
• PipeWire: Devices with multiple ports now get distinct, localized, per-port names.
• WASAPI: The windows and windows-core dependencies are now both pinned to 0.62.

Fixed

• Timestamps now stay monotonic across device and graph changes.
• ALSA: A nonzero but sub-millisecond stream timeout is no longer treated as a non-blocking poll.
• ALSA: Fix compilation on FreeBSD, DragonFly, and NetBSD.
• ASIO: Fix duplex streams silently dropping audio when built from separate Device handles.
• AudioWorklet: Fix Stream operations to work when called from any thread.
• AudioWorklet: Fix stale audio output when a data callback wrote a partial buffer.
• CoreAudio: Fix stale audio output when a data callback wrote a partial buffer.
• CoreAudio: Default-output streams now report xrun status.
• iOS: Streams now resume automatically when an audio session interruption ends.
• JACK: Streams with more channels than physical system ports no longer fail to build.
• JACK: Channel enumeration is no longer capped at the physical system port count.
• JACK: Device::id no longer embeds the process ID, so DeviceId is now stable across application restarts.
• PipeWire: Fix streams starting audio before play() is called.
• PipeWire: Fix real-time promotion blocking the audio callback thread on Linux.
• PipeWire: Fix rtkit burst limit errors from repeated real-time promotion on quantum jitter.
• PipeWire: Fix 24-bit sample format mapping.
• PipeWire: Nodes with an /Internal media class are now enumerated as devices.
• PipeWire: Streams for a specific device no longer auto-reroute if it disappears.
• PipeWire: Build on 32-bit targets without native 64-bit atomics.
• PulseAudio: NoData errors are no longer misreported as buffer xruns.
• PulseAudio: Build on 32-bit targets without native 64-bit atomics.
• visionOS: The CoreAudio backend now builds.
• WASAPI: Stream::drop, play, and pause no longer panic when the device is lost.
• WASAPI: Output streams no longer reject formats that the built-in resampler can convert.
• WASAPI: Fix 24-bit samples not being packed into the upper bits of their sample container.
• WASAPI: Reported buffer sizes are no longer off by one frame.
• WASAPI: Default device changes no longer report DeviceChanged, which wrongly implied the stream had rerouted automatically.
• WebAudio: Fix stale audio output when a data callback wrote a partial buffer.
• WebAudio: Fix unsound Send + Sync on Stream when compiled with +atomics.
• WebAudio: Fix Host::is_available() always returning true, even in non-window contexts.

... (truncated)

Changelog

Sourced from cpal's changelog.

[0.18.2] - 2026-08-16

Added

• AAudio: Xruns are now reported as ErrorKind::Xrun.
• CoreAudio: Xruns are now reported as ErrorKind::Xrun.
• PipeWire: Xruns are now reported as ErrorKind::Xrun.
• WASAPI: Capture xruns are now reported as ErrorKind::Xrun.

Changed

• BSD: Clarify that realtime-dbus has no effect there.
• CoreAudio: Bump objc2-core-foundation dependency lower bound to 0.3.1.
• iOS: Timestamps now include hardware latency and update when the audio route changes.
• JACK: Timestamps now include port latency.
• Linux: Clarify that realtime alone is a no-op without realtime-dbus.
• PipeWire: Devices with multiple ports now get distinct, localized, per-port names.
• WASAPI: The windows and windows-core dependencies are now both pinned to 0.62.

Fixed

• Timestamps now stay monotonic across device and graph changes.
• ALSA: A nonzero but sub-millisecond stream timeout is no longer treated as a non-blocking poll.
• ALSA: Fix compilation on FreeBSD, DragonFly, and NetBSD.
• ASIO: Fix duplex streams silently dropping audio when built from separate Device handles.
• AudioWorklet: Fix Stream operations to work when called from any thread.
• AudioWorklet: Fix stale audio output when a data callback wrote a partial buffer.
• CoreAudio: Default-output streams now report xrun status.
• CoreAudio: Fix stale audio output when a data callback wrote a partial buffer.
• iOS: Streams now resume automatically when an audio session interruption ends.
• JACK: Streams with more channels than physical system ports no longer fail to build.
• JACK: Channel enumeration is no longer capped at the physical system port count.
• JACK: Device::id no longer embeds the process ID, so DeviceId is now stable across application restarts.
• PipeWire: Fix streams starting audio before play() is called.
• PipeWire: Fix rtkit burst limit errors from repeated real-time promotion on quantum jitter.
• PipeWire: Fix real-time promotion blocking the audio callback thread on Linux.
• PipeWire: Fix 24-bit sample format mapping.
• PipeWire: Nodes with an /Internal media class are now enumerated as devices.
• PipeWire: Streams for a specific device no longer auto-reroute if it disappears.
• PipeWire: Build on 32-bit targets without native 64-bit atomics.
• PulseAudio: NoData errors are no longer misreported as buffer xruns.
• PulseAudio: Build on 32-bit targets without native 64-bit atomics.
• visionOS: The CoreAudio backend now builds.
• WASAPI: Default device changes no longer report DeviceChanged, which wrongly implied the stream had rerouted automatically.
• WASAPI: Reported buffer sizes are no longer off by one frame.
• WASAPI: Stream::drop, play, and pause no longer panic when the device is lost.
• WASAPI: Capture streams no longer report a spurious xrun on the first buffer after starting.
• WASAPI: Output streams no longer reject formats that the built-in resampler can convert.
• WASAPI: Fix 24-bit samples not being packed into the upper bits of their sample container.
• WebAudio: Fix stale audio output when a data callback wrote a partial buffer.

... (truncated)

Commits

• e1612d5 chore: prepare cpal 0.18.2 and asio-sys 0.4.0 release
• 8806724 fix(wasapi): shift i24 to/from top bits (#1309) (#1311)
• 8846425 fix(asio): share duplex buffer state across Device handles for the same drive...
• 9d05a73 docs: alphabetize error variants in supported-configs docs
• d733d51 doc: record UnsupportedConfig on the supported-configs queries
• 9f6f47a fix(ci): pin mipsel to no forced frame pointers
• b87721d fix(pipewire): fix 24-bit sample format mapping
• e0893c3 doc: realtime-dbus has never worked on BSD
• 11014e4 ios: recover the stream after an audio session interruption (#1295)
• c4a92cb fix: include *BSD in frames_to_duration gate
• Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

• ffe0939 Release sha2 0.11.0 (#806)
• 8991b65 Use the standard order of the [package] section fields (#807)
• 3d2bc57 sha2: refactor backends (#802)
• faa55fb sha3: bump keccak to v0.2 (#803)
• d3e6489 sha3 v0.11.0-rc.9 (#801)
• bbf6f51 sha2: tweak backend docs (#800)
• 155dbbf sha3: add default value for the DS generic parameter on TurboShake128/256...
• ed514f2 Use published version of keccak v0.2 (#799)
• 702bcd8 Migrate to closure-based keccak (#796)
• 827c043 sha3 v0.11.0-rc.8 (#794)
• Additional commits viewable in compare view

Updates tiny-skia from 0.11.4 to 0.12.0

Changelog

Sourced from tiny-skia's changelog.

[0.12.0] - 2026-02-02

Fixed

• Fixed a panic when drawing small anti-aliased rectangles. Thanks to @​nwhitehead

Added

• 2-point conical gradient support for (RadialGradient). Thanks to @​wmedrano
• Sweep gradient support (SweepGradient). Thanks to @​wmedrano
• Support for a small number of color spaces. Thanks to @​danieldg
• Added the is_empty and join methods to Rect. Thanks to @​danieldg
• Implement Hash for PathVerb, Rect and Size and IntSize. Thanks to @​LaurenzV
• Add support for relaxed SIMD in WebAssembly. Thanks to @​CryZe
• Add the from_rgba_unchecked method to Color so it can be created in const contexts. Thanks to @​jeffreyrosenbluth
• Add the scale_by and scale_to method to Size. Thanks to @​jermy
• Add the take_demultiplied method to Pixmap. Thanks to @​JustForFun88
• Add the take method to Mask. Thanks to @​valadaptive
• Add the round_out method to Rect. Thanks to @​valadaptive

Changed

• The RadialGradient::new requires a start radius now. Set the second argument to 0.0 to preserve the old behavior.

Commits

• e48b902 Publish v0.12.0 (#171)
• 027f10c Update changelog (#170)
• c19c256 Update dependencies (#169)
• 2df5c25 Add support for sweep gradients (#166)
• 6943c20 Add support for 2 point conical gradients (#164)
• 9f5dd32 Fix rustup run nightly cargo bench (#163)
• f046014 Fix panic for tiny anti-aliased rectangles (#119)
• aed7139 Upgrade the png crate to 0.18 (#160)
• 624257c Fix Rect::round(_out) (#157)
• ab40557 Add Mask::take method (#156)
• Additional commits viewable in compare view

Updates svgtypes from 0.15.3 to 0.16.1

Release notes

Sourced from svgtypes's releases.

0.16.1

Crates.io | Docs

This release has an MSRV of 1.85.

Changed

• Update Kurbo to v0.13 (#60 by @​nicoburns)

v0.16.0

Crates.io | Docs

This release has an MSRV of 1.82.

Added

• Add helper functions to PathSegment (#47 by @​LaurenzV)

Changed

• Update Kurbo to v0.12. (#56 by @​HaHa421)

Changelog

Sourced from svgtypes's changelog.

[0.16.1][] (2026-01-09)

This release has an [MSRV][] of 1.85.

Changed

• Update Kurbo to v0.13. (#60[] by [@​nicoburns][])

[0.16.0][] (2025-10-26)

This release has an [MSRV][] of 1.82.

Added

• Add helper functions to PathSegment (#37[] by [@​LaurenzV][])

Changed

• Update Kurbo to v0.12. (#56[] by [@​HaHa421][])

Commits

• fa62387 Upgrade to Kurbo 0.13, MSRV 1.85, Prepare v0.16.1 (#60)
• c99a6f2 Prepare for v0.16.0 release (#58)
• 83199c5 Support no_std (#39)
• 2252532 Cleanups after #56 (#57)
• ee0c189 upgrade kurbo dependency to 0.12 (#56)
• 1ca44c9 Add helper functions to PathSegment (#47)
• 26c9a26 Fix clippy::uninlined_format_args lints (#55)
• fb0bbea ci: update to stable Rust 1.87, typos 1.32.0 (#53)
• 7c98ef6 Fix clippy::use_self lints (#52)
• ed3878f benches: Mark crate as not published (#51)
• Additional commits viewable in compare view