chore(deps): bump the everything-else group across 1 directory with 25 updates

[dependabot]

Bumps the everything-else group with 25 updates in the / directory:

Package	From	To
uuid	1.24.0	1.26.1
base64	0.22.1	0.23.1
rust_decimal	1.42.1	1.43.0
toml	0.9.12+spec-1.1.0	1.1.4+spec-1.1.0
http-body-util	0.1.4	0.1.5
rstest	0.23.0	0.27.0
dirs	6.0.0	7.0.0
jsonschema	0.46.10	0.49.9
deadpool	0.13.0	0.13.1
blake3	1.8.6	1.8.7
quick-xml	0.41.0	0.42.0
printpdf	0.12.5	0.12.8
rustls	0.23.43	0.23.44
lru	0.18.2	0.18.4
rcgen	0.14.9	0.14.10
wat	1.256.0	1.259.0
aes-gcm	0.11.0	0.11.1
secret-service	5.1.0	5.2.0
aws-lc-rs	1.18.0	1.18.1
toml_edit	0.25.13+spec-1.1.0	0.25.14+spec-1.1.0
encoding_rs	0.8.35	0.8.41
similar	3.1.2	3.2.0
syn	3.0.3	3.0.5
open	5.4.1	5.4.4
rig-core	0.36.0	0.42.0

Updates uuid from 1.24.0 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

• Seat the v7 counter below the version nibble by @​lenamonj in uuid-rs/uuid#907
• Don't panic in overflowing Timestamp to SystemTime conversion by @​KodrAus in uuid-rs/uuid#909
• Prepare for 1.26.1 release by @​KodrAus in uuid-rs/uuid#910

New Contributors

• @​lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

• Add ContextV7::with_additional_precision_bits by @​ChrisJr404 in uuid-rs/uuid#904
• Prepare for 1.26.0 release by @​KodrAus in uuid-rs/uuid#905

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

• Add a serde::bytes module that encodes a Uuid as a byte string by @​ChrisJr404 in uuid-rs/uuid#902
• Prepare for 1.25.0 release by @​KodrAus in uuid-rs/uuid#903

New Contributors

• @​ChrisJr404 made their first contribution in uuid-rs/uuid#902

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

• Fix non-ASCII character handling in parse diagnostics by @​questfever in uuid-rs/uuid#899
• Prepare for 1.24.1 release by @​KodrAus in uuid-rs/uuid#900

New Contributors

• @​questfever made their first contribution in uuid-rs/uuid#899

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

Commits

• 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
• d4df8f0 prepare for 1.26.1 release
• 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
• fda00eb don't panic in overflowing Timestamp to SystemTime conversion
• c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
• ac065a6 Align the counter diagram
• 34ec102 Seat the v7 counter below the version nibble
• cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
• 34e4f49 don't test macros under miri
• d9e7242 update nightly used for miri
• Additional commits viewable in compare view

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

Updates rust_decimal from 1.42.1 to 1.43.0

Release notes

Sourced from rust_decimal's releases.

1.43.0

What's Changed

• Accumulated fixes backported from master by @​paupino in paupino/rust-decimal#808
• Various performance improvements by @​paupino in paupino/rust-decimal#809
• General clippy cleanup by @​paupino in paupino/rust-decimal#813
• Require rust_decimal_macros >=1.37 to avoid circular dependency by @​momomuchu in paupino/rust-decimal#814
• fix: add negative sign for array_string by @​flisky in paupino/rust-decimal#823
• Remove rkyv 0.7 from feature bridge and update rand 0.8 support by @​paupino in paupino/rust-decimal#819

New Contributors

• @​momomuchu made their first contribution in paupino/rust-decimal#814
• @​flisky made their first contribution in paupino/rust-decimal#823

Full Changelog: paupino/rust-decimal@1.42.1...1.43.0

Commits

• 8592462 version 1.43.0
• 9be5917 Remove rkyv 0.7 from feature bridge and update rand 0.8 support (#819)
• f017c8b Merge pull request #823 from flisky/v1
• 93bd26f fix: add negative sign for array_string
• 5c3bf3b Merge pull request #814 from momomuchu/fix/rust-decimal-macros-minimal-versio...
• fe55209 fix: require rust_decimal_macros >=1.37 to avoid circular dependency
• 551be15 General clippy cleanup (#813)
• f7272b5 Various performance improvements (#809)
• b363729 Accumulated fixes backported from master (#808)
• See full diff in compare view

Updates toml from 0.9.12+spec-1.1.0 to 1.1.4+spec-1.1.0

Commits

• beee9fe chore: Release
• 16e2ac1 docs: Update changelog
• 89f5541 fix(toml): preserve datetimes when deserializing Value (#1194)
• 534039c fix(serde): Deserialize Value datetimes into typed targets
• 6e45cef test(serde): Reproduce Value datetime deserialization error
• 4ec099f chore: Release
• 5a47a51 docs: Update changelog
• da0911f perf(parser): Reduce over allocation by better tokens/byte ratio (#1193)
• 26eb157 perf(parser): Reduce over allocation by better tokens/byte ratio
• ca4c7bf chore(deps): Update Prek to v0.4.11 (#1191)
• Additional commits viewable in compare view

Updates http-body-util from 0.1.4 to 0.1.5

Commits

• 07838bd http-body-util v0.1.5
• 612118c docs: migrate from doc_auto_cfg to doc_cfg (#175)
• See full diff in compare view

Updates rstest from 0.23.0 to 0.27.0

Release notes

Sourced from rstest's releases.

v0.27.0

[0.27.0] 2026/9/6

Changed

• Bump msrv to 1.85.0 both for rstest and rstest_reuse
• Disabled default features of futures-util

Added

• Doc comments before #[values(...)] entries can be used to override the generated matrix test names (both for the legacy arg => [..] syntax and the new attribute form). See #321 thanks to @​orhun.

Fixed

• Use fully-qualified core import. See #336.
• Fix mut arguments failing to compile with #[trace]. See #345 thanks to @​super-cooper.
• Fix compilation under bazel by upgrading proc-macro-crate to 3.4.0.

0.26.1

Fix Docs

Full Changelog: la10736/rstest@v0.26.0...v0.26.1

0.26.0

What's Changed

• docs: fix filemode examples by @​lucascool12 in la10736/rstest#301
• Issue #306. Ignore folders by @​Obito-git in la10736/rstest#307
• Hide generated items in documentation by @​wiktor-k in la10736/rstest#309
• 313_fix by @​la10736 in la10736/rstest#314
• fix: do not depend by default on async-std by @​coriolinus in la10736/rstest#311
• Add permission for empty_structs_with_brackets in fixture by @​bugRanger in la10736/rstest#317
• Touch up indentation used for examples in the README by @​fgimian in la10736/rstest#318
• Make #[files(...)] work on Windows by @​twz123 in la10736/rstest#322
• Finalize #311 by @​la10736 in la10736/rstest#323
• Make clippy happy by @​la10736 in la10736/rstest#324

New Contributors

• @​Obito-git made their first contribution in la10736/rstest#307
• @​wiktor-k made their first contribution in la10736/rstest#309
• @​coriolinus made their first contribution in la10736/rstest#311
• @​bugRanger made their first contribution in la10736/rstest#317
• @​fgimian made their first contribution in la10736/rstest#318
• @​twz123 made their first contribution in la10736/rstest#322

Full Changelog: la10736/rstest@v0.25.0...v0.26.0

0.25.0

What's Changed

... (truncated)

Changelog

Sourced from rstest's changelog.

[0.27.0] 2026/9/6

Changed

• Bump msrv to 1.85.0 both for rstest and rstest_reuse
• Disabled default features of futures-util

Added

• Doc comments before #[values(...)] entries can be used to override the generated matrix test names (both for the legacy arg => [..] syntax and the new attribute form). See #321 thanks to @​orhun.

Fixed

• Use fully-qualified core import. See #336.
• Fix mut arguments failing to compile with #[trace]. See #345 thanks to @​super-cooper.
• Fix compilation under bazel by upgrading proc-macro-crate to 3.4.0.

[0.26.1] 2025/7/27

Fixed

• Docs

[0.26.0] 2025/7/26

Changed

• The #[files(...)] attribute now ignores matched directory paths by default. See #306 thanks to @​Obito-git.

Add

• Introduced the #[dirs] attribute, which can be used with #[files(...)] to explicitly include directory paths. See #306 thanks to @​Obito-git.
• The CI now runs builds and tests on Windows, as well.
• #[test_attr] to define test attribute explicit and also enable the use of #[macro_rules_attribute::apply(<macro>)]: naw also smol works. See #303 #311 #315 thanks to @​coriolinus.

Fixed

• Removed unsued trait and impl spotted out on 1.89.0-nightly
• Add missed tests about ignore attribute's args in rstest expansion. See #313
• The #[files(...)] attribute now works reliably on Windows.

... (truncated)

Commits

• 59cd3d1 Release 0.27.0
• 0821ebc test: Add E2E test for mut arguments with #[trace]
• 509ffef fix: mut arguments with #[trace]
• 043437d fix: Resolve clippy warnings and truncate long test project names
• 9aa8d1a fix: Suppress nightly cargo lints in test scaffolding
• 3d3c76c fix: Bump rstest_test MSRV to 1.85 and mark as unpublished
• d9ae990 chore: Add changelog entry
• 05d4b1a fix: Use fully-qualified core import
• 6da56a1 Bump msrv to 1.85 also for rstest_reuse (#342)
• 1e9963b Add CLAUDE.md for Claude Code guidance (#340)
• Additional commits viewable in compare view

Updates dirs from 6.0.0 to 7.0.0

Updates jsonschema from 0.46.10 to 0.49.9

Release notes

Sourced from jsonschema's releases.

[CLI] Release 0.49.9

No release notes provided.

[Python] Release 0.49.9

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema.to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[Ruby] Release 0.49.9

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema#to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[Rust] Release 0.49.9

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema::to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[CLI] Release 0.49.8

No release notes provided.

[Python] Release 0.49.8

Performance

• Up to 380x faster canonicalization of a oneOf whose overlapping branches carry many properties, which no longer removes shared regions the exactly-one spelling discards.

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.49.9] - 2026-08-09

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema::to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[0.49.8] - 2026-08-08

Performance

• Up to 380x faster canonicalization of a oneOf whose overlapping branches carry many properties, which no longer removes shared regions the exactly-one spelling discards.

Fixed

• Draft detection treating the version-less http://json-schema.org/schema meta-schema URI as a custom dialect, where it names the current draft.
• A patternProperties entry matching every key leaving additionalProperties: false spelled as a key constraint, where it forbids nothing.
• unevaluatedProperties/unevaluatedItems set to true forcing the whole document to stay unmodeled beside an unresolved applicator, where the keyword rejects nothing regardless of the evaluated set.
• unevaluatedProperties/unevaluatedItems beside a $ref forcing the whole document to stay unmodeled, where the reference's own evaluated properties or items are known once it is resolved.

[0.49.7] - 2026-08-07

Added

• CanonicalizeOptions::with_retriever to fetch external resources absent from the registry.
• CanonicalizeOptions::with_base_uri to resolve relative references in the root schema.
• Canonicalization of a oneOf whose branches name disjoint targets, which degrades to a union.
• Canonicalization of a vacuous patternProperties entry beside schema-valued additionalProperties, where matching keys escape its value constraint.
• Canonicalization of a Draft 4 closed pattern map with a reference nested under a property.
• Canonicalization of Draft 4 closed pattern maps that meet through an applicator.
• The complement of a reference back to a target already being negated, which stays symbolic instead of declining.
• CanonicalSchema::definition resolving # to the document the handle was read against.

Performance

• Up to 150x faster canonicalization of not over a union of many branches.
• 2% faster emission of canonical schemas, which no longer formats copied string values.
• 5% faster emission of canonical schemas, which no longer formats object keys while copying them.
• Up to 12% faster canonicalization of schemas that repeatedly intersect the same branches.
• 13% faster canonicalization of a non-dynamic OpenAPI document, which no longer scans every schema object for dynamic references.
• Faster canonicalization of schemas with local $defs references, which avoid decoding unescaped definition names.
• 23% faster canonicalization of an object whose keys a finite property-name set spells.
• 3% faster intersection of schemas where one side constrains nothing.

... (truncated)

Commits

• 4ad1722 chore(rust): Release 0.49.9
• 0f114ee fix: Canonicalization running without end on a conjunction over unions; past ...
• 8d4d60c chore: CanonicalSchema::to_json_schema on a definition emits only the defin...
• bed4553 feat: Canonicalization of a oneOf whose branches name object targets a requ...
• 0c310f4 chore(ruby): Release 0.49.8
• bd6836d chore(python): Release 0.49.8
• 71de156 chore(rust): Release 0.49.8
• a90819b feat: Extend support for unevaluated* keywords in canonicalization
• 92d4b9c perf: Up to 380x faster canonicalization of a oneOf whose overlapping branc...
• 6eb2489 fix: A patternProperties entry matching every key leaving `additionalProper...
• Additional commits viewable in compare view

Updates deadpool from 0.13.0 to 0.13.1

Commits

• bba260f Release all deadpool crates
• f417aa5 Bump up MSRV of deadpool-redis and redis
• 2c9ed6f Update async-memcached dependency to version 0.7
• 7b09e63 Bump up MSRV of deadpool-diesel
• a37ba58 Update itertools dependency to version 0.15
• 85d3405 Coalesce concurrent statement preparation
• f2728ab Extract statement cache into its own module
• 790881b Add script for running cargo for all crates
• f7a5037 Add script for checking reexports
• 256801a Fix "variable does not need to be mutable" warning
• Additional commits viewable in compare view

Updates blake3 from 1.8.6 to 1.8.7

Release notes

Sourced from blake3's releases.

1.8.7

version 1.8.7

Changes since 1.8.6:

• Remove the arrayref dependency. Unfortunately the crates.io owner was compromised.

Commits

• f3149ec version 1.8.7
• b65bcb7 add #[allow(deprecated)] annotations to fix nightly/beta warnings
• 483a220 fix warnings related to not using MAX constants
• ba02549 Codex: remove arrayref
• See full diff in compare view

Updates quick-xml from 0.41.0 to 0.42.0

Release notes

Sourced from quick-xml's releases.

v0.42.0 - String Ergonomics

What's Changed

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

• #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
• #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
• #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
• #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
• #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
• #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
• #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
• #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
• #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
• #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

• #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
• #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
• #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
• #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
• #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
• #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
• #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
• #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
• #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
• #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has changed slightly. The default maximum has also been reduced from 256 to 128.
• #1000: DeError::UnexpectedStart renamed to DeError::MixedContent. That error is emitted when you try to deserialize boolean, number or string field from something like <field>text <tag/> another text</field>.

... (truncated)

Commits

• 36a2c52 Release 0.42.0
• a4b9fca cargo fmt
• 22c99f5 Update Rust Edition to 2024
• 83351fb Add rename = $value to a table in serde example comments
• f4db767 Clarify documentation about lifetimes of the events and attributes
• 9f4c66a Fix formatting for correct assertions in read_nodes_serde
• 6950ef7 Add GHA job to execute examples
• dbf9e3f Show XML Decl tracking in examples
• aab9452 Add writing a Decl event to the writer example
• 1573e05 Avoid trim_text(true) in the in-depth examples
• Additional commits viewable in compare view

Updates printpdf from 0.12.5 to 0.12.8

Changelog

Sourced from printpdf's changelog.

0.12.8

rust-fontconfig 5 + azul 0.0.16. Font fallback in HTML→PDF now runs on rust-fontconfig 5's tiered FontFallbackChain (CSS families with per-script faces, script fallbacks, an explicit last resort) and its FcFallbackConfig generic-family model, through azul-layout 0.0.16. printpdf only uses the stable surface (FcFontCache, FcPattern/FcFont, FcParseFontBytes, FontBytes, UnicodeRange), so no printpdf code changed; the dependency range moved from >=4.4.9, <5 to >=5.0, <6, intersecting azul-layout's >=5.0, <5.1 on ONE rust-fontconfig (two copies would be two independent font caches: layout resolving a font the renderer cannot find). Verified against azul#457 at 041e20eb6 (branch feat/rust-fontconfig-5, the rebase of the auto-closed #455): 199 tests over 33 binaries green, html_font_resolution and the ligature/subset canaries included, with ONE rust-fontconfig (5.0.0), one allsorts and one azul-core in the graph.

Font coverage is now exact, which changes fallback for the better. No printpdf code changed, but rust-fontconfig 5 reads cmap segments directly instead of probing blocks, and that fixes two real defects in how the embedded base-14 fonts participated in per-character fallback:

• Symbol and ZapfDingbats reported NO coverage at all under rfc 4. The block probe could not read their cmap, so both declared empty unicode_ranges — and azul skips empty-coverage faces during fallback, so neither font could ever be chosen for any codepoint. They now declare the 43 and 10 codepoints they really map.
• Everyone else over-claimed. Coverage was rounded up to the enclosing block: Helvetica claimed all 256 of U+0000..=U+00FF against 213 real glyphs, and Times-Italic claimed the whole Cyrillic block on the strength of a handful of glyphs. Over-claiming is the harmful direction — the resolver stops at the first font whose ranges contain the codepoint, so a bogus claim wins the character and renders .notdef instead of falling through to a font that has the glyph. Verified against the cmap tables: all fourteen subsets now report exactly the codepoints that map to a non-.notdef glyph.

build_font_pool(fonts, Some(&["monospace"])) and friends also scan a wider superset than before (generic expansion now includes the per-script fallback candidates: 13 -> 27 fonts for monospace, 24 -> 63 for sans-serif on a typical macOS box). The filter is documented as a superset selector, not the final resolution, so this only means more fonts are available to fall back to; Some(&[]) still scans nothing.

The azul pin is 0.0.16, not 0.0.15. Building printpdf against the published 0.0.15 surfaced two azul-layout defects that only printpdf's feature matrix reaches (it is the only consumer that builds azul-layout without cpurender and without xml, across all three wasm targets): uuid was pulled into every wasm build and refused to compile on wasm32-unknown-unknown, and DocumentChangeset::apply_to_dom called into the xml-gated document_edit from an ungated impl block, breaking `--no-default-features --features

... (truncated)

Commits

• See full diff in compare view

Updates rustls from 0.23.43 to 0.23.44

Commits

• 64ad386 Bump version to 0.23.44
• 1efbf66 bogo: remove PostQuantum setup
• e78162f aws-lc-rs: add support for ML-DSA signatures
• d880772 bogo: extract Options::provider() helper
• 87201d6 bogo: force all callers to get provider from Options
• 93657e3 server: limit 1.2 certificate requests to 1.2-compatible signature schemes
• bbd3c9a client: avoid sending 1.3-only signature schemes if no cipher suites configured
• eb57688 tls12: require known signature algorithm
• e7a9cef tls12: send illegal_parameter alert for kx signed with wrong algorithm
• 06a546d bogo: take latest
• Additional commits viewable in compare view

Updates lru from 0.18.2 to 0.18.4

Changelog

Sourced from lru's changelog.

v0.18.4 - 2026-09-02

• Add retain method.

v0.18.3 - 2026-08-27

• Add sparse constructor.

Commits

• 2504ad0 Merge pull request #245 from jeromefroe/jerome/prepare-0-18-4-release
• 419b047 Prepare 0.18.4 release
• 05ba36e Merge pull request #241 from ChrisJr404/add-retain
• d84bc5e Revert retain to the simpler removal implementation
• 36a810e Potential fix for pull request finding
• e0d578c Merge remote-tracking branch 'up/master' into add-retain
• 6e6ff26 retain: free the node returned by the map to avoid a dangling entry
• ceeee6a Merge pull request #244 from jeromefroe/jerome/prepare-0-18-3-release
• 1810d9a Prepare 0.18.3 release
• 0f4e37a Merge pull request #242 from drbrain/LruCache-sparse
• Additional commits viewable in compare view

Updates rcgen from 0.14.9 to 0.14.10

Release notes

Sourced from rcgen's releases.

0.14.10

What's Changed

• Spec compliance bug fixes by @​cpu in rustls/rcgen#445
• Take advantage of stable ML-DSA in aws-lc-rs by @​djc in rustls/rcgen#447

Commits

• f4a3b16 Bump version to 0.14.10
• dea3d4d Upgrade to botan 0.13
• 788b093 Upgrade to pem 4
• 7ce21f4 Take advantage of stable ML-DSA in aws-lc-rs
• e2dba45 Remove unused RSASSA-PSS signature algorithm
• 37070de Omit reasonCode unspecified(0) from CRL entry extensions
• b247a87 Write extensions for certs that only set KeyUsage or CRLDP
• 85eafdd Reject empty CRL distribution point URIs
• 3a99b50 Encode CRL invalidityDate as GeneralizedTime
• See full diff in compare view

Updates wat from 1.256.0 to 1.259.0

Release notes

Sourced from wat's releases.

v1.259.0

What's Changed

• Refactor name resolution of components in the text format by @​alexcrichton in bytecodealliance/wasm-tools#2621
• Import component spec tests as a submodule and run them. by @​alexcrichton in bytecodealliance/wasm-tools#2623
• Fix name uniqueness with methods/interfaces by @​alexcrichton in bytecodealliance/wasm-tools#2625
• Add compact import generation in wasm-smith by @​chacailline in bytecodealliance/wasm-tools#2627
• Drop hyphens when testing equality of kebab names by @​alexcrichton in

[railway-app]

🚅 Deployed to the ironclaw-pr-8099 environment in ironclaw-ci-preview

Service	Status	Web	Updated
ironclaw	❌ Build Failed (View Logs)	Web	Sep 13, 2026 at 8:38 pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0a81c729-c46d-427e-b85d-1e1545b973e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ironloopai]

Review · Status

🟩 Completed

IronLoop completed the review and posted it to GitHub.

Result

Open submitted review →

Run details

• Run: 364c78ec-32fe-45a6-af31-93983efa0d90
• Base: main at b0b999d
• Head: dependabot/cargo/everything-else-8638fe4db2 at b6e2ec1
• Created: 2026-09-13 20:40 UTC
• Updated: 2026-09-13 20:54 UTC

_{Automatic trigger · attempt 1 of 3 · completed in 14m 21s}

[ironloopai]

Review · Summary

Two direct dependency upgrades break compilation.

Findings: 🔴 High 2

_{Code-specific findings are attached to the diff.}

Validation

• ❌ Affected crate builds — The updated LLM and document crates each fail to compile against their upgraded direct dependencies.
• ✅ Host API contract suite — 334 tests passed with the test-support feature enabled.
• ✅ Common types suite — 110 tests passed against the resolved dependency set.

Review details

• Run: 364c78ec-32fe-45a6-af31-93983efa0d90
• Attempts: 1

[ironloopai]

🔴 High · Migrate Rig before bumping it

rig-core 0.42 exposes rig_core, while this crate imports rig throughout; it also removes OneOrMany, which rig_adapter.rs uses. As a result, ironclaw_llm no longer compiles. Keep 0.36 or include the required Rig migration in this change.

[ironloopai]

🔴 High · Migrate the OOXML parser before bumping quick-xml

quick-xml 0.42 changes the name/attribute interfaces to strings and removes BytesText::decode. The DOCX, XLSX, and PPTX parsers still use the old byte-oriented API, so ironclaw_documents fails with 56 compile errors. Keep 0.41 or migrate those parsers with this update.