build(deps): bump the cargo group with 5 updates

[dependabot]

Bumps the cargo group with 5 updates:

Package	From	To
serde_json	1.0.151	1.0.154
gix-imara-diff	0.3.0	0.3.1
napi	3.14.0	3.14.2
napi-derive	3.6.10	3.6.12
zip	8.6.0	9.0.1

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates gix-imara-diff from 0.3.0 to 0.3.1

Release notes

Sourced from gix-imara-diff's releases.

gix-imara-diff v0.3.1

Commit Statistics

• 3 commits contributed to the release over the course of 13 calendar days.
• 13 days passed between releases.
• 0 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

• Uncategorized
  • Prepare changelogs prior to release (794eeef)
  • Merge pull request #3033 from GitoxideLabs/gix-cli-progress-cleanup (80f4b03)
  • Merge pull request #3020 from GitoxideLabs/report-september (5fb3dcf)

Changelog

Sourced from gix-imara-diff's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Headline benefits of this extra-curricular release are various security improvements, and greatly improved error handling and consisstency. Plumbing crates for instance will now use a standard std::error::Error compatible error type.

Besides that, the tracing of all commands was greatly improved.

Changed (BREAKING)

• remove full-screen progress mode

  Full-screen progress required separate command and UI threads plus channel coordination, while line progress already covers long-running commands and works with independently buffered tracing.

  Remove --progress, --progress-keep-open, and the prodash-render-tui feature. Keep synchronous line progress as the only progress UI.

New Features

• make trace output independently configurable

  Quick review only, as it's mostly about tracing and gix which both aren't super important, and are seemingly working well. An extra agent-review couldn't find anything either.

  Replace the old boolean trace switch with a bounded -t/--trace counter: forest INFO and DEBUG at one or two occurrences, then flat DEBUG and TRACE at three or four. Keep --threads long-only and route tracing independently of verbose and progress rendering, including commands with bespoke execution paths and corpus runs.

  Initialize display tracing once before repository discovery, buffer it outside prodash, and emit it after command and progress teardown. Format forest and flat output with ANSI, then adapt the final stderr write so terminals get color while pipes and NO_COLOR remain plain.

  Corpus worker subscribers share that sink while retaining their complete JSON trace storage, and flat modes include completed spans. gix tix remains delegated to Tix so it installs only one subscriber.

• add and remove linked worktrees from the CLI

... (truncated)

Commits

• 0115e90 Release gix-error v0.5.0, gix-date v0.18.0, gix-actor v0.44.0, gix-trace v0.3...
• 794eeef prepare changelogs prior to release
• fd88555 Merge pull request #3043 from cruessler/run-gix-transport-tests-with-sha-256
• c2f1925 Merge pull request #3042 from cruessler/branch-9
• d78005a Merge pull request #3038 from cruessler/run-gix-discover-tests
• 248186c review
• 951b9fc Make first gix-transport test GIX_TEST_FIXTURE_HASH-aware
• b9093f8 review
• e6fb2ad change(gix-status)!: Remove unnecessary object_hash from Options
• 9572ce0 Add test for detached HEAD discovery
• Additional commits viewable in compare view

Updates napi from 3.14.0 to 3.14.2

Release notes

Sourced from napi's releases.

napi-v3.14.2

Fixed

• (napi) register the wasm cleanup through the env cleanup hook (#3571)
• (napi) own NativeBorrowScope storage via NonNull to fix aliasing violation (#3573)
• (napi) bound serde_json::Value conversion depth at 128 levels (#3568)

napi-v3.14.1

Fixed

• (napi) create objects with napi_define_properties on every Node version (#3560)

Commits

• 8bab46e chore: release (#3567)
• 9c49b6c chore(release): publish
• e73367c feat: recognize the aarch64-unknown-freebsd target (#3574)
• 44e7911 chore(deps): update dependency @​oxc-node/core to v0.1.3 (#3564)
• 962e4b5 fix(cli): keep WASI-managed root entry that differs from package main (#3572)
• 469b861 chore(deps): update dependency webdriverio to v10 (#3566)
• 9ca1bab fix(napi): register the wasm cleanup through the env cleanup hook (#3571)
• 8047dbb fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violatio...
• 125e472 fix(napi): bound serde_json::Value conversion depth at 128 levels (#3568)
• a713fcb chore(deps): update dependency oxc-parser to ^0.153.0 (#3569)
• Additional commits viewable in compare view

Updates napi-derive from 3.6.10 to 3.6.12

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.6.12

Other

• update Cargo.toml dependencies

napi-derive-v3.6.11

Fixed

• (deps) update rust crate syn to v3 (#3407)

Commits

• 8bab46e chore: release (#3567)
• 9c49b6c chore(release): publish
• e73367c feat: recognize the aarch64-unknown-freebsd target (#3574)
• 44e7911 chore(deps): update dependency @​oxc-node/core to v0.1.3 (#3564)
• 962e4b5 fix(cli): keep WASI-managed root entry that differs from package main (#3572)
• 469b861 chore(deps): update dependency webdriverio to v10 (#3566)
• 9ca1bab fix(napi): register the wasm cleanup through the env cleanup hook (#3571)
• 8047dbb fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violatio...
• 125e472 fix(napi): bound serde_json::Value conversion depth at 128 levels (#3568)
• a713fcb chore(deps): update dependency oxc-parser to ^0.153.0 (#3569)
• Additional commits viewable in compare view

Updates zip from 8.6.0 to 9.0.1

Release notes

Sourced from zip's releases.

v9.0.1

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

v9.0.0

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)
• use ZipFileEntry instead of ZipStreamFileMetadata (#935)
• add ZipFileEntry with no Reader (#933)
• change aes_mode to aes_settings() in ZipFileData (#925)
• cleanup and harmonize extra fields (#923)
• Rewrite zip64 extra (#913)

🐛 Bug Fixes

• reading an empty AES entry again at EOF returns Ok(0) (#1024)
• reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
• apply central directory metadata in ZipStreamReader, only to written entries (#1030)
• consume the whole extended timestamp field in the central header (#1016)
• parse the central header of the extended timestamp (#1002)
• don't pre-allocate the declared size in the legacy decoders (#991)
• Symlink with very large declared size could lead to out-of-memory panic (#984)
• copy extra fields in raw_copy_file (#955) (#982)
• add unix_mode when copy_raw_file (#981)
• rewrite documentation of add_symlink_from_path (#979)
• ignore a ZIP64 extra field that no sentinel asked for (#962)
• do not set data descriptor if directory (#973)
• expose flags function for easier access (#972)
• preserve unix permission in raw_copy_file (#956)
• clippy warning on nightly (#960)
• remove extra alloc used to copy (#938)
• lazy allocation on error case (#937)
• fix data alignment (#929)

... (truncated)

Changelog

Sourced from zip's changelog.

9.0.1 - 2026-10-10

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

9.0.0 - 2026-10-08

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)
• use ZipFileEntry instead of ZipStreamFileMetadata (#935)
• add ZipFileEntry with no Reader (#933)
• change aes_mode to aes_settings() in ZipFileData (#925)
• cleanup and harmonize extra fields (#923)
• Rewrite zip64 extra (#913)

🐛 Bug Fixes

• reading an empty AES entry again at EOF returns Ok(0) (#1024)
• reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
• apply central directory metadata in ZipStreamReader, only to written entries (#1030)
• consume the whole extended timestamp field in the central header (#1016)
• parse the central header of the extended timestamp (#1002)
• don't pre-allocate the declared size in the legacy decoders (#991)
• Symlink with very large declared size could lead to out-of-memory panic (#984)
• copy extra fields in raw_copy_file (#955) (#982)
• add unix_mode when copy_raw_file (#981)
• rewrite documentation of add_symlink_from_path (#979)
• ignore a ZIP64 extra field that no sentinel asked for (#962)
• do not set data descriptor if directory (#973)
• expose flags function for easier access (#972)
• preserve unix permission in raw_copy_file (#956)
• clippy warning on nightly (#960)
• remove extra alloc used to copy (#938)

... (truncated)

Commits

• ac26df1 chore: release v9.0.1 (#1045)
• c605dfa style: cargo fmt --all (#1044)
• 114875a fix: set_permissions was still following symlinks in non-streaming extraction...
• 4f278b4 Merge commit from fork
• 2528ff7 fix: two arithmetic overflows in the implode decoder (#1028)
• 50f0434 ci(deps): bump codelytv/pr-size-labeler from 1.11.1 to 1.12.0 (#1042)
• 25bb3de fix: reject an empty archive whose central directory offset is past the EOCD ...
• f31c01d fix: don't panic when two entries extract to the same path (#1023)
• 71efbd8 fix: fail reads that exceed the declared uncompressed size (#1022)
• fd7c9b1 fix: shrink decoder skipped LZW code 8191 (#1029)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.41%. Comparing base (d8c28eb) to head (34bb3c3).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #504      +/-   ##
==========================================
+ Coverage   99.25%   99.41%   +0.16%     
==========================================
  Files          26       28       +2     
  Lines        5759     6487     +728     
==========================================
+ Hits         5716     6449     +733     
+ Misses         43       38       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.