build(deps): bump the cargo group with 11 updates

[dependabot]

Bumps the cargo group with 11 updates:

Package	From	To
brioche-pack	0106894	93c20b8
ar_archive_writer	0.5.1	0.5.2
cc	1.2.63	1.2.64
memchr	2.8.1	2.8.2
regex-syntax	0.8.10	0.8.11
time	0.3.47	0.3.49
time-core	0.1.8	0.1.9
time-macros	0.2.27	0.2.29
wasip2	1.0.3+wasi-0.2.9	1.0.4+wasi-0.2.12
zerocopy	0.8.50	0.8.52
zerocopy-derive	0.8.50	0.8.52

Updates brioche-pack from 0106894 to 93c20b8

Commits

• 93c20b8 perf(script): speed up JavaScript runtime startup (#476)
• a66a664 feat(git): support SHA-256 git repositories (#475)
• f9e2b53 Build(deps): bump the cargo group with 5 updates (#477)
• See full diff in compare view

Updates ar_archive_writer from 0.5.1 to 0.5.2

Commits

• 0182515 Bump version to 0.5.2
• e5295d2 Merge pull request #32 from rust-lang/fix_large_archives
• 9f1cbd1 Avoid panic when there are more than 64k archive members
• 1e137ce Merge pull request #33 from ilka-schulz/add-msrv
• 73b44bc fix clippy warning: remove manual implementation of "is_multiple_of" – https:...
• 02efe91 add MSRV 1.88.0 to Cargo.toml, determined with "cargo msrv find"
• See full diff in compare view

Updates cc from 1.2.63 to 1.2.64

Release notes

Sourced from cc's releases.

cc-v1.2.64

Other

• Add more bare-metal 32-bit Arm support (#1753)
• Remove unnecessary clone (#1748)
• Add default compiler prefixes for thumbv7a/thumbv7r/thumbv8r bare-metal targets (#1742)

Changelog

Sourced from cc's changelog.

1.2.64 - 2026-06-12

Other

• Add more bare-metal 32-bit Arm support (#1753)
• Remove unnecessary clone (#1748)
• Add default compiler prefixes for thumbv7a/thumbv7r/thumbv8r bare-metal targets (#1742)

Commits

• f0c8998 chore(cc): release v1.2.64 (#1757)
• 1cb49a7 Add more bare-metal 32-bit Arm support (#1753)
• 44212e0 Bump actions/checkout from 6.0.2 to 6.0.3 (#1751)
• 9c81f5d Remove unnecessary clone (#1748)
• a2bcb6e Update rusqlite requirement from 0.39.0 to 0.40.0 (#1744)
• b2e811e Add default compiler prefixes for thumbv7a/thumbv7r/thumbv8r bare-metal targe...
• See full diff in compare view

Updates memchr from 2.8.1 to 2.8.2

Commits

• a61ac1a 2.8.2
• a08bf90 arch: fix undefined behavior in lower level (but public) APIs
• b41293b rebar: update memchr to latest
• 87467c9 impl: remove unnecessary clones in into_owned impls
• See full diff in compare view

Updates regex-syntax from 0.8.10 to 0.8.11

Commits

• 1401679 regex-syntax-0.8.11
• d709000 changelog: 1.12.4
• 9825c74 syntax: avoid re-canonicalizing the entire IntervalSet on push (#1308)
• a7f2ff6 docs: clarify regex-lite word boundaries
• 2c7b172 docs: clarify unsupported Anchored::Pattern searches
• See full diff in compare view

Updates time from 0.3.47 to 0.3.49

Release notes

Sourced from time's releases.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.49 [2026-06-13]

Fixed

• Due to a long-standing bug in the Rust compiler, v0.3.48 caused a number of crates to stop compiling. A patch has been added that avoids triggering the bug.

0.3.48 [2026-06-12] [YANKED]

Security

• The number of digits parsed by [subsecond digits:1+] is capped at 32 to avoid parsing unbounded user input. Digits after the 9th have no semantic meaning.
• Explicitly specify #[repr] for Weekday. The value of the variants is relied upon in multiple locations for soundness. The practical effect of this change is nothing, as Rust has always mapped C-like enums to 0..N in memory.

Compatibility

• Non-UTF-8 formatting and parsing is deprecated without replacement. It is recommended to only format and parse valid UTF-8.
• format_description::parse is deprecated. It is recommended to use format_description::parse_borrowed::<3> or format_description::parse_owned::<3>.

Added

• All types in the unit module have a generic parameter, though this is currently not used for much. Usage will be expanded in the future.
• Comparisons between types in the unit module and the generic Unit type are permitted.
• Support for rand 0.10
• Version 3 format descriptions
  • Only UTF-8 is supported. As a side effect of this, [ignore] requires that the remaining input not begin mid-codepoint.
  • Representation is deliberately opaque to allow for arbitrary changes going forward.
  • format:false is supported on [optional] components. This is not possible in version 1 and version 2 format descriptions due to API compatibility.
  • The time::serde::format_description! macro uses a new, clearer syntax for version 3.
    • time::serde::format_description!(mod foo [Date] = "[year]-[month]-[day]");
    • Unlike version 1 and version 2 format descriptions, the type is not automatically brought into scope. You must import it yourself.
  • Nonsensical combinations of modifiers are rejected. For example, you cannot specify case-sensitivity when parsing a numerical month.
  • [year] defaults to range:standard
  • Components and modifiers are case sensitive (and always lowercase).

Changed

• The convert module has been renamed to unit.

Fixed

... (truncated)

Commits

• ff8683c v0.3.49 release
• f189886 fix: resolve E0119 trait coherence error in rustc >= 1.95.0
• 5d8737c v0.3.48 release
• 1bfca87 Use widen instead of extend in sys code
• c57284f fix: return error instead of panicking on truncated strftime padding modifier
• a74f35f Use v3 format descriptions for serde defaults
• 96ff36c Allow eliding serde format description version
• edc58b1 Permit duplicates in v1/v2 in permit_modifiers!
• a838f69 Bump codecov action
• f2f99f8 Fix unused warning
• Additional commits viewable in compare view

Updates time-core from 0.1.8 to 0.1.9

Changelog

Sourced from time-core's changelog.

Changelog

All notable changes to the time project will be documented in this file.

The format is based on [Keep a Changelog]. This project adheres to [Semantic Versioning].

---

0.3.49 [2026-06-13]

Fixed

• Due to a long-standing bug in the Rust compiler, v0.3.48 caused a number of crates to stop compiling. A patch has been added that avoids triggering the bug.

0.3.48 [2026-06-12] [YANKED]

Security

• The number of digits parsed by [subsecond digits:1+] is capped at 32 to avoid parsing unbounded user input. Digits after the 9th have no semantic meaning.
• Explicitly specify #[repr] for Weekday. The value of the variants is relied upon in multiple locations for soundness. The practical effect of this change is nothing, as Rust has always mapped C-like enums to 0..N in memory.

Compatibility

• Non-UTF-8 formatting and parsing is deprecated without replacement. It is recommended to only format and parse valid UTF-8.
• format_description::parse is deprecated. It is recommended to use format_description::parse_borrowed::<3> or format_description::parse_owned::<3>.

Added

• All types in the unit module have a generic parameter, though this is currently not used for much. Usage will be expanded in the future.
• Comparisons between types in the unit module and the generic Unit type are permitted.
• Support for rand 0.10
• Version 3 format descriptions
  • Only UTF-8 is supported. As a side effect of this, [ignore] requires that the remaining input not begin mid-codepoint.
  • Representation is deliberately opaque to allow for arbitrary changes going forward.
  • format:false is supported on [optional] components. This is not possible in version 1 and version 2 format descriptions due to API compatibility.
  • The time::serde::format_description! macro uses a new, clearer syntax for version 3.
    • time::serde::format_description!(mod foo [Date] = "[year]-[month]-[day]");
    • Unlike version 1 and version 2 format descriptions, the type is not automatically brought into scope. You must import it yourself.
  • Nonsensical combinations of modifiers are rejected. For example, you cannot specify case-sensitivity when parsing a numerical month.

... (truncated)

Commits

• See full diff in compare view

Updates time-macros from 0.2.27 to 0.2.29

Commits

• See full diff in compare view

Updates wasip2 from 1.0.3+wasi-0.2.9 to 1.0.4+wasi-0.2.12

Commits

• 1edbc7a Update WASI to 0.2.12 and 0.3.0 (#158)
• See full diff in compare view

Updates zerocopy from 0.8.50 to 0.8.52

Release notes

Sourced from zerocopy's releases.

v0.8.52

What's Changed

• Introduce derive(most_traits) and rename unstable linux cfg by @​jswrenn in google/zerocopy#3416
• zerocopy: add SPDX-License-Identifier to source files by @​joshlf in google/zerocopy#3455

Full Changelog: google/zerocopy@v0.8.51...v0.8.52

v0.8.51

What's Changed

• [byteorder] Add cfg no_fp_fmt_parse by @​eiffel-fl in google/zerocopy#3429
• [derive] Remove unnecessary clones by @​FranciscoTGouveia in google/zerocopy#3449

New Contributors

• @​platonicsock made their first contribution in google/zerocopy#3424
• @​eiffel-fl made their first contribution in google/zerocopy#3429
• @​FranciscoTGouveia made their first contribution in google/zerocopy#3449

Full Changelog: google/zerocopy@v0.8.50...v0.8.51

Commits

• 8beb48b Release 0.8.52 (#3456)
• 6f7583b zerocopy: add SPDX-License-Identifier to source files (#3455)
• 8d7db04 Introduce derive(most_traits) and rename unstable linux cfg (#3416)
• 21f8388 Release 0.8.51 (#3454)
• 0e29474 [derive] Remove unnecessary clones (#3449)
• 88536c1 Skip benchmark storage outside canonical main (#3452)
• 7055b34 Fix create-pull-request action pins and update GitHub Actions workflow pins (...
• 83dbc57 Release Anneal 0.1.0-alpha.24 (#3446)
• 0949784 [anneal][release] Upload toolchain archives before publishing release (#3445)
• 7a0a880 [anneal][release] Publish Nix-built toolchain archives (#3441)
• Additional commits viewable in compare view

Updates zerocopy-derive from 0.8.50 to 0.8.52

Release notes

Sourced from zerocopy-derive's releases.

v0.8.52

What's Changed

• Introduce derive(most_traits) and rename unstable linux cfg by @​jswrenn in google/zerocopy#3416
• zerocopy: add SPDX-License-Identifier to source files by @​joshlf in google/zerocopy#3455

Full Changelog: google/zerocopy@v0.8.51...v0.8.52

v0.8.51

What's Changed

• [byteorder] Add cfg no_fp_fmt_parse by @​eiffel-fl in google/zerocopy#3429
• [derive] Remove unnecessary clones by @​FranciscoTGouveia in google/zerocopy#3449

New Contributors

• @​platonicsock made their first contribution in google/zerocopy#3424
• @​eiffel-fl made their first contribution in google/zerocopy#3429
• @​FranciscoTGouveia made their first contribution in google/zerocopy#3449

Full Changelog: google/zerocopy@v0.8.50...v0.8.51

Commits

• 8beb48b Release 0.8.52 (#3456)
• 6f7583b zerocopy: add SPDX-License-Identifier to source files (#3455)
• 8d7db04 Introduce derive(most_traits) and rename unstable linux cfg (#3416)
• 21f8388 Release 0.8.51 (#3454)
• 0e29474 [derive] Remove unnecessary clones (#3449)
• 88536c1 Skip benchmark storage outside canonical main (#3452)
• 7055b34 Fix create-pull-request action pins and update GitHub Actions workflow pins (...
• 83dbc57 Release Anneal 0.1.0-alpha.24 (#3446)
• 0949784 [anneal][release] Upload toolchain archives before publishing release (#3445)
• 7a0a880 [anneal][release] Publish Nix-built toolchain archives (#3441)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[jaudiger]

Looks good to me 🚀