build(deps): bump the all-dependencies-cargo group with 8 updates

[dependabot]

Bumps the all-dependencies-cargo group with 8 updates:

Package	From	To
serde_json	1.0.150	1.0.151
regex	1.12.4	1.13.1
mlua	0.11.6	0.12.0
handlebars	6.4.2	6.4.3
clap_complete	4.6.7	4.6.8
serde	1.0.228	1.0.229
toml	1.1.2+spec-1.1.0	1.1.4+spec-1.1.0
clap	4.6.1	4.6.4

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• See full diff in compare view

Updates regex from 1.12.4 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

• #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

Commits

• 2b52759 1.13.1, redux
• 40e9823 1.13.1
• 75fcb96 changelog: 1.13.1
• 64ad0b6 automata: fix bug in reverse suffix/inner optimization
• fa91c31 automata: fix a bug caught by Codex review
• 30390ec automata: formatting tweaks
• 821a8eb automata: refactor reverse suffix/inner search slightly
• 10afd70 automata: expose the extracted literals for inner literal extraction
• 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
• 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
• Additional commits viewable in compare view

Updates mlua from 0.11.6 to 0.12.0

Release notes

Sourced from mlua's releases.

v0.12.0

Highlights

More ergonomic UserData building blocks

• Declaratively implement UserData with #[derive(UserData)] and register methods/fields with the new #[mlua::userdata_impl] attribute macro.
• UserDataOwned<T> wrapper takes ownership of userdata and implements FromLua
• UserDataMethods::add_method_once/add_async_method_once
• __todebugstring metamethod for pretty-printing userdata when debugging
• MaybeSync trait for userdata under the send feature

Reorganized public API

Types are now grouped into focused modules: chunk, debug, error, function, table, string, state, thread, userdata and luau.

Thread lifecycle callbacks

Hook into coroutine create/resume/yield events across all Lua versions (when using mlua API).

Luau improvements

Latest Luau with extended require-by-string support and JIT options.

Garbage-collector interface refactor

Lua::gc_inc / Lua::gc_gen are replaced by a Lua::gc_set_mode, with GcIncParams/GcGenParams for fine-grained tuning.

What's Changed (since v0.12.0-rc.2)

• Crate root re-exports are refactored (only essentials are re-exported, the rest is in the new submodules)
• Added ThreadStatus::Normal and Thread::is_normal (mimic coroutine.status)
• Added Lua::set_jit_options with support of Luau JIT inliner (Luau)
• Added Value::as_vector/Value::is_vector (Luau)
• Added Table::remove
• serde: tables with the array metatable are always encoded as arrays (incl. detect_mixed_tables option)
• impl Hash for BorrowedStr/BorrowedBytes
• Lua::current_thread resolves implicit async threads to their root owner (#706)
• Bugfixes and improvements

Full Changelog: mlua-rs/mlua@v0.11.6...v0.12.0

v0.12.0-rc.2

The new stable version is almost ready and will be released after some testing

What's Changed

• Add #[derive(UserData)] and #[userdata_impl] macros
• Support thread create/resume/yield callbacks for all Lua versions (including Luau)
• Support to_alias_override/to_alias_fallback in Require trait (Luau)
• Prevent XRc overflow when dropping RawLua with foreign Lua state

... (truncated)

Changelog

Sourced from mlua's changelog.

v0.12.0 (Jul 05, 2026)

Changes since v0.12.0-rc.2

• Create root re-exports are refactored (only essentials are re-exported, the rest is in the new submodules)
• Added ThreadStatus::Normal and Thread::is_normal (mimic coroutine.status)
• Added Lua::set_jit_options with support of Luau JIT inliner (Luau)
• Added Value::as_vector/Value::is_vector (Luau)
• Added Table::remove
• serde: tables with the array metatable are always encoded as arrays (incl. detect_mixed_tables option)
• impl Hash for BorrowedStr/BorrowedBytes
• Lua::current_thread resolves implicit async threads to their root owner (#706)
• Bugfixes and improvements

v0.12.0-rc.2 (Jun 06, 2026)

• Add #[derive(UserData)] and #[mlua::userdata_impl] macros
• Support thread create/resume/yield callbacks for all Lua versions (including Luau)
• Support to_alias_override/to_alias_fallback in Require trait (Luau)
• Prevent XRc overflow when dropping RawLua with foreign Lua state
• implement Not for StdLib (#699)
• Fix String::to_pointer return NULL in Lua <5.4

v0.12.0-rc.1 (Apr 21, 2026)

• Rust 2024 edition
• Removed Error::ToLuaConversionError variant as it was unused (and not practically useful)
• New modules to group data types: chunk, debug, error, function, table, string, state, thread, userdata, luau
• Support __todebugstring metamethod for pretty formatting userdata value (for debugging)
• New MaybeSync trait that is required for userdata types
• Removed lifetime from BorrowedStr and BorrowedBytes
• New Thread methods: is_resumable, is_running, is_finished, is_error
• Added Thread::state to get raw Lua state pointer
• Luau TextRequirer is renamed to FsRequirer
• GC interface refactor: Lua::gc_inc/Lua::gc_gen is replaced with gc_set_mode
• Added GcIncParams and GcGenParams for GC tuning
• New UserDataMethods::add_method_once and UserDataMethods::add_async_method_once
• Initial Luau integer64 type support
• Changed interface of Function::wrap/wrap_mut/wrap_async to support any Error type
• Changed AnyUserData::type_name to return LuaString instead
• Added UserDataOwned<T> wrapper to take ownership of userdata T and implements FromLua

Commits

• 8eddf85 v0.12.0
• 46d3783 Update CHANGELOG
• 7ddcdc1 Add Table::remove
• 6b19eeb Make VmState as non_exhaustive
• b64da48 Make NavigateError as non_exhaustive (Luau)
• cddbcc5 Refactor crate-root re-exports and drop hidden backward-compat aliases
• 1af17ec Various doc updates and refinement
• eef5985 Rename LuaJitOptions to LuauJitOptions in prelude
• 9099d5f Rename JitOptions::set_inliner to JitOptions::inliner for consistency
• 34825d6 Fix Lua::gc_set_mode panic when GC is internally stopped (Lua 5.4/5.5)
• Additional commits viewable in compare view

Updates handlebars from 6.4.2 to 6.4.3

Release notes

Sourced from handlebars's releases.

v6.4.3

What's Changed

• chore: drop pprof dev-dependency to remove vulnerable quick-xml by @​sunng87 in sunng87/handlebars-rust#769
• chore(deps-dev): bump ws from 8.18.0 to 8.21.0 in /playground/www by @​dependabot[bot] in sunng87/handlebars-rust#770
• feat: add preserve_json_order feature flag by @​sunng87 in sunng87/handlebars-rust#767
• fix: handle leading tilde on else if chain tags by @​sunng87 in sunng87/handlebars-rust#768

Full Changelog: sunng87/handlebars-rust@v6.4.2...v6.4.3

Changelog

Sourced from handlebars's changelog.

[6.4.3] - 2026-07-12

• [Fixed] Panic when using whitespace omission (~) on an else if chain tag, e.g. {{~else if cond}}. The leading tilde is now handled consistently with {{~else}} #766
• [Added] preserve_json_order feature flag that gates serde_json's preserve_order feature. Enabled by default to keep insertion-order key iteration; disable with default-features = false to restore alphabetical JSON object key ordering. #767
• [Changed] Drop the pprof dev-dependency (and its inferno / quick-xml transitive deps) from benchmarks. This removes the vulnerable quick-xml 0.26 transitive dependency (#764, #765); the upgrade was blocked upstream because pprof pins inferno 0.11. Benchmarks now use plain criterion without in-repo flamegraph generation.

Commits

• ed6090f chore: Release handlebars version 6.4.3
• 924fcef chore: update changelog
• aa3aaa0 fix: handle leading tilde on else if chain tags (#768)
• 747133f feat: add preserve_json_order feature flag (#767)
• 5bc756b chore(deps-dev): bump ws from 8.18.0 to 8.21.0 in /playground/www (#770)
• 488a9f9 chore: drop pprof dev-dependency to remove vulnerable quick-xml (#769)
• See full diff in compare view

Updates clap_complete from 4.6.7 to 4.6.8

Commits

• d93a00d chore: Release
• 4709d1a docs(complete): Update changelog
• 2246e8b Merge pull request #6455 from epage/possible
• 2550f32 feat(complete): Expose possible value completers
• 9048857 refactor(complete): Pull out possible values candidate conversion
• 0607d66 refactor(complete): Remove unused allocation
• 943de73 refactor(complete): Move related functions next to each other
• 81b86a9 refactor(complete): Generalize value candidate handling
• ae09202 refactor(complete): Remove extra allocation
• 466b2be chore: Release
• Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.4+spec-1.1.0

Commits

• beee9fe chore: Release
• 16e2ac1 docs: Update changelog
• 89f5541 fix(toml): preserve datetimes when deserializing Value (#1194)
• 534039c fix(serde): Deserialize Value datetimes into typed targets
• 6e45cef test(serde): Reproduce Value datetime deserialization error
• 4ec099f chore: Release
• 5a47a51 docs: Update changelog
• da0911f perf(parser): Reduce over allocation by better tokens/byte ratio (#1193)
• 26eb157 perf(parser): Reduce over allocation by better tokens/byte ratio
• ca4c7bf chore(deps): Update Prek to v0.4.11 (#1191)
• Additional commits viewable in compare view

Updates clap from 4.6.1 to 4.6.4

Release notes

Sourced from clap's releases.

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Changelog

Sourced from clap's changelog.

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Commits

• 87ec1ad chore: Release
• 78f2529 docs: Update changelog
• b61f270 Merge pull request #6369 from Metbcy/fix/zsh-completion-ordering
• 74c6666 fix(complete): Keep zsh candidate order
• d142d8f Merge pull request #6360 from epage/string
• ba89563 style: Prefer explicit string operations
• bea966e Merge pull request #6359 from epage/man
• b811986 chore(man):Remove unused required-features
• 0010bf2 Merge pull request #6358 from clap-rs/renovate/crate-ci-typos-1.x
• bab9b24 chore(deps): Update compatible (dev) (#6357)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions