build(deps): bump the cargo-minor-and-patch group with 6 updates

[dependabot]

Bumps the cargo-minor-and-patch group with 6 updates:

Package	From	To
serde	1.0.228	1.0.229
blake3	1.8.4	1.8.7
chrono	0.4.44	0.4.45
freenet-stdlib	0.8.3	0.8.5
dioxus	0.7.4	0.7.10
serde_json	1.0.149	1.0.151

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates blake3 from 1.8.4 to 1.8.7

Release notes

Sourced from blake3's releases.

1.8.7

version 1.8.7

Changes since 1.8.6:

• Remove the arrayref dependency. Unfortunately the crates.io owner was compromised.

1.8.6

version 1.8.6

Changes since 1.8.5:

• update_mmap and update_mmap_rayon (and by extension b3sum) now use seek rather than metadata to get the length of a file/mapping, and they tolerate mmap failures. That means b3sum will now memory map e.g. Linux block devices, which support mapping despite reporting length 0 in metadata. Hashing NUL files on Windows also works now, where previously it was an error unless you used --no-mmap or <. This change was originally proposed by @​nabijaczleweli.

1.8.5

version 1.8.5

Changes since 1.8.4:

• Forcibly disable LTO when compiling C intrinsics from the Rust build. This fixes a build break on Arch Linux ARM: BLAKE3-team/BLAKE3#550

Commits

• f3149ec version 1.8.7
• b65bcb7 add #[allow(deprecated)] annotations to fix nightly/beta warnings
• 483a220 fix warnings related to not using MAX constants
• ba02549 Codex: remove arrayref
• 77b257e version 1.8.6
• 83b1746 use seek instead of metadata to establish mmap length (#570)
• 9eac279 use vswhere to find Visual Studio in CI
• fc3d0e9 Fix path to Visual Studio toolchain in CI
• 8aa5145 a few more colons
• 6bb9773 use cargo:: build script syntax
• Additional commits viewable in compare view

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in chronotope/chrono#1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in chronotope/chrono#1789

Commits

• 1703382 Prepare 0.4.45 release
• 881f9ab tz_data: fix tzdata locations on Android
• f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
• c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
• 120686c Bump codecov/codecov-action from 5 to 6
• See full diff in compare view

Updates freenet-stdlib from 0.8.3 to 0.8.5

Changelog

Sourced from freenet-stdlib's changelog.

[0.8.5] - 2026-07-27

Fixed

• Related-contract decoding no longer panics on well-formed requests. RelatedStateUpdate.related_to, RelatedDeltaUpdate.related_to, RelatedStateAndDeltaUpdate.related_to and RelatedContract.instance_id were decoded with ContractInstanceId::from_bytes(..).unwrap(). That function is a base58 string decoder, and the wire carries the id as 32 raw bytes. This was not an edge case: a random 32-byte id essentially never consists solely of base58 characters (the alphabet is 58 of 256 byte values, so the odds are about 2e-21), so every FlatBuffers UPDATE carrying a related update, and every PUT carrying a related contract, panicked the client's connection task. The PUT case stayed hidden because the loop body only runs on a non-empty vector and the TypeScript suite's fixture passes an empty one.

  Stated plainly, because it is not purely a panic fix: those four fields are now raw-bytes-only. The old decoder did accept base58 text there (that is the one input base58 decoding handles), so a client that worked around the panic by sending text at exactly those fields is rejected now. Raw bytes is what the schema type carries everywhere else, including ContractKey.instance in the same request.

• Four more length-unchecked (required) fields no longer panic. DelegateKey.key, SecretsId.hash, RegisterDelegate.cipher and RegisterDelegate.nonce were read with copy_from_slice or try_from(..).unwrap() into fixed-size arrays. The flatbuffers verifier checks that a (required) vector is PRESENT, not that it is the right LENGTH, so any client could send a short one and take down its connection task. DelegateKey is on the normal delegate path, and the TypeScript SDK exports it as the raw generated type with no length validation.

• Four union discriminants no longer hit unreachable!(). ContractType, DelegateType, UpdateDataType and InboundDelegateMsgType were decoded with unreachable!() on an unrecognized discriminant, but every generated union verifier ends in _ => Ok(()), so any discriminant a client sets reaches the decoder's match. All four now return a per-request error, matching what ContractRequestType and DelegateRequestType already did; those two, plus ClientRequestType, now share the same error shape and all report the offending value.

  A single test sweeps all 256 discriminants of all seven unions currently on the decode path, and a source-scrape test fails CI if a new decoder reintroduces either shape.

• HostResponse's three related-update variants now encode related_to as raw bytes. They wrote related_to.encode() - base58 text - into common.ContractInstanceId.data, which every other producer and every consumer treats as 32 raw bytes. This is the encode half of the same bug, and it survived because Rust only encodes host responses while only TypeScript

... (truncated)

Commits

• f4636e5 chore: release freenet-stdlib 0.8.5 (#89)
• 704b9d0 fix: stop the flatbuffers decode boundary panicking on client input (#88)
• 87b9b79 fix: pass ContractKey code hash through FBS decode instead of re-hashing (#85)
• aab7516 fix: deliver the buffered response when recv()'s stream channel closes first ...
• 32b8908 feat: add DelegateRequest::RegisterDelegateWithPredecessors for secret copy-f...
• See full diff in compare view

Updates dioxus from 0.7.4 to 0.7.10

Release notes

Sourced from dioxus's releases.

v0.7.10

What's Changed

• [v0.7] Fix hotpatching when the bin target's crate name differs from the package name by @​nicoburns in DioxusLabs/dioxus#5720

Full Changelog: DioxusLabs/dioxus@v0.7.9...v0.7.10

v0.7.9

This release fixes an issue where dx --version would use an outdated git SHA, and dioxus-cli installed from cargo install would not have a version at all, preventing self-update from functioning properly.

Full Changelog: DioxusLabs/dioxus@v0.7.8...v0.7.9

v0.7.8

This release fixes a few small bugs discovered while working on v0.8. We decided the backport these to bring out fixes faster.

What's Changed

• Fix macos signing/notarization (0.7 backport) by @​nicoburns in DioxusLabs/dioxus#5528
• fix: toctou in wasm hotpatch apply_patch causing UB by @​jkelleyrtp in DioxusLabs/dioxus#5534
• backport iframe fix to v0.7 by @​jkelleyrtp in DioxusLabs/dioxus#5535

Full Changelog: DioxusLabs/dioxus@v0.7.7...v0.7.8

v0.7.7

This release fixes a regression with JS bundling where DX would always bundle JS snippets as ESM, even though they might be CJS, UMD, or a generic JS snippet. We now properly detect the js module type and then run esbuild with the appropriate flags.

What's Changed

• autodetect js module type - only bundle esm by @​jkelleyrtp in DioxusLabs/dioxus#5515

Full Changelog: DioxusLabs/dioxus@v0.7.6...v0.7.7

v0.7.6

Dioxus v0.7.6

This release solves a large number of bugs and adds a few new features! We intend for it to be the final release of 0.7 - our git repo will now ship breaking changes in prep for 0.8.

• Shell-completions for dx using dx completions
• Much faster dev server starts for dx serve --hotpatch
• Dioxus web apps that panic while handling events will no longer brick the webpage
• 20+ new code examples
• cursor editor debug support
• Windows app icon bundling in dx serve and dx bundle

What's Changed

• Fix too restrictive Clone bounds in props with generics by @​Gohla in DioxusLabs/dioxus#5451
• fix: ensure file type bit is set for rpm bundle by @​acrilique in DioxusLabs/dioxus#5459
• Fix autofill event downcast - ignore events of the wrong type by @​ealmloff in DioxusLabs/dioxus#5379
• Add shell-completions for dx by @​sermuns in DioxusLabs/dioxus#5232
• fix(autofmt): add support for handling comments in various expression types by @​jkelleyrtp in DioxusLabs/dioxus#5461
• fix: Content-hash-based filename when bundling with wasm_split by @​SuperKenVery in DioxusLabs/dioxus#5340
• feat: add blanket IntoAttributeValue impl for references by @​tmchow in DioxusLabs/dioxus#5447

... (truncated)

Commits

• 57d6794 release v0.7.10
• fda083b Fix hotpatching when the bin target's crate name differs from the package nam...
• 3e43ffa release v0.7.9
• bfcc111 fix: git sha for cli
• d1ead87 fix: make instantiate async
• f5be0ea release v0.7.8
• f1a0124 backport iframe fix to v0.7 (#5535)
• 003ec32 fix: toctou in wasm apply_patch causing UB (#5534)
• 83f492d Fix macos signing/notarization (0.7 backport) (#5528)
• a7c0e3b release v0.7.7
• Additional commits viewable in compare view

Updates serde_json from 1.0.149 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions