From fcb4bd68b230a5acb8947b2128ee788b118a7789 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 10:12:36 +0000
Subject: [PATCH 1/9] chore(deps)(deps): bump the production-dependencies group
 with 9 updates

Bumps the production-dependencies group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [bitflags](https://github.com/bitflags/bitflags) | `2.13.0` | `2.13.1` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.19` |
| [toml](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.3+spec-1.1.0` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.0` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.33` |
| [cc](https://github.com/rust-lang/cc-rs) | `1.2.67` | `1.3.0` |
| [bytemuck](https://github.com/Lokathor/bytemuck) | `1.25.1` | `1.25.2` |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.2` |


Updates `bitflags` from 2.13.0 to 2.13.1
- [Release notes](https://github.com/bitflags/bitflags/releases)
- [Changelog](https://github.com/bitflags/bitflags/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bitflags/bitflags/compare/2.13.0...2.13.1)

Updates `thiserror` from 2.0.18 to 2.0.19
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](https://github.com/dtolnay/thiserror/compare/2.0.18...2.0.19)

Updates `toml` from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0
- [Commits](https://github.com/toml-rs/toml/compare/toml-v1.1.2...toml-v1.1.3)

Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.150...v1.0.151)

Updates `tokio` from 1.52.3 to 1.53.0
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.52.3...tokio-1.53.0)

Updates `futures-util` from 0.3.32 to 0.3.33
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/futures-rs/compare/0.3.32...0.3.33)

Updates `cc` from 1.2.67 to 1.3.0
- [Release notes](https://github.com/rust-lang/cc-rs/releases)
- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/cc-rs/compare/cc-v1.2.67...cc-v1.3.0)

Updates `bytemuck` from 1.25.1 to 1.25.2
- [Changelog](https://github.com/Lokathor/bytemuck/blob/main/changelog.md)
- [Commits](https://github.com/Lokathor/bytemuck/compare/v1.25.1...v1.25.2)

Updates `clap` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.1...clap_complete-v4.6.2)

---
updated-dependencies:
- dependency-name: bitflags
  dependency-version: 2.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: toml
  dependency-version: 1.1.3+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: tokio
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: futures-util
  dependency-version: 0.3.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cc
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bytemuck
  dependency-version: 1.25.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: clap
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock | 257 ++++++++++++++++++++++++++++-------------------------
 1 file changed, 134 insertions(+), 123 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e65eb940..cac2b6ff 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -77,7 +77,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812947049edcd670a82cd5c73c3661d2e58468577ba8489de58e1a73c04cbd5d"
 dependencies = [
  "alsa-sys",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "libc",
 ]
@@ -99,7 +99,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f2a1bb052857d5dd49572219344a7332b31b76405648eabac5bc68978251bcd"
 dependencies = [
  "android-properties",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cc",
  "jni",
  "libc",
@@ -109,7 +109,7 @@ dependencies = [
  "ndk-sys",
  "num_enum",
  "simd_cesu8",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -426,9 +426,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "block-buffer"
@@ -490,9 +490,9 @@ checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06"
 
 [[package]]
 name = "bytemuck"
-version = "1.25.1"
+version = "1.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
 dependencies = [
  "bytemuck_derive",
 ]
@@ -532,7 +532,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b99da2f8558ca23c71f4fd15dc57c906239752dd27ff3c00a1d56b685b7cbfec"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "log",
  "polling",
  "rustix 0.38.44",
@@ -582,7 +582,7 @@ dependencies = [
  "semver",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -602,9 +602,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.67"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
+checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -684,9 +684,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -694,9 +694,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstream",
  "anstyle",
@@ -918,7 +918,7 @@ version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d5d7dca3ebcf65a035582c9ad4385371a9d9ee6537474d2a278f4e1e475bb58"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "libc",
  "objc2-audio-toolbox",
  "objc2-core-audio",
@@ -1055,7 +1055,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "crossterm_winapi",
  "derive_more",
  "document-features",
@@ -1257,7 +1257,7 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.6.2",
  "libc",
  "objc2 0.6.4",
@@ -1322,7 +1322,7 @@ checksum = "2796c98d50b79631281d516343a6f6e93c0666462ca36e2c93b39f25d7793325"
 dependencies = [
  "accesskit",
  "ahash",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "emath",
  "epaint",
  "itertools 0.14.0",
@@ -1345,7 +1345,7 @@ dependencies = [
  "epaint",
  "log",
  "profiling",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "type-map",
  "web-time",
  "wgpu",
@@ -1632,15 +1632,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1649,21 +1649,21 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
 
 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
  "futures-core",
  "futures-macro",
@@ -1865,7 +1865,7 @@ dependencies = [
  "hashbrown 0.16.1",
  "log",
  "presser",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "windows",
 ]
 
@@ -1875,7 +1875,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b89c83349105e3732062a895becfc71a8f921bb71ecbbdd8ff99263e3b53a0ca"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "gpu-descriptor-types",
  "hashbrown 0.15.5",
 ]
@@ -1886,7 +1886,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdf242682df893b86f33a73828fb09ca4b2d3bb6cc95249707fc684d27484b91"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -1916,7 +1916,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0431e8e389aa0f1e72bb9d1c2db8957a1a7a3580e8ed97db819c14837aac9b3e"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytemuck",
  "read-fonts",
  "smallvec",
@@ -2180,7 +2180,7 @@ version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "153be1941a183ec9ccd095ddbe17a8b8d435ef6c76e9e02451b933c3999af2c8"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "inotify-sys",
  "libc",
 ]
@@ -2261,7 +2261,7 @@ dependencies = [
  "jni-sys 0.4.1",
  "log",
  "simd_cesu8",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "walkdir",
  "windows-link",
 ]
@@ -2336,7 +2336,7 @@ checksum = "bde5057d6143cc94e861d90f591b9303d6716c6b9602309150bd068853c10899"
 dependencies = [
  "hashbrown 0.16.1",
  "portable-atomic",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -2425,7 +2425,7 @@ version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "libc",
  "plain",
  "redox_syscall 0.9.0",
@@ -2458,7 +2458,7 @@ version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f50e8f47623268b5407192d26876c4d7f89d686ca130fdc53bced4814cd29f8"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -2671,7 +2671,7 @@ checksum = "b2bf919621e7975acb27d881bae2fb993e0d45c8e0446e85e6272971e00dc8df"
 dependencies = [
  "arrayvec",
  "bit-set 0.9.1",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "codespan-reporting",
@@ -2685,7 +2685,7 @@ dependencies = [
  "once_cell",
  "rustc-hash 1.1.0",
  "spirv",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "unicode-ident",
 ]
 
@@ -2695,7 +2695,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "jni-sys 0.3.1",
  "log",
  "ndk-sys",
@@ -2725,7 +2725,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -2738,7 +2738,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -2867,7 +2867,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "libc",
  "objc2 0.5.2",
@@ -2883,7 +2883,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.6.2",
  "objc2 0.6.4",
  "objc2-core-graphics",
@@ -2896,7 +2896,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6948501a91121d6399b79abaa33a8aa4ea7857fe019f341b8c23ad6e81b79b08"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "libc",
  "objc2 0.6.4",
  "objc2-core-audio",
@@ -2911,7 +2911,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13a380031deed8e99db00065c45937da434ca987c034e13b87e4441f9e4090be"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "objc2 0.6.4",
  "objc2-foundation 0.3.2",
 ]
@@ -2922,7 +2922,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74dd3b56391c7a0596a295029734d3c1c5e7e510a4cb30245f8221ccea96b009"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "objc2 0.5.2",
  "objc2-core-location",
@@ -2959,7 +2959,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a89f2ec274a0cf4a32642b2991e8b351a404d290da87bb6a9a9d8632490bd1c"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "objc2 0.6.4",
 ]
 
@@ -2969,7 +2969,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "objc2 0.5.2",
  "objc2-foundation 0.2.2",
@@ -2981,7 +2981,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.6.2",
  "dispatch2",
  "libc",
@@ -2994,7 +2994,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "dispatch2",
  "objc2 0.6.4",
  "objc2-core-foundation",
@@ -3037,7 +3037,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "dispatch",
  "libc",
@@ -3050,7 +3050,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.6.2",
  "libc",
  "objc2 0.6.4",
@@ -3063,7 +3063,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "libc",
  "objc2-core-foundation",
 ]
@@ -3074,7 +3074,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "objc2 0.6.4",
  "objc2-core-foundation",
 ]
@@ -3097,7 +3097,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "objc2 0.5.2",
  "objc2-foundation 0.2.2",
@@ -3109,7 +3109,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.6.2",
  "objc2 0.6.4",
  "objc2-foundation 0.3.2",
@@ -3121,7 +3121,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "objc2 0.5.2",
  "objc2-foundation 0.2.2",
@@ -3134,7 +3134,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "objc2 0.6.4",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -3157,7 +3157,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8bb46798b20cd6b91cbd113524c490f1686f4c4e8f49502431415f3512e2b6f"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "objc2 0.5.2",
  "objc2-cloud-kit",
@@ -3178,7 +3178,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "objc2 0.6.4",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -3201,7 +3201,7 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "76cfcbf642358e8689af64cee815d139339f3ed8ad05103ed5eaf73db8d84cb3"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "objc2 0.5.2",
  "objc2-core-location",
@@ -3541,7 +3541,7 @@ version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "crc32fast",
  "fdeflate",
  "flate2",
@@ -3679,7 +3679,7 @@ checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
 dependencies = [
  "bit-set 0.8.0",
  "bit-vec 0.8.0",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "num-traits",
  "rand 0.9.4",
  "rand_chacha 0.9.0",
@@ -3851,7 +3851,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cbb175c433c8e28a809d1f5773a2ae96e68c0ce40db865cbab1020bf33ae479c"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "compact_str",
  "critical-section",
  "hashbrown 0.17.1",
@@ -3861,7 +3861,7 @@ dependencies = [
  "palette",
  "serde",
  "strum",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "unicode-segmentation",
  "unicode-truncate",
  "unicode-width",
@@ -3916,7 +3916,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66e3d19bcc9130ca376277d93b60767ff121ace3be06f5f95f81dd68956407d1"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "hashbrown 0.17.1",
  "indoc",
  "instability",
@@ -4002,7 +4002,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -4011,7 +4011,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c5102a6aaa05aa011a238e178e6bca86d2cb56fc9f586d37cb80f5bca6e07759"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -4108,7 +4108,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
 dependencies = [
  "hashbrown 0.16.1",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -4117,7 +4117,7 @@ version = "0.40.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "11438310b19e3109b6446c33d1ed5e889428cf2e278407bc7896bc4aaea43323"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink",
@@ -4215,7 +4215,7 @@ version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
@@ -4228,7 +4228,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
@@ -4310,13 +4310,13 @@ dependencies = [
 name = "rustynes-apu"
 version = "2.2.1"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "criterion",
  "libm",
  "pretty_assertions",
  "proptest",
  "realfft",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -4331,7 +4331,7 @@ dependencies = [
 name = "rustynes-core"
 version = "2.2.1"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "criterion",
  "lz4_flex",
  "pretty_assertions",
@@ -4341,18 +4341,18 @@ dependencies = [
  "rustynes-ppu",
  "serde",
  "sha2 0.11.0",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
 name = "rustynes-cpu"
 version = "2.2.1"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "criterion",
  "pretty_assertions",
  "proptest",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -4396,7 +4396,7 @@ dependencies = [
  "sha1",
  "sha2 0.11.0",
  "tempfile",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "toml",
  "ureq",
  "wasm-bindgen",
@@ -4451,12 +4451,12 @@ dependencies = [
 name = "rustynes-mappers"
 version = "2.2.1"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "criterion",
  "pretty_assertions",
  "proptest",
  "rustynes-apu",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -4468,7 +4468,7 @@ dependencies = [
  "rustynes-netplay",
  "rustynes-ra",
  "rustynes-script",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tungstenite",
  "uniffi",
  "zip",
@@ -4489,7 +4489,7 @@ dependencies = [
  "js-sys",
  "rustynes-core",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tokio-tungstenite",
  "tungstenite",
@@ -4501,12 +4501,12 @@ dependencies = [
 name = "rustynes-ppu"
 version = "2.2.1"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "criterion",
  "libm",
  "pretty_assertions",
  "proptest",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -4524,7 +4524,7 @@ dependencies = [
  "piccolo",
  "rusqlite",
  "rustynes-core",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -4536,7 +4536,7 @@ dependencies = [
  "pretty_assertions",
  "rustynes-core",
  "sha2 0.11.0",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "zip",
 ]
 
@@ -4657,9 +4657,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -4830,7 +4830,7 @@ version = "0.19.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "calloop",
  "calloop-wayland-source",
  "cursor-icon",
@@ -4874,7 +4874,7 @@ version = "0.4.0+sdk-1.4.341.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9571ea910ebd84c86af4b3ed27f9dbdc6ad06f17c5f96146b2b671e2976744f"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -4974,6 +4974,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a207d6d6a2b7fc470b80443726053f18a2481b7e1eee970597051596567987a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -5013,7 +5024,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9048a889effe34a5cddee0af7f53285198b16dca3be510858d38dfdb3e62a04e"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "parking_lot",
  "rustix 1.1.4",
  "signal-hook",
@@ -5049,7 +5060,7 @@ checksum = "4676b37242ccbd1aabf56edb093a4827dc49086c0ffd764a5705899e0f35f8f7"
 dependencies = [
  "anyhow",
  "base64",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "fancy-regex",
  "filedescriptor",
  "finl_unicode",
@@ -5103,11 +5114,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl 2.0.19",
 ]
 
 [[package]]
@@ -5123,13 +5134,13 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.2",
 ]
 
 [[package]]
@@ -5229,9 +5240,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee"
 dependencies = [
  "bytes",
  "libc",
@@ -5267,9 +5278,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
+checksum = "53c96ecdfa941c8fc4fcaed14f99ada8ebed502eef533015095a07e3301d4c3c"
 dependencies = [
  "indexmap",
  "serde_core",
@@ -5312,9 +5323,9 @@ dependencies = [
 
 [[package]]
 name = "toml_writer"
-version = "1.1.1+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 
 [[package]]
 name = "tracing"
@@ -5363,7 +5374,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "sha1",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "webpki-roots 0.26.11",
 ]
 
@@ -5657,7 +5668,7 @@ dependencies = [
  "log",
  "peniko",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -5796,7 +5807,7 @@ version = "0.31.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "645c7c96bb74690c3189b5c9cb4ca1627062bb23693a4fad9d8c3de958260144"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "rustix 1.1.4",
  "wayland-backend",
  "wayland-scanner",
@@ -5808,7 +5819,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cursor-icon",
  "wayland-backend",
 ]
@@ -5830,7 +5841,7 @@ version = "0.32.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "wayland-backend",
  "wayland-client",
  "wayland-scanner",
@@ -5842,7 +5853,7 @@ version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b6d8cf1eb2c1c31ed1f5643c88a6e53538129d4af80030c8cabd1f9fa884d91"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "wayland-backend",
  "wayland-client",
  "wayland-protocols",
@@ -5855,7 +5866,7 @@ version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "wayland-backend",
  "wayland-client",
  "wayland-protocols",
@@ -6033,7 +6044,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "76e8840e1ba2881d4cbb18d2147627a56af426ff064c0401eb0c8410c6325d07"
 dependencies = [
  "arrayvec",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytemuck",
  "cfg-if",
  "cfg_aliases",
@@ -6065,7 +6076,7 @@ dependencies = [
  "arrayvec",
  "bit-set 0.9.1",
  "bit-vec 0.9.1",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytemuck",
  "cfg_aliases",
  "document-features",
@@ -6080,7 +6091,7 @@ dependencies = [
  "raw-window-handle",
  "rustc-hash 1.1.0",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "wgpu-core-deps-apple",
  "wgpu-core-deps-emscripten",
  "wgpu-core-deps-wasm",
@@ -6136,7 +6147,7 @@ dependencies = [
  "arrayvec",
  "ash",
  "bit-set 0.9.1",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.6.2",
  "bytemuck",
  "cfg-if",
@@ -6169,7 +6180,7 @@ dependencies = [
  "raw-window-metal",
  "renderdoc-sys",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "wasm-bindgen",
  "wayland-sys",
  "web-sys",
@@ -6196,7 +6207,7 @@ version = "29.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84bf84cd9ca8ca45e2b223a3868f1adf9bfc0c66aeac212e76ee7e40fdadf8f5"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytemuck",
  "js-sys",
  "log",
@@ -6616,7 +6627,7 @@ dependencies = [
  "ahash",
  "android-activity",
  "atomic-waker",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "block2 0.5.1",
  "bytemuck",
  "calloop",
@@ -6724,7 +6735,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d039de8032a9a8856a6be89cea3e5d12fdd82306ab7c94d74e6deab2460651c5"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "dlib",
  "log",
  "once_cell",

From 8e2a86a0f1969822b6576449f440bd945f837d6a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 10:12:58 +0000
Subject: [PATCH 2/9] chore(deps)(deps): bump lz4_flex from 0.13.1 to 0.14.0

Bumps [lz4_flex](https://github.com/pseitz/lz4_flex) from 0.13.1 to 0.14.0.
- [Release notes](https://github.com/pseitz/lz4_flex/releases)
- [Changelog](https://github.com/PSeitz/lz4_flex/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pseitz/lz4_flex/compare/0.13.1...0.14.0)

---
updated-dependencies:
- dependency-name: lz4_flex
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock | 4 ++--
 Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cac2b6ff..bcf595b0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2536,9 +2536,9 @@ dependencies = [
 
 [[package]]
 name = "lz4_flex"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
+checksum = "ecbdfe44b1bd960b68170b417450a628c43f7cf56bb3c5317e61cb230ee7f226"
 
 [[package]]
 name = "mac_address"
diff --git a/Cargo.toml b/Cargo.toml
index 08b318c3..e17c3613 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -107,7 +107,7 @@ serde_json = "1.0"
 # rewind ring buffer to compress per-frame snapshots. `std` is opted in
 # by `rustynes-core`'s `std` feature (default on for desktop builds; off when
 # cross-compiling to a no_std target like `thumbv7em-none-eabihf`).
-lz4_flex = { version = "0.13", default-features = false, features = ["safe-encode", "safe-decode"] }
+lz4_flex = { version = "0.14", default-features = false, features = ["safe-encode", "safe-decode"] }
 
 # Frontend deps
 winit = "0.30"

From c475787b168d2cbaa4de6371a8429cbd7c3ed521 Mon Sep 17 00:00:00 2001
From: DoubleGate <parobek@gmail.com>
Date: Mon, 20 Jul 2026 17:31:03 -0400
Subject: [PATCH 3/9] chore(ci): bump actions/setup-python from 6 to 7

Applies the same bump as PR #313 (dependabot). v7 migrates the action
to ESM, pins its own dependency SHAs, and reclassifies stderr warnings
so they no longer surface as spurious annotation errors. No workflow
input changes required on our side.
---
 .github/workflows/web.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 6de9f30f..b8671105 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -117,7 +117,7 @@ jobs:
       # than straight into `_site/docs`, because the assemble step below clears +
       # recreates `_site`.
       - name: Set up Python for MkDocs
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

From 61b0205fb5d3608a4bc2cda69a0749a85f6589e7 Mon Sep 17 00:00:00 2001
From: DoubleGate <parobek@gmail.com>
Date: Mon, 20 Jul 2026 17:34:55 -0400
Subject: [PATCH 4/9] =?UTF-8?q?chore(deps):=20cargo=20update=20=E2=80=94?=
 =?UTF-8?q?=20tokio=201.53.1,=20clap/clap=5Fderive=204.6.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sweeps the rest of the workspace's semver-compatible Cargo.lock entries
after cherry-picking the three open Dependabot PRs (#313-#315). tokio's
1.53.1 point release also drops its transitive windows-sys 0.53.5 /
windows_*_0.53.1 dependency set entirely (upstream no longer needs it
on this platform), so the lockfile shrinks slightly as a side effect.

Surveyed the remainder of the tree via `cargo outdated --workspace`
(root-deps and full) and confirmed nothing else is actionable:
- getrandom 0.2.17 (wasm32) is pulled transitively by `ring` (via
  rustls/tungstenite/ureq), which hasn't moved off getrandom ^0.2
  upstream — outside our control.
- wgpu/naga 30.0.0 are out because egui-wgpu 0.35.0 (the newest egui
  release) still pins `wgpu = "^29.0"`; bumping wgpu alone would split
  the tree onto two incompatible wgpu majors. Stays in the existing
  egui 0.35 / wgpu 29 / winit 0.30.13 / accesskit 0.24.1 tier until
  egui itself moves.
- All GitHub Actions in .github/workflows/*.yml are already pinned to
  their current major tag (checkout@v7, upload-artifact@v7, etc.),
  which floats to the latest point release automatically.
---
 Cargo.lock | 98 +++++++-----------------------------------------------
 1 file changed, 12 insertions(+), 86 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index bcf595b0..ce36e02e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -231,7 +231,7 @@ dependencies = [
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
  "x11rb",
 ]
 
@@ -684,9 +684,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.2"
+version = "4.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
+checksum = "0fb99565819980999fb7b4a1796046a5c949e6d4ff132cf5fadf5a641e20d776"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -715,9 +715,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.1"
+version = "4.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+checksum = "32f2392eae7f16557a3d727ef3a12e57b2b2ca6f98566a5f4fb41ffe305df077"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -1445,7 +1445,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4232,7 +4232,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5006,7 +5006,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5240,9 +5240,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.53.0"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d988bcd52dbe076d3d46903332f58c912b87a2c49b1428419a5845154762ffee"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -6268,7 +6268,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -6405,15 +6405,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -6447,30 +6438,13 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
+ "windows_i686_gnullvm",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
 [[package]]
 name = "windows-threading"
 version = "0.2.1"
@@ -6492,12 +6466,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -6510,12 +6478,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -6528,24 +6490,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -6558,12 +6508,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -6576,12 +6520,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -6594,12 +6532,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -6612,12 +6544,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"

From a9bd6eba47cd6c9627579907ac79e1124753a8ed Mon Sep 17 00:00:00 2001
From: DoubleGate <parobek@gmail.com>
Date: Mon, 20 Jul 2026 17:36:00 -0400
Subject: [PATCH 5/9] docs(changelog): record the deps master-bump
 consolidation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also adds .coderabbit.yaml so CodeRabbit is pre-configured as an
alternate PR review bot (alongside gemini-code-assist and
copilot-pull-request-reviewer) for whenever the GitHub App is
installed on this repo — Gemini's daily review quota has been hit
before, and CodeRabbit gives a fallback that doesn't depend on it.
---
 .coderabbit.yaml | 59 ++++++++++++++++++++++++++++++++++++++++++++++++
 CHANGELOG.md     | 31 +++++++++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 .coderabbit.yaml

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 00000000..2cf988b9
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,59 @@
+# CodeRabbit configuration for RustyNES.
+# https://docs.coderabbit.ai/reference/configuration
+#
+# Added as an alternate PR review bot alongside gemini-code-assist and
+# copilot-pull-request-reviewer (project convention: reply-and-resolve every
+# bot review thread before merge — see docs/dev/CONTRIBUTING.md and the
+# HARD MERGE-GATE ceremony this project follows). Requires installing the
+# CodeRabbit GitHub App on this repo before it will actually run.
+
+language: en-US
+
+tone_instructions: >
+  Precise, technical language. No emojis. Flag correctness, determinism,
+  and no_std/unsafe-boundary issues in the rustynes-* chip crates with
+  higher priority than style nits.
+
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+  collapse_walkthrough: true
+  auto_review:
+    enabled: true
+    drafts: false
+  path_filters:
+    - "!ref-proj/**"
+    - "!ref-docs/**"
+    - "!docs/archive/**"
+    - "!to-dos/archive/**"
+    - "!Cargo.lock"
+  path_instructions:
+    - path: "crates/rustynes-cpu/**"
+      instructions: >
+        This is a #![no_std] deterministic 6502 core validated against
+        nestest and the blargg/kevtris/AccuracyCoin test-ROM suites.
+        Flag anything that could introduce non-determinism (wall-clock,
+        OS RNG, unordered iteration) or break cycle-accuracy.
+    - path: "crates/rustynes-ppu/**"
+      instructions: >
+        PPU-dot-resolution lockstep timing is load-bearing (see
+        docs/scheduler.md). Flag any change that could shift sub-instruction
+        PPU event timing without an accompanying test-ROM justification.
+    - path: "crates/rustynes-apu/**"
+      instructions: >
+        Audio synthesis must stay byte-identical to the golden vectors in
+        tests/golden/ unless the PR explicitly re-blesses them.
+    - path: "**/*.md"
+      instructions: >
+        Docs are the spec here, not a changelog. Flag documentation that
+        drifts from the code it describes rather than just prose nits.
+
+chat:
+  auto_reply: true
+
+knowledge_base:
+  learnings:
+    scope: auto
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1ff5184d..f7d214b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,6 +36,37 @@ cycle-accurate core later replaced.
   `get_fastforwarding`-gated audio-push skip during RetroArch's
   fast-forward/rollback-netplay catch-up path.
 
+### Changed
+
+- **Dependency version-bump consolidation (closes Dependabot #313–#315).**
+  Rolled all three open Dependabot PRs into one reviewed change plus a
+  full `cargo update --workspace` sweep of the rest of the tree, all with
+  **no source changes** and the deterministic `#![no_std]` core untouched
+  (AccuracyCoin stays **141/141**): CI **actions/setup-python v6 → v7**
+  (MkDocs step), **lz4_flex 0.13 → 0.14** (save-state/movie compression;
+  `default-features = false` + `safe-encode`/`safe-decode` retained),
+  the `production-dependencies` group (**bitflags 2.13.0 → 2.13.1**,
+  **bytemuck 1.25.1 → 1.25.2**, **cc 1.2.67 → 1.3.0**, **clap 4.6.1 →
+  4.6.2**, **futures-core/-macro/-sink/-task/-util 0.3.32 → 0.3.33**,
+  **serde_json 1.0.150 → 1.0.151**), and a workspace-wide `cargo update`
+  picking up **tokio 1.53.0 → 1.53.1** (which also drops its transitive
+  `windows-sys`/`windows_*` 0.53.x dependency set entirely) and
+  **clap/clap_derive → 4.6.3**. Surveyed the remainder of the tree via
+  `cargo outdated --workspace` and confirmed nothing else is actionable:
+  `getrandom` 0.2 (wasm32) is pinned transitively by `ring` upstream, and
+  `wgpu`/`naga` 30.0.0 stay out because `egui-wgpu` 0.35.0 (the newest
+  egui release) still requires `wgpu = "^29.0"` — bumping wgpu alone
+  would split the tree across two incompatible majors, so the desktop
+  stack stays in its existing egui 0.35 / wgpu 29 / winit 0.30.13 /
+  accesskit 0.24.1 tier until egui itself moves. GitHub Actions were all
+  already pinned to their current major tag and float to the latest
+  point release automatically. Android/iOS Gradle/Swift dependency
+  versions are intentionally out of scope here (they are their own
+  separately-verified trains, per project convention — see the v1.8.8
+  "Atlas" and iOS dep-refresh history). Verified with `cargo fmt --check`,
+  `cargo clippy --workspace --all-targets -D warnings` (+ every feature
+  combo), and `cargo test --workspace`.
+
 ## [2.2.1] - 2026-07-15 - Housekeeping patch (dev-tooling archival + dependency consolidation + FDS test corpus)
 
 Zero accuracy, feature, or core changes — the deterministic `#![no_std]` chip

From c06c8dfd410b886a0af9e328375e70383ccd8565 Mon Sep 17 00:00:00 2001
From: DoubleGate <parobek@gmail.com>
Date: Mon, 20 Jul 2026 17:57:24 -0400
Subject: [PATCH 6/9] fix(deps): request lz4_flex's alloc feature for the
 no_std build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

lz4_flex 0.14 (bumped from 0.13 by the PR #315 Dependabot cherry-pick)
split its own no_std support into a real alloc-vs-std distinction:
compress_prepend_size/decompress_size_prepended (the Vec-returning
block API rustynes-core's rewind.rs and zwinder.rs use for per-frame
snapshot compression) now live behind the crate's `alloc` feature
specifically, not `std`. The workspace's lz4_flex dependency line only
requested `safe-encode`/`safe-decode` with default-features off, so a
standalone no-std-feature build of rustynes-core (exactly what the CI
`no_std build (thumbv7em-none-eabihf)` job runs, and what neither
Dependabot's own checks nor my local `cargo build --workspace` catch,
since a workspace build pulls in `lz4_flex/std` — which implies
`alloc` — via rustynes-core's own default-on `std` feature) failed to
compile: E0432, `no compress_prepend_size in block`.

Fix: request `alloc` unconditionally in the workspace lz4_flex spec.
rustynes-core already links `extern crate alloc;` in every build, std
or not, so this costs nothing on the no_std path; `std` still implies
`alloc` via lz4_flex's own feature table for the desktop/wasm builds,
so nothing changes there either.

Verified with the exact CI invocation:
  cargo build -p rustynes-core --target thumbv7em-none-eabihf --no-default-features
plus a full `cargo fmt --check` / `cargo clippy --workspace --all-targets
-D warnings` / `cargo test --workspace` re-run.
---
 Cargo.toml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index e17c3613..d639a2aa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -106,8 +106,14 @@ serde_json = "1.0"
 # `safe-decode` features avoid all `unsafe` in the hot path. Used by the
 # rewind ring buffer to compress per-frame snapshots. `std` is opted in
 # by `rustynes-core`'s `std` feature (default on for desktop builds; off when
-# cross-compiling to a no_std target like `thumbv7em-none-eabihf`).
-lz4_flex = { version = "0.14", default-features = false, features = ["safe-encode", "safe-decode"] }
+# cross-compiling to a no_std target like `thumbv7em-none-eabihf`). `alloc`
+# is requested unconditionally: 0.14 split the crate's own no_std support so
+# `compress_prepend_size`/`decompress_size_prepended` (the Vec-returning block
+# API rewind.rs/zwinder.rs use) now live behind `alloc`, not `std` — and
+# rustynes-core already links `extern crate alloc;` in every build, std or
+# not, so this costs nothing on the no_std path (`std` still implies `alloc`
+# via lz4_flex's own feature table for the desktop/wasm builds).
+lz4_flex = { version = "0.14", default-features = false, features = ["safe-encode", "safe-decode", "alloc"] }
 
 # Frontend deps
 winit = "0.30"

From 981f9a9cd6354fa06980d7573e6dbe5720bb2cd9 Mon Sep 17 00:00:00 2001
From: DoubleGate <parobek@gmail.com>
Date: Mon, 20 Jul 2026 18:07:59 -0400
Subject: [PATCH 7/9] docs(changelog): fix tokio's actual before-version + note
 lz4_flex alloc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Copilot's review on PR #316 caught a real inaccuracy: the Unreleased
entry said tokio moved 1.53.0 -> 1.53.1, but main was actually on
1.52.3 (verified against origin/main's Cargo.lock) — the 1.53.0
reading came from an intermediate state after the Dependabot
cherry-picks, before the workspace-wide `cargo update` ran. Also notes
the `alloc` feature addition to the lz4_flex line (the no_std-build fix
from the previous commit) so the changelog matches what actually
shipped.
---
 CHANGELOG.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7d214b2..37ea8e51 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,12 +44,15 @@ cycle-accurate core later replaced.
   **no source changes** and the deterministic `#![no_std]` core untouched
   (AccuracyCoin stays **141/141**): CI **actions/setup-python v6 → v7**
   (MkDocs step), **lz4_flex 0.13 → 0.14** (save-state/movie compression;
-  `default-features = false` + `safe-encode`/`safe-decode` retained),
+  `default-features = false` + `safe-encode`/`safe-decode` retained, plus
+  an explicit `alloc` feature request — 0.14 split `alloc`-vs-`std` no_std
+  support, and without it the `rustynes-core` no_std cross-compile job
+  fails to compile `compress_prepend_size`/`decompress_size_prepended`),
   the `production-dependencies` group (**bitflags 2.13.0 → 2.13.1**,
   **bytemuck 1.25.1 → 1.25.2**, **cc 1.2.67 → 1.3.0**, **clap 4.6.1 →
   4.6.2**, **futures-core/-macro/-sink/-task/-util 0.3.32 → 0.3.33**,
   **serde_json 1.0.150 → 1.0.151**), and a workspace-wide `cargo update`
-  picking up **tokio 1.53.0 → 1.53.1** (which also drops its transitive
+  picking up **tokio 1.52.3 → 1.53.1** (which also drops its transitive
   `windows-sys`/`windows_*` 0.53.x dependency set entirely) and
   **clap/clap_derive → 4.6.3**. Surveyed the remainder of the tree via
   `cargo outdated --workspace` and confirmed nothing else is actionable:

From 6a821414c91a7f1dd3d2fbd9f6bc3c148285e559 Mon Sep 17 00:00:00 2001
From: DoubleGate <parobek@gmail.com>
Date: Mon, 20 Jul 2026 18:17:32 -0400
Subject: [PATCH 8/9] chore(coderabbit): switch to assertive profile, tailor to
 actual stack
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sets reviews.profile to "assertive" (deliberately more thorough than
the "chill" default) — this project treats accuracy/determinism
regressions and no_std/unsafe boundary mistakes as high-cost (they can
silently break AccuracyCoin or a save-state/movie format), so a few
extra nitpicks are worth it in exchange for not missing the comment
that matters.

Also, researched CodeRabbit's full configuration schema
(docs.coderabbit.ai) and tailored it to what this repo actually is,
rather than leaving ~50 tools at their silent defaults:

- knowledge_base.code_guidelines now points at AGENTS.md/CLAUDE.md,
  CONTRIBUTING.md, testing-strategy.md, and architecture.md so reviews
  are informed by this project's own conventions.
- Four deterministic custom_checks encoding project rules that
  otherwise only live in AGENTS.md: docs-as-spec sync for chip-behavior
  changes, a CHANGELOG entry for user-visible changes, no unwrap/expect/
  panic on untrusted input, and a SAFETY comment on new unsafe blocks.
- path_instructions extended to rustynes-core (Bus-ownership + save-
  state/format-version invariants), the egui/wgpu/winit/naga/accesskit
  version-tier lock, the Kotlin/Android and Swift/iOS apps, and CI
  workflow hygiene (pinned actions, least-privilege permissions).
- path_filters now also excludes crates/rustynes-cheevos/vendor/
  (vendored upstream rcheevos C we don't maintain — was previously
  unfiltered and would have generated noise against code we can't
  change).
- tools{} explicitly enables what's actually present in this repo
  (verified via a language-footprint audit, not guessed): clippy,
  semgrep/opengrep, gitleaks/trufflehog, osvScanner, actionlint/zizmor,
  yamllint, markdownlint, shellcheck, hadolint (2 Dockerfiles under
  deploy/), checkmake (rustynes-libretro/Makefile), detekt (50 Kotlin
  files), swiftlint (52 Swift files), ruff (60 Python files),
  luacheck (17 Lua files), clang/cppcheck (first-party C in
  rustynes-ios/include, distinct from the vendored/excluded rcheevos).
  Explicitly disables ~25 tools for ecosystems this repo has zero
  content in (PHP/Ruby/Terraform/SQL/Prisma/Shopify/Ember/PowerShell/
  etc.), plus pylint/flake8 (redundant with ruff) — left explicit
  rather than silently defaulted-on so the config documents the actual
  stack instead of inheriting noise for languages nobody writes here.
---
 .coderabbit.yaml | 251 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 244 insertions(+), 7 deletions(-)

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 2cf988b9..463f40a7 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -1,35 +1,116 @@
 # CodeRabbit configuration for RustyNES.
 # https://docs.coderabbit.ai/reference/configuration
 #
-# Added as an alternate PR review bot alongside gemini-code-assist and
+# Alternate PR review bot alongside gemini-code-assist and
 # copilot-pull-request-reviewer (project convention: reply-and-resolve every
 # bot review thread before merge — see docs/dev/CONTRIBUTING.md and the
-# HARD MERGE-GATE ceremony this project follows). Requires installing the
-# CodeRabbit GitHub App on this repo before it will actually run.
+# HARD MERGE-GATE ceremony this project follows).
+#
+# profile: assertive — deliberately more thorough than the "chill" default.
+# This project treats accuracy/determinism regressions and no_std/unsafe
+# boundary mistakes as high-cost (they can silently break AccuracyCoin or a
+# save-state/movie format), so a few extra nitpicks are worth it in exchange
+# for not missing the one comment that matters.
 
 language: en-US
 
 tone_instructions: >
-  Precise, technical language. No emojis. Flag correctness, determinism,
-  and no_std/unsafe-boundary issues in the rustynes-* chip crates with
-  higher priority than style nits.
+  Precise, technical language. No emojis, no poems. Flag correctness,
+  determinism, and no_std/unsafe-boundary issues in the rustynes-* chip
+  crates with higher priority than style nits. This repo's own
+  cargo fmt / clippy -D warnings / markdownlint gates already run in CI —
+  don't duplicate pure style findings clippy or rustfmt would already
+  catch; focus review effort on things those tools can't see (timing,
+  determinism, API/docs drift, security boundaries).
 
 reviews:
-  profile: chill
+  profile: assertive
   request_changes_workflow: false
   high_level_summary: true
+  sequence_diagrams: true
+  estimate_code_review_effort: true
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: true
+  auto_apply_labels: false
+  suggested_reviewers: true
+  auto_assign_reviewers: false
   poem: false
   review_status: true
   collapse_walkthrough: true
+  changed_files_summary: true
+  slop_detection:
+    enabled: true
   auto_review:
     enabled: true
+    auto_incremental_review: true
     drafts: false
+    ignore_title_keywords:
+      - "WIP"
+      - "DO NOT REVIEW"
+  finishing_touches:
+    docstrings:
+      enabled: true
+    unit_tests:
+      enabled: true
+    autofix:
+      enabled: true
+    simplify:
+      # Off deliberately: hot-path chip code (Cpu::tick/Ppu::tick/mapper
+      # register access) is intentionally allocation-free and
+      # abstraction-light per project convention — an auto-"simplify"
+      # suggestion is more likely to fight that than help it.
+      enabled: false
+  pre_merge_checks:
+    title:
+      mode: warning
+    description:
+      mode: warning
+    issue_assessment:
+      mode: warning
+    docstrings:
+      mode: warning
+      threshold: 80
+    custom_checks:
+      - name: "Docs-as-spec sync"
+        mode: warning
+        instructions: >
+          If this PR changes observable behavior in crates/rustynes-cpu,
+          crates/rustynes-ppu, crates/rustynes-apu, or crates/rustynes-mappers
+          (not just internal refactoring), the matching docs/<subsystem>.md
+          file should be updated in the same PR. Fail if a chip-behavior
+          change has no corresponding docs change and the PR body doesn't
+          explain why one isn't needed.
+      - name: "CHANGELOG entry for user-visible changes"
+        mode: warning
+        instructions: >
+          If this PR changes user-visible behavior, adds a feature, or fixes
+          a user-facing bug, CHANGELOG.md should gain an entry under
+          [Unreleased]. Pass for pure-internal refactors, dependency-only
+          bumps with no behavior change, or CI/tooling-only changes.
+      - name: "No unwrap/expect/panic on untrusted input"
+        mode: warning
+        instructions: >
+          Flag any new `.unwrap()`, `.expect()`, or `panic!()` applied to
+          data parsed from an external/untrusted source (ROM/save-state/
+          movie file bytes, network/netplay messages, user-supplied paths)
+          outside of #[cfg(test)] code. These boundaries must return a typed
+          Result/error instead. Pass if the unwrap/expect is on a value the
+          code just constructed or an invariant already checked nearby.
+      - name: "SAFETY comment on new unsafe blocks"
+        mode: warning
+        instructions: >
+          Every new `unsafe { ... }` block or `unsafe fn` must have an
+          adjacent `// SAFETY:` comment explaining the invariant the caller
+          upholds. Fail if a new unsafe block has no such comment nearby.
   path_filters:
     - "!ref-proj/**"
     - "!ref-docs/**"
     - "!docs/archive/**"
     - "!to-dos/archive/**"
     - "!Cargo.lock"
+    - "!crates/rustynes-cheevos/vendor/**"
   path_instructions:
     - path: "crates/rustynes-cpu/**"
       instructions: >
@@ -46,14 +127,170 @@ reviews:
       instructions: >
         Audio synthesis must stay byte-identical to the golden vectors in
         tests/golden/ unless the PR explicitly re-blesses them.
+    - path: "crates/rustynes-core/**"
+      instructions: >
+        The Bus owns all mutable subsystem state; the CPU/PPU/APU each see
+        only the narrow trait (PpuBus/ApuBus) they need. Flag any change
+        that widens a crate's access beyond that, or that could break
+        save-state / TAS movie / netplay-replay format compatibility
+        without an accompanying format-version bump (see ADR 0028).
+    - path: "crates/*/Cargo.toml"
+      instructions: >
+        This workspace pins a single compatible egui/wgpu/winit/naga/
+        accesskit tier (currently egui 0.35 / wgpu 29 / winit 0.30.13 /
+        accesskit 0.24.1). Flag a version bump to any one of these crates
+        that isn't accompanied by matching bumps to the others, or that
+        would require two incompatible major versions of the same
+        transitive dependency to coexist.
+    - path: "android/**/*.kt"
+      instructions: >
+        Kotlin/Compose Android app. Flag Compose recomposition footguns
+        (unstable lambdas/params causing unnecessary recomposition) and
+        any direct filesystem/SharedPreferences access that bypasses the
+        existing UniFFI bridge to rustynes-mobile.
+    - path: "**/*.swift"
+      instructions: >
+        SwiftUI/Metal iOS app calling into rustynes-mobile via UniFFI-
+        generated bindings. Flag force-unwraps (`!`) on values that
+        originate from the Rust bridge or from user/file I/O.
+    - path: "scripts/**/*.py"
+      instructions: >
+        One-off developer tooling, not shipped product code. Prioritize
+        correctness and clear error messages over style; don't ask for
+        packaging/type-hints polish unless it affects correctness.
+    - path: ".github/workflows/**"
+      instructions: >
+        Flag unpinned third-party actions (should be pinned to a version
+        tag or commit SHA, not a branch), missing least-privilege
+        `permissions:` blocks, and secrets echoed into logs.
     - path: "**/*.md"
       instructions: >
         Docs are the spec here, not a changelog. Flag documentation that
         drifts from the code it describes rather than just prose nits.
+        This repo's markdownlint gate is pinned to v0.39.0 via pre-commit
+        (see CLAUDE.md) — don't flag rules that version doesn't have.
+
+  tools:
+    clippy:
+      enabled: true
+    ast-grep:
+      essential_rules: true
+    semgrep:
+      enabled: true
+    opengrep:
+      enabled: true
+    gitleaks:
+      enabled: true
+    trufflehog:
+      enabled: true
+    osvScanner:
+      enabled: true
+    actionlint:
+      enabled: true
+    zizmor:
+      enabled: true
+    yamllint:
+      enabled: true
+    markdownlint:
+      enabled: true
+    shellcheck:
+      enabled: true
+    hadolint:
+      enabled: true
+    checkmake:
+      enabled: true
+    detekt:
+      enabled: true
+    swiftlint:
+      enabled: true
+    ruff:
+      enabled: true
+    luacheck:
+      enabled: true
+    clang:
+      enabled: true
+    cppcheck:
+      enabled: true
+    # Off: no real content for these ecosystems in this repo (Rust/Kotlin/
+    # Swift/Python/Lua/C/shell/YAML/Markdown/GH-Actions/Docker cover the
+    # actual stack — see the language footprint check that motivated this
+    # list). Left explicit rather than silently defaulted-on so the config
+    # documents the stack instead of just inheriting ~50 tools' worth of
+    # noise for languages this project doesn't use.
+    pylint:
+      enabled: false # redundant with ruff, avoid duplicate findings
+    flake8:
+      enabled: false # redundant with ruff, avoid duplicate findings
+    fbinfer:
+      enabled: false # Java/C static analysis; our first-party C is tiny and
+        # already covered by clang+cppcheck, vendored C is path-filtered out
+    pmd:
+      enabled: false # Java — project has none (Android app is Kotlin)
+    phpstan:
+      enabled: false
+    phpcs:
+      enabled: false
+    phpmd:
+      enabled: false
+    rubocop:
+      enabled: false
+    brakeman:
+      enabled: false
+    prismaLint:
+      enabled: false
+    sqlfluff:
+      enabled: false
+    squawk:
+      enabled: false
+    checkov:
+      enabled: false
+    tflint:
+      enabled: false
+    buf:
+      enabled: false
+    regal:
+      enabled: false
+    oasdiff:
+      enabled: false
+    circleci:
+      enabled: false
+    reactDoctor:
+      enabled: false
+    emberTemplateLint:
+      enabled: false
+    shopifyThemeCheck:
+      enabled: false
+    smartyLint:
+      enabled: false
+    htmlhint:
+      enabled: false
+    stylelint:
+      enabled: false
+    dotenvLint:
+      enabled: false
+    psscriptanalyzer:
+      enabled: false
+    blinter:
+      enabled: false
 
 chat:
   auto_reply: true
 
 knowledge_base:
+  opt_out: false
+  web_search:
+    enabled: true
+  code_guidelines:
+    enabled: true
+    filePatterns:
+      - "**/AGENTS.md"
+      - "**/CLAUDE.md"
+      - "docs/dev/CONTRIBUTING.md"
+      - "docs/testing-strategy.md"
+      - "docs/architecture.md"
   learnings:
     scope: auto
+  issues:
+    scope: auto
+  pull_requests:
+    scope: auto

From 355dfabd290a7940daaed2b92d9061be0ab5c53e Mon Sep 17 00:00:00 2001
From: DoubleGate <parobek@gmail.com>
Date: Mon, 20 Jul 2026 19:06:55 -0400
Subject: [PATCH 9/9] fix(coderabbit): shrink tone_instructions under the
 250-char limit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeRabbit's schema caps tone_instructions at 250 characters; the
previous text was 458 (including the trailing newline from the folded
block scalar) and failed validation outright, so the config wasn't
actually being applied. Trimmed to the load-bearing part — no emojis/
poems, prioritize determinism/no_std/unsafe correctness over style
nits CI's own clippy/rustfmt/markdownlint gates already catch — at 201
characters, switching to a stripped folded scalar (>-) so the trailing
newline doesn't eat into the budget either.
---
 .coderabbit.yaml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 463f40a7..8e57acaf 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -14,14 +14,10 @@
 
 language: en-US
 
-tone_instructions: >
-  Precise, technical language. No emojis, no poems. Flag correctness,
-  determinism, and no_std/unsafe-boundary issues in the rustynes-* chip
-  crates with higher priority than style nits. This repo's own
-  cargo fmt / clippy -D warnings / markdownlint gates already run in CI —
-  don't duplicate pure style findings clippy or rustfmt would already
-  catch; focus review effort on things those tools can't see (timing,
-  determinism, API/docs drift, security boundaries).
+tone_instructions: >-
+  Precise, technical language. No emojis or poems. Prioritize determinism
+  and no_std/unsafe-boundary correctness in rustynes-* chip crates over
+  style nits clippy/rustfmt/markdownlint already catch in CI.
 
 reviews:
   profile: assertive