build(deps): bump the all group with 4 updates

[dependabot]

Bumps the all group with 4 updates: hcl-rs, minijinja, noyalib and tui-tree-widget.

Updates hcl-rs from 0.19.7 to 0.19.8

Release notes

Sourced from hcl-rs's releases.

hcl-rs-v0.19.8

Other

• updated the following local packages: hcl-primitives, hcl-edit

Commits

• 0ff4a83 chore: release (#560)
• 5f50f40 chore(deps): update rust crate clap to v4.6.6 (#551)
• a105105 chore(deps): update rust crate serde to v1.0.229 (#554)
• 323721e chore(deps): update rust crate serde_json to v1.0.151 (#555)
• 78fc26d chore(deps): update rust crate kstring to v2.0.4 (#553)
• 6bbc0c1 chore(deps): update rust crate globset to v0.4.20 (#552)
• ee076cc chore(deps): update rust crate anyhow to v1.0.104 (#550)
• 475bd9e chore(deps): update rust crate winnow to v1.0.4 (#556)
• 9e96b16 fix: reject invalid string escapes instead of silently dropping them (#559)
• 6c58769 Handle parsing the i64's min value literal (i.e., "-9223372036854775808") cor...
• Additional commits viewable in compare view

Updates minijinja from 2.23.0 to 2.24.0

Changelog

Sourced from minijinja's changelog.

2.24.0

• Added the wordwrap filter to the Python bindings. #885
• Fixed conditional expressions in keyword argument values for Jinja2 compatibility in Rust and Go. #921
• Fixed context! sorting keys when the preserve_order feature is enabled. #920
• Limited string repetition to 100 MB in Rust and Go to prevent excessive memory allocations.

Commits

• 0ca749f chore(release): 2.24.0
• 0f2989a feat(python): expose wordwrap filter
• 3eac8fa docs(changelog): document context key ordering fix
• c867352 fix(macros): preserve context key order
• a9e1813 fix(parser): allow conditionals in keyword arguments
• c6fa683 fix(value): limit repeated strings to 100 MB
• See full diff in compare view

Updates noyalib from 0.0.18 to 0.0.22

Release notes

Sourced from noyalib's releases.

noyalib v0.0.22

What's Changed

• docs(changelog): cut the v0.0.22 release section (5122e42)
• chore(release): bump to v0.0.22 (7601ced)
• fix(cst): splices adopt the document's line break instead of assuming \n (0e647db)

Checksums

213c922c1762f1e25cdd85773b2a7968b96e5b88058265733a847e2be3b589ce  noyalib-0.0.22.crate

noyalib v0.0.21

Changes since v0.0.19 (2026-08-11).

Note on versioning. 0.0.20 was merged to main but never tagged, so it never reached crates.io. Its bare-metal no_std work ships here. The published sequence is 0.0.19 → 0.0.21.

---

Three silent-corruption fixes

Each of these returned Ok while damaging the document. None were reported — they were found by probing the behaviour the roadmap claimed, and in one case by a property test written in the same branch.

remove deleted more than it was asked to

input	call	before
a: {x: 1, y: 2}	remove("a.x")	entire document deleted
keep: 0 ⏎ a: {x: 1, y: 2}	remove("a.x")	all of a gone

The typed oracle guarded only multi-line edits; single-line entries took an unguarded path that deleted the whole line. In a flow collection an entry shares its line with its siblings and its parent.

The fast path now requires the entry to own its line. Keeping a fast path at all is deliberate: the oracle expects "this path absent", which is the wrong expectation for a duplicated key, and guarding everything broke that existing test.

A set fragment could reach outside its path

set("a", "v\nc: 3") gave the document a new top-level key c and returned Ok. The result is valid YAML, so the re-parse guard could not see it. A structural oracle now requires the shape outside the edited path to be unchanged.

... (truncated)

Changelog

Sourced from noyalib's changelog.

[v0.0.22] - 2026-08-13

Fixed

• Splices adopt the document's own line break instead of assuming \n (#261, thanks @​zoosky) — an edit that added a line wrote a hard-coded \n whatever the document used. The mutators already derived a splice's indentation from the site; the terminator was the one thing still assumed. Affected insert_entry / push_back / insert_after and their _value counterparts, set_leading_comment, and set_comment(Before | Inline).

  The inline case was the worst of them. It spliced at line_end_from — the index of the \n — which inside a \r\n lands between the two and stranded a lone \r. set_inline_comment was already correct, since it splices at the node's span end, so the two APIs for the same operation disagreed. They now agree, and a test pins that.

  document_break (and comment_line_break, its counterpart in annotated.rs) reports "\r\n" only when the document is wholly CRLF — at least one break, and every \n preceded by a \r. So it reads the document's convention rather than guessing one:

  • leading_break_for_splice returns it instead of "\n"
  • indent_continuation_lines takes it, so a multi-line emission grows CRLF on every line rather than only the last
  • the inline-comment splice moves to a new line_break_start, which steps back over a \r

  Deliberate non-changes, each with a test: a mixed-ending document keeps the \n default (there is no convention to honour, and picking one would rewrite bytes the caller did not ask about); a document with no break at all likewise; a document whose last line is unterminated still reads the convention from the breaks it does have. set_value and remove never added a line and are pinned as controls.

  No data was lost by the old behaviour — values round-tripped, and the inline case stayed valid because YAML 1.2 accepts a lone \r as a break. What a caller got was a file returning with two or three terminators in it, which for a lossless CST shows up as a whole-file diff on Windows, or a .gitattributes / CI line-ending check firing.

  No public API changes shape: document_break and comment_line_break are private, and indent_continuation_lines is private and gained a parameter.

  Cross-checked against a real consumer: yqr carries a local workaround that restores the convention at emit time. With that workaround disabled and yqr pointed at this change, its full suite passes (163/163) including five CRLF regression tests; against unpatched 0.0.21

... (truncated)

Commits

• 97edc90 Merge pull request #262 from sebastienrousseau/feat/v0.0.22
• 5122e42 docs(changelog): cut the v0.0.22 release section
• 7601ced chore(release): bump to v0.0.22
• 74ef6ef Merge pull request #261 from zoosky/fix/crlf-aware-splices
• 0e647db fix(cst): splices adopt the document's line break instead of assuming \n
• 554e883 docs(changelog): backfill v0.0.19 and v0.0.21 (#260)
• b4e5eaa feat(v0.0.21): comment mutation, three silent-corruption fixes, and supply-ch...
• dafaca7 feat(v0.0.20): build for bare-metal no_std targets (closes #210) (#258)
• cbb6194 feat(v0.0.19): dependency consolidation, @​EdJoPaTo's clippy follow-ups, and t...
• e077fcc feat(v0.0.20): clippy refactors from @​EdJoPaTo — #240, #241, #242, #243 (#245)
• Additional commits viewable in compare view

Updates tui-tree-widget from 0.24.0 to 0.24.1

Release notes

Sourced from tui-tree-widget's releases.

v0.24.1

• a3467c1 build: reduce required dependencies

Commits

• a378ec8 build: v0.24.1
• a3467c1 build: reduce required dependencies
• 953773f ci: update actions
• 9b7eafe ci(actions): bump softprops/action-gh-release from 2 to 3 (#63)
• d67a463 ci(actions): bump actions/upload-artifact from 6 to 7 (#61)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions