chore(deps): bring every workspace dependency to its newest published version

[andrewgazelka]

What moved

55 workspace dependencies, from cargo upgrade --incompatible plus cargo update. Two crossed a major, and one is a prerelease:

crate	from	to	note
compact_str	0.9.0	0.10.0	major, but nothing in the tree imports it (see below)
libloading	0.8.9	0.9.0	major, and it changed behaviour: see the next section
approx	0.5.1	0.6.0-rc2	prerelease, and the newest thing approx has published; 0.5.1 is from 2022

The other 52 are within-major: anyhow 1.0.98 to 1.0.104, arc-swap 1.7.1 to 1.9.2, arrayvec 0.7.4 to 0.7.8, bitvec 1.0.1 to 1.1.1, boxcar 0.2.13 to 0.2.14, bumpalo 3.16 to 3.20, bytemuck 1.23.0 to 1.25.2, bytes 1.8.0 to 1.12.1, clap 4.5.38 to 4.6.4, colored 3.0.0 to 3.1.1, derive_more 2.0.1 to 2.1.1, enumset 1.1.6 to 1.1.14, fast_hilbert 2.0.0 to 2.1.0, fastrand 2.1.0 to 2.5.0, flate2 1.1.1 to 1.1.9, futures-util 0.3.31 to 0.3.33, humantime 2.1.0 to 2.4.0, indexmap 2.9.0 to 2.14.0, libc 0.2.172 to 0.2.189, libdeflater 1.24.0 to 1.25.2, memmap2 0.9.5 to 0.9.11, mio 1.0.3 to 1.2.2, num_cpus 1.16.0 to 1.17.0, once_cell 1.21.3 to 1.21.4, ordered-float 5.0.0 to 5.3.0, papaya 0.2.1 to 0.2.4, parking_lot 0.12.3 to 0.12.5, plotters 0.3.6 to 0.3.7, plotters-bitmap 0.3.6 to 0.3.7, proc-macro2 1.0.95 to 1.0.107, proptest 1.5.0 to 1.11.0, quote 1.0.39 to 1.0.47, rayon 1.10.0 to 1.12.0, rkyv 0.8.8 to 0.8.17, rustc-hash 2.0.0 to 2.1.3, rustls 0.23.31 to 0.23.42, rustls-pki-types 1.12.0 to 1.15.1, rustls-webpki 0.103.4 to 0.103.13, serde 1.0.217 to 1.0.229, serde_json 1.0.140 to 1.0.151, slotmap 1.0.7 to 1.1.1, syntect 5.2.0 to 5.3.0, tar 0.4.41 to 0.4.46, thiserror 2.0.12 to 2.0.19, thread_local 1.1.8 to 1.1.10, time 0.3.41 to 0.3.54, tokio 1.45.0 to 1.53.1, tokio-rustls 0.26.2 to 0.26.4, tokio-util 0.7.15 to 0.7.19, tracing 0.1.40 to 0.1.44, tracing-appender 0.2.3 to 0.2.5, tracing-subscriber 0.3.18 to 0.3.23, uuid 1.16.0 to 1.24.0.

The one behaviour change a person would notice

libloading 0.9 moved the dlerror text out of Display and behind Error::source. The hot reloader formatted its failures as could not open module: {e}, so every dlopen failure would have printed exactly this and nothing more:

could not open module: dlopen failed

That is the whole diagnosis gone: no path, no missing symbol, no "no such file". Fixed at the layer that owns it, in crates/hyperion-hot-reload/src/host.rs: LoadError now appends the source when there is one, and implements Error::source so a caller walking the chain reaches the platform message too. crates/hyperion-hot-reload/tests/load_errors.rs pins both. I reverted the fix and watched that test fail with the message above before restoring it, so it is a guard rather than a decoration.

What did not move, and why

Each of these now carries a comment in Cargo.toml next to the pin.

• glam 0.29.3 (0.33.2 available). Unchanged reason, comment already present: valence_protocol exposes glam types across its whole public API and the vendored fork pins 0.29.3, so a newer glam here puts two of them in the tree and every valence signature stops accepting hyperion's vectors.
• libc 0.2.189 (1.0.0-alpha.4 published). Every other crate that reaches libc requires 0.2, so the alpha adds a second libc without removing the first.
• rustls 0.23.42 (0.24.0-dev.1 published). tokio-rustls 0.26, hyper-rustls 0.27, reqwest 0.13 and rustls-platform-verifier 0.7 all require 0.23.
• rustls-webpki 0.103.13 (0.104.0-alpha.7 published). rustls 0.23 depends on 0.103, so 0.104 would put two webpki crates in the tree.

Those four are the only crates in the workspace with a prerelease above their stable line. Every other max_pre on crates.io is an old release candidate below the current stable, so there was nothing else to take.

Git dependencies, checked against upstream

All three are already at the newest revision available to them, so Cargo.lock and the flake's outputHashes are unchanged for them.

• divan 55ec68e is nvzqz/divan main HEAD.
• Flecs-Rust 252944d is the head of Sparse-term safety locks pass a stage where a world is required Indra-db/Flecs-Rust#302, rebased today. That PR is still open, so the fork pin stays; the existing comment already says to repin on upstream once it lands.
• valence fb792dc is the head of TestingPlant/valence feat-bytes. Worth knowing: that branch is 18 ahead and 47 behind valence-rs/valence main. Catching it up is a job in that repo, not this one, and it is the same blocker as the glam pin.

Toolchain and flake

• rust-toolchain.toml stays on nightly-2026-07-27. That is the newest nightly upstream has published; 2026-07-28 is a 404 on static.rust-lang.org, checked twice several hours apart.
• nix flake update moved only index (3225f70 to 5e3b95c). The root nixpkgs (624af66) and rust-overlay (c67ce00) were already at their upstream heads.

Notes for the reader

• compact_str is dead weight. It is declared in [workspace.dependencies] but no crate manifest references it and no source file imports it. I bumped it rather than delete it, because deleting a dependency is a different change from updating one. Worth removing separately.
• rkyv's future-incompat warning is not new. cargo warns that bytecheck 0.8.2 and rkyv 0.8.17 use a trailing semicolon in macro expression position. I checked rkyv 0.8.8: the same fail!(NotStarted) is on the same line, so the bump did not introduce it.
• deny.toml is stale, and that predates this PR. cargo deny reports 20 unnecessary skips, 1 unmatched skip and 2 advisory ignores that no longer match anything. I ran the same gate against pristine origin/main and got byte-identical staleness, so none of it is mine and I left it alone. It wants a separate cleanup pass.
• One new duplicate appears: libloading 0.8.9 survives only as a build-dependency of bindgen via clang-sys, under flecs_ecs_sys. The runtime one is 0.9.0. multiple-versions is warn, and the gate passes.

Gates

All run locally in the worktree, on nightly-2026-07-27, aarch64-darwin. e2e and smash-e2e used HYPERION_PLAYER_PORT=36565 HYPERION_SERVER_PORT=46565 so they did not touch the live stack on 25565/35565.

$ nix run .#fmt -- --check
rc=0

$ nix run .#lint
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 7.47s
warning: the following packages contain code that will be rejected by a future version of Rust: bytecheck v0.8.2, rkyv v0.8.17
rc=0

$ nix run .#test
     Summary [   1.756s] 462 tests run: 462 passed, 1 skipped
rc=0

$ nix run .#deny
advisories ok, bans ok, licenses ok, sources ok
rc=0

$ nix run .#unused-deps
cargo-machete didn't find any unused dependencies in this directory. Good job!
rc=0

$ nix flake check
checking NixOS module 'nixosModules.game-server'...
checking NixOS module 'nixosModules.proxy'...
running 1 flake checks...
all checks passed!
rc=0

e2e, one bedwars client through the whole stack:

$ HYPERION_PLAYER_PORT=36565 HYPERION_SERVER_PORT=46565 nix run .#e2e
stack up on 127.0.0.1:36565 (bedwars)
[e2e] -> Intention protocol=776 intent=login
[e2e] <- Login entity_id=134218740  ** REACHED PLAY STATE **
[e2e] RESULT: every referenced tag is present in UpdateTags
[e2e] RESULT: reached play state (Login received)
[e2e] RESULT: 4096 LevelChunkWithLight packet(s)
[e2e] RESULT: GameEvent(LEVEL_CHUNKS_LOAD_START) sent
rc=0

smash-e2e, four clients through a whole match:

$ HYPERION_PLAYER_PORT=36565 HYPERION_SERVER_PORT=46565 nix run .#smash-e2e
 173.73s       === what the match proved ===
 173.73s         proved      four in play
 173.73s         proved      lobby started a match
 173.73s         proved      kits equipped
 173.73s         proved      arena is a committed map
 173.73s         proved      knockback from an ability
 173.73s         proved      life lost and respawned
 173.73s         proved      match ended, back in the hub
 173.73s       RESULT: a whole match ran at protocol 776
rc=0

Not on the required list, but run because libloading's major bump is the thing that actually calls dlopen, and no listed gate exercises it:

$ nix run .#hot-reload-demo
  entity 0: hp: f32 = 22.0 | points: i32 = 7
  entity 1: hp: f32 = 32.0 | points: i32 = 14
  entity 2: hp: f32 = 42.0 | points: i32 = 21
rc=0

Four successive builds of the demo module loaded into one running world, with the migration applied. That is the path libloading 0.9 changed, and it still works.

[github-actions]

Benchmark Results for general

ray_intersection/aabb_size_0.1                     [  17.9 ns ...  17.9 ns ]      +0.05%
ray_intersection/aabb_size_1                       [  17.4 ns ...  17.4 ns ]      +0.10%
ray_intersection/aabb_size_10                      [  15.8 ns ...  15.8 ns ]      +0.03%
ray_intersection/ray_distance_1                    [   0.6 ns ...   0.6 ns ]      -0.02%
ray_intersection/ray_distance_5                    [   0.6 ns ...   0.6 ns ]      +0.26%
ray_intersection/ray_distance_20                   [   0.6 ns ...   0.6 ns ]      -0.02%
overlap/no_overlap                                 [  10.5 ns ...  10.5 ns ]      -0.12%
overlap/partial_overlap                            [  10.5 ns ...  10.5 ns ]      +0.09%
overlap/full_containment                           [  10.0 ns ...  10.0 ns ]      +0.03%
point_containment/inside                           [   4.4 ns ...   4.4 ns ]      +0.24%
point_containment/outside                          [   4.4 ns ...   4.3 ns ]      -0.13%
point_containment/boundary                         [   4.3 ns ...   4.3 ns ]      +0.23%

Comparing to 3855d34

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 41.17%. Comparing base (3855d34) to head (f0afe1e).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
crates/hyperion-hot-reload/src/host.rs	80.00%	2 Missing ⚠️

@@            Coverage Diff             @@
##             main     #991      +/-   ##
==========================================
+ Coverage   41.11%   41.17%   +0.06%     
==========================================
  Files         241      241              
  Lines       25738    25747       +9     
  Branches     1004     1004              
==========================================
+ Hits        10581    10601      +20     
+ Misses      14939    14928      -11     
  Partials      218      218              

Files with missing lines	Coverage Δ
crates/hyperion-hot-reload/src/host.rs	10.15% <80.00%> (+10.15%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.