build(deps): bump the all group with 2 updates

[dependabot]

Bumps the all group with 2 updates: noyalib and regex.

Updates noyalib from 0.0.13 to 0.0.15

Release notes

Sourced from noyalib's releases.

noyalib v0.0.15

What's Changed

• release: v0.0.15 — loader-parity completion + coverage hardening (#190) (f1e0bef)
• fix(loader,streaming): re-land #172 — DoS-budget parity + key-collision guard (lost from main) (#189) (b75462e)
• test(value): cover tag-preserving deserialize path in value/serde_impl.rs (#188) (24ee7f2)
• test(recovery): cover recover_one / try_line_truncation branch arms (#187) (238cbf8)
• test(cst): cover GreenChild::token_text — cst/green.rs to 100% (#186) (80f8f71)
• test(number): cover Number::Unsigned arms in value/number.rs (#185) (f055b62)
• test(ser): cover scattered serializer branch arms in ser.rs (#184) (5c7ca17)
• test(error): exercise kind() + miette code/help/labels for every variant (#183) (a45fc0c)
• test(cst): cover coerce helper edge arms in cst/coerce.rs (#182) (0bc07c6)
• test(compat): cover serde_yaml from_reader / to_writer drop-ins (#181) (c363255)
• test(base64): cover compile-time build_lut via a runtime unit test (#180) (1254fef)
• test(cst): cover formatter arms reachable via malformed input (#179) (dba4cb2)
• test(schema): cover coerce_to_schema path in schema_validate.rs (#177) (ba5826b)
• test(with): cover to_pascal_case empty-word edge; document defensive arms (#176) (0f143db)
• test(cst): cover reachable formatter branch arms in cst/format.rs (#175) (fd3bd27)
• test(de,include): close reachable coverage gaps in de.rs + include.rs (#174) (b6ae422)
• fix(coverage): restore make coverage-gap under cargo-llvm-cov ≥ 0.8.7 (#173) (39a0007)

Checksums

9014fb34654ac4f54a4ff52d5207b1e4a764604fced568c3a1d71ee99d1fc300  noyalib-0.0.15.crate

noyalib v0.0.14

What's Changed

• release: v0.0.14 — loader-parity cut, review-hardened (KeyCollision + CST edit guards) (#160) (17ab7f6)

Checksums

12ed62e7f82a103cc3c01c43d8fbbe8d0591731e5625dc85661298aede7d6c3d  noyalib-0.0.14.crate

Changelog

Sourced from noyalib's changelog.

[v0.0.15] - 2026-07-11

The loader-parity completion + coverage-hardening cut. Finishes the three-loader DoS-budget parity started in v0.0.14 by extending the remaining budgets to the NoSpanLoader fast path and the distinct-typed-key collision guard to the streaming loader, then drives a workspace-wide coverage campaign (≈16 files to effective-100%) with no change to public API or behaviour beyond the parity fixes.

Lockstep versioning: noyalib bumps 0.0.14 → 0.0.15. Satellites publish =0.0.15 from their own repos:

• sebastienrousseau/noyalib-wasm@0.0.15
• sebastienrousseau/noyalib-mcp@0.0.15
• sebastienrousseau/noyalib-lsp@0.0.15
• sebastienrousseau/noya-cli@0.0.15

Fixed — loader parity (security)

• NoSpanLoader DoS-budget parity, completed. The Value fast path now also enforces max_events, the total-scalar-bytes budget, and the alias_anchor_ratio — the three budgets still span-full-only after v0.0.14. All three loaders (streaming, span-full Loader, NoSpanLoader) now enforce the same DoS budgets, with cross-path tests (no_span_loader_parity).
• Distinct-typed key-collision guard on the streaming loader. The guard that raises Error::KeyCollision for 1: a vs "1": b (added to the AST paths in v0.0.14) now also runs on the streaming deserialiser, closing the last loader where the collision could silently collapse (key_collision_streaming).

Testing / tooling

• Workspace coverage campaign: ~16 files driven to effective-100% (de, include, schema_validate, compat/serde_yaml, base64, cst/coerce, error, ser, value/number, cst/green, recovery, and more). Region/line/function coverage rises across the workspace; no behavioural change.
• make coverage-gap restored under cargo-llvm-cov ≥ 0.8.7 (the empty --ignore-filename-regex is now guarded, matching CI).

[v0.0.14] - 2026-07-07

The loader-parity cut. Fixes a fast-path silent-collapse of distinct-typed mapping keys plus three DoS-budget parity gaps between the span-full and span-free loaders, adds a coarse Error::kind() classifier for downstream routing, and lands five CST span_at fixes and one scanner lone-CR fix.

Lockstep versioning: noyalib bumps 0.0.13 → 0.0.14. Satellites publish =0.0.14 from their own repos:

... (truncated)

Commits

• f1e0bef release: v0.0.15 — loader-parity completion + coverage hardening (#190)
• b75462e fix(loader,streaming): re-land #172 — DoS-budget parity + key-collision guard...
• 24ee7f2 test(value): cover tag-preserving deserialize path in value/serde_impl.rs (#188)
• 238cbf8 test(recovery): cover recover_one / try_line_truncation branch arms (#187)
• 80f8f71 test(cst): cover GreenChild::token_text — cst/green.rs to 100% (#186)
• f055b62 test(number): cover Number::Unsigned arms in value/number.rs (#185)
• 5c7ca17 test(ser): cover scattered serializer branch arms in ser.rs (#184)
• a45fc0c test(error): exercise kind() + miette code/help/labels for every variant (#183)
• 0bc07c6 test(cst): cover coerce helper edge arms in cst/coerce.rs (#182)
• c363255 test(compat): cover serde_yaml from_reader / to_writer drop-ins (#181)
• Additional commits viewable in compare view

Updates regex from 1.12.4 to 1.13.0

Changelog

Sourced from regex's changelog.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

Commits

• 926af2e 1.13.0
• 7d941a9 regex-automata-0.4.15
• e358341 api: add regex! macro for lazy compilation
• c420333 automata: disable miri on a couple doc tests
• b9d2cf7 github: add FUNDING link
• 0858006 docs: add AI policy for contributors
• 468fc64 automata: reject dense DFA start states that are match states
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions