Bump the cargo-deps group across 2 directories with 7 updates

[dependabot]

Bumps the cargo-deps group with 1 update in the /integration directory: tokio.
Bumps the cargo-deps group with 6 updates in the /test-runner directory:

Package	From	To
wasm-bindgen-cli	0.2.126	0.2.127
serde	1.0.228	1.0.229
serde_json	1.0.150	1.0.151
serde_with	3.21.0	3.22.0
wasm-encoder	0.253.0	0.255.0
wasmparser	0.253.0	0.255.0

Updates tokio from 1.53.0 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

• signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

• time: fix alt timer cancellation and insertion race (#8252)

Documented

• runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Commits

• 75fef53 chore: prepare Tokio v1.53.1 (#8303)
• ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
• eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
• 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
• a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
• See full diff in compare view

Updates wasm-bindgen-cli from 0.2.126 to 0.2.127

Release notes

Sourced from wasm-bindgen-cli's releases.

0.2.127

Added

• Navigation API to web-sys #5247

• Added riscv64gc-unknown-linux-gnu release artifacts. #5265

• Added JsNullable<T>, modeling WebIDL nullable types (T | null). Both null and undefined are treated as absent, per WebIDL's ECMAScript conversion rules; the canonical empty value produced from Rust is null. web-sys now uses JsNullable<T> instead of JsOption<T> for nullable types nested inside generics (e.g. Promise<GpuError?> from GPUDevice.popErrorScope()), fixing spec-defined null resolutions being treated as present values under JsOption<T>'s strict undefined-only semantics. JsNullable<T> participates in the same upcast lattice as JsOption<T> (including contravariant closure argument casts), and additionally upcasts from Null and from JsOption<T> itself. Imported extern types now also upcast into JsOption<JsValue> and JsNullable<JsValue>, so catch-all nullable closures can be used where a typed callback is expected. #5234

Changed

• Emscripten output now marks public exports (free functions, classes, enums, and namespace roots) with the __export: true and __force: true symbol attributes on their addToLibrary entries, instead of mutating EXPORTED_FUNCTIONS and pushing to extraLibraryFuncs at library-load time. The $initBindgen init closure is kept via __force: true, and private symbols (including namespace leaves) carry neither attribute — they remain reachable through __deps. Requires an emscripten with __export/__force symbol-attribute support.

• Updated WebGPU bindings to the August 2026 spec, including the new GPUCommandEncoder::copy_buffer_to_buffer overloads and setImmediates. #5246

• Unstable API overload names now elide name tokens shared by every overload variant: LockManager::request_with_callback is now request, and request_with_options_and_callback is now request_with_options. #5246

Fixed

• The name property of the JS error thrown for panic=unwind is now set from a string literal instead of PanicError.name, so it survives minification. #5260

... (truncated)

Changelog

Sourced from wasm-bindgen-cli's changelog.

0.2.127

Added

• Navigation API to web-sys #5247

• Added riscv64gc-unknown-linux-gnu release artifacts. #5265

• Added JsNullable<T>, modeling WebIDL nullable types (T | null). Both null and undefined are treated as absent, per WebIDL's ECMAScript conversion rules; the canonical empty value produced from Rust is null. web-sys now uses JsNullable<T> instead of JsOption<T> for nullable types nested inside generics (e.g. Promise<GpuError?> from GPUDevice.popErrorScope()), fixing spec-defined null resolutions being treated as present values under JsOption<T>'s strict undefined-only semantics. JsNullable<T> participates in the same upcast lattice as JsOption<T> (including contravariant closure argument casts), and additionally upcasts from Null and from JsOption<T> itself. Imported extern types now also upcast into JsOption<JsValue> and JsNullable<JsValue>, so catch-all nullable closures can be used where a typed callback is expected. #5234

Changed

• Emscripten output now marks public exports (free functions, classes, enums, and namespace roots) with the __export: true and __force: true symbol attributes on their addToLibrary entries, instead of mutating EXPORTED_FUNCTIONS and pushing to extraLibraryFuncs at library-load time. The $initBindgen init closure is kept via __force: true, and private symbols (including namespace leaves) carry neither attribute — they remain reachable through __deps. Requires an emscripten with __export/__force symbol-attribute support.

• Updated WebGPU bindings to the August 2026 spec, including the new GPUCommandEncoder::copy_buffer_to_buffer overloads and setImmediates. #5246

• Unstable API overload names now elide name tokens shared by every overload variant: LockManager::request_with_callback is now request, and request_with_options_and_callback is now request_with_options. #5246

Fixed

• The name property of the JS error thrown for panic=unwind is now set from a string literal instead of PanicError.name, so it survives minification. #5260

... (truncated)

Commits

• a579ee6 Release 0.2.127 (#5219)
• 30e0200 Add JsNullable for WebIDL nullable types (#5258)
• 01b12ef Update WebGPU API to 2026-08-02 (#5246)
• bec51f6 slice_to_array fixes (#5261)
• f50896d Use string literal for PanicError name so it survives minification (#5262)
• 389c36d Leave env.memory to the emscripten runtime (#5254)
• 2baf51c Throw a clear error for non-ok fetch Responses in __wbg_load (#5256)
• 7fa3bc4 Add Navigation API to web-sys (#5247)
• 297640c Use emscripten __export/__force symbol attributes for public exports (#5253)
• c11101e Restore the stack pointer when an exception leaves an export (#5244)
• Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• See full diff in compare view

Updates serde_with from 3.21.0 to 3.22.0

Release notes

Sourced from serde_with's releases.

serde_with v3.22.0

Added

• Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

• Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

Commits

• 88f576a Bump version to 3.22.0 (#991)
• 931e664 Bump version to 3.22.0
• e26930e Bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group (...
• 92cd5a0 Bump github/codeql-action in the github-actions group
• 32be66f Guard with_capacity_and_hasher against untrusted size_hint (DoS) (#971)
• 33871cd Merge branch 'master' into fix/duplicate-key-impls-capacity-overflow
• bb1e064 Change function position within impl (#968)
• 202d3dd Improve the time unit macros to remove unnecessary repetition and make the co...
• b347efb Move the use_duration_signed_ser/*_de macros utils
• 6590545 chrono_0_4: Implement the same time unit macro cleanup as jiff_0_2
• Additional commits viewable in compare view

Updates wasm-encoder from 0.253.0 to 0.255.0

Commits

• See full diff in compare view

Updates wasmparser from 0.253.0 to 0.255.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions