Rust 1.98.0 (2026-08-20) is current stable; the toolchain pin was already
updated locally and is committed here as part of the sweep.
cargo update takes the semver-compatible drift — 14 packages, including rustls,
tokio, serde_json, zbus, zvariant, wasm-bindgen and zerocopy.
Of the nine major bumps available, two are taken and neither was a plain version
change:
jsonwebtoken 10 -> 11, in the workspace only. tooling/compliance stays on 10
because it hands a jsonwebtoken::EncodingKey to octocrab, which still depends on
^10; moving only that side swaps the type out from under octocrab and cannot
build. The reason is recorded in the manifest so the inconsistency does not look
like an oversight. livekit_api's usage touches none of 11.0's breaking list.
resvg and usvg 0.47 -> 0.48.1, in lockstep, with "svgz" added explicitly. 0.48
moved gzipped-SVG decoding behind a feature gate that used to be unconditional,
and this build sets default-features = false — so the bump alone would have
dropped .svgz support with no compile error, surfacing only as a runtime
SvgzFeatureNotEnabled. The pair must move together or usvg::Tree stops being the
type resvg::render accepts.
Seven are held, each for a reason found by reading the changelog against our own
usage rather than by trying it:
- ed25519-dalek 2 -> 3: all four open-standards workspaces pin "2" and SigningKey
crosses that boundary. Type identity, not version resolution.
- taffy 0.10 -> 0.14: the API work is small (16 alignment constant renames, one
measure-closure rewrite) but four minors carry ~60 behavioural layout changes,
and this fork adds bespoke device-pixel snapping on top of taffy's output with
a single layout test to catch a regression.
- core-text 22 and core-graphics 0.25: coupled through the zed-font-kit fork pin,
so not independently upgradable.
- coreaudio-rs, wit-bindgen, mdbook: bounded work, but each deserves its own
change rather than riding along in a dependency sweep.
windows 0.62 needed nothing: that migration shipped in 1b5f1c3. The 0.61 pair
cargo-outdated still reports is etw_tracing's deliberate second stack for
wprcontrol, which shares no types across the boundary.
Verified with a targeted check of the two crates the changes actually reach —
gpui and livekit_api, both clean — plus joule_core's 287 tests. The full
--workspace --all-targets run got through most of the graph with no code errors
before dying on ENOSPC; the volume is at 99%.
Co-Authored-By: Claude Opus 5 <[email protected]>
81f79d8a59