Bump the cargo-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the cargo-minor-patch group with 3 updates in the / directory: mrrc, serde and serde_json.

Updates mrrc from 0.9.1 to 0.9.2

Release notes

Sourced from mrrc's releases.

v0.9.2

Security

• Bump quick-xml to 0.41.0, fixing the RUSTSEC-2026-0194/0195 DoS advisories on the MARCXML read/write path. The BIBFRAME/RDF path is not covered: oxrdfxml pins quick-xml ^0.37 and still resolves to the affected 0.37.5. Since bibframe is a default feature (and is always enabled in the Python wheel), a default build still contains the affected code on the RDF serialization path. Both advisories are DoS-class.
• Bump crossbeam-epoch to 0.9.20, fixing the RUSTSEC-2026-0204 invalid-pointer-dereference advisory (reached transitively through rayon).
• Gate PyPI publishing behind a required-reviewer GitHub environment, so a release cannot upload without maintainer approval.
• Harden the CI and release workflows: pin all third-party actions to commit SHAs, disable git-credential persistence in checkouts, scope job token permissions to least privilege, and add a zizmor workflow-security scan to CI.

Dependencies

• Bump pytest from 9.1.0 to 9.1.1
• Bump ruff from 0.15.17 to 0.15.21
• Bump pymdown-extensions from 10.21.3 to 11.0.1
• Bump foldhash from 0.1.5 to 0.2.0
• Bump CodSpeedHQ/action from 4.17.5 to 4.18.5
• Bump softprops/action-gh-release from 3.0.0 to 3.0.2
• Bump actions/checkout from 6.0.3 to 7.0.0
• Bump actions/cache from 5 to 6.1.0
• Bump pyright from 1.1.410 to 1.1.411
• Bump syrupy from 5.3.2 to 5.5.3
• Bump regex from 1.12.4 to 1.13.0
• Bump memchr from 2.8.2 to 2.8.3
• Bump crossbeam-channel from 0.5.15 to 0.5.16
• Bump mypy from 2.1.0 to 2.3.0
• Bump pymarc from 5.3.1 to 5.4.0
• Bump astral-sh/setup-uv from 8.2.0 to 8.3.2
• Bump actions/setup-python from 6.2.0 to 6.3.0
• Bump docker/setup-qemu-action from 4.1.0 to 4.2.0
• Bump anyhow from 1.0.102 to 1.0.103 (dev-dependency, used by examples only; picks up the RUSTSEC-2026-0190 Error::downcast_mut() unsoundness fix, which does not affect the published library or wheel)

Changelog

Sourced from mrrc's changelog.

[0.9.2] - 2026-07-27

Security

• Bump quick-xml to 0.41.0, fixing the RUSTSEC-2026-0194/0195 DoS advisories on the MARCXML read/write path. The BIBFRAME/RDF path is not covered: oxrdfxml pins quick-xml ^0.37 and still resolves to the affected 0.37.5. Since bibframe is a default feature (and is always enabled in the Python wheel), a default build still contains the affected code on the RDF serialization path. Both advisories are DoS-class.
• Bump crossbeam-epoch to 0.9.20, fixing the RUSTSEC-2026-0204 invalid-pointer-dereference advisory (reached transitively through rayon).
• Gate PyPI publishing behind a required-reviewer GitHub environment, so a release cannot upload without maintainer approval.
• Harden the CI and release workflows: pin all third-party actions to commit SHAs, disable git-credential persistence in checkouts, scope job token permissions to least privilege, and add a zizmor workflow-security scan to CI.

Dependencies

• Bump pytest from 9.1.0 to 9.1.1
• Bump ruff from 0.15.17 to 0.15.21
• Bump pymdown-extensions from 10.21.3 to 11.0.1
• Bump foldhash from 0.1.5 to 0.2.0
• Bump CodSpeedHQ/action from 4.17.5 to 4.18.5
• Bump softprops/action-gh-release from 3.0.0 to 3.0.2
• Bump actions/checkout from 6.0.3 to 7.0.0
• Bump actions/cache from 5 to 6.1.0
• Bump pyright from 1.1.410 to 1.1.411
• Bump syrupy from 5.3.2 to 5.5.3
• Bump regex from 1.12.4 to 1.13.0
• Bump memchr from 2.8.2 to 2.8.3
• Bump crossbeam-channel from 0.5.15 to 0.5.16
• Bump mypy from 2.1.0 to 2.3.0
• Bump pymarc from 5.3.1 to 5.4.0
• Bump astral-sh/setup-uv from 8.2.0 to 8.3.2
• Bump actions/setup-python from 6.2.0 to 6.3.0
• Bump docker/setup-qemu-action from 4.1.0 to 4.2.0
• Bump anyhow from 1.0.102 to 1.0.103 (dev-dependency, used by examples only; picks up the RUSTSEC-2026-0190 Error::downcast_mut() unsoundness fix, which does not affect the published library or wheel)

Commits

• a3a55b8 chore(release): v0.9.2 (#431)
• 28c8f65 docs(changelog): scope the quick-xml security note; record oxrdf upstream sta...
• 1867299 docs(changelog): record merged dependency bumps (#413–#428) (#429)
• 9f932d1 chore(deps): Bump mypy from 2.1.0 to 2.3.0 (#428)
• fbb7c82 chore(deps): Bump regex from 1.12.4 to 1.13.0 (#422)
• 0dacbd4 chore(deps): Bump CodSpeedHQ/action from 4.18.2 to 4.18.5 (#426)
• f1250b6 chore(deps): Bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#424)
• c17075b chore(deps): Bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#423)
• e942d3a chore(deps): Bump memchr from 2.8.2 to 2.8.3 (#421)
• f03f9c0 chore(deps): Bump syrupy from 5.5.1 to 5.5.3 (#425)
• Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions