chore(deps): bump the rust-deps group across 1 directory with 3 updates

[dependabot]

Bumps the rust-deps group with 3 updates in the / directory: office_oxide, thiserror and trybuild.

Updates office_oxide from 0.1.11 to 0.1.13

Release notes

Sourced from office_oxide's releases.

v0.1.13 | Every finding of the 2026-09-27 audit — 19 issues, 165 checklist items — plus ten resource-bound defects reported privately, fixed test-first: each with a minimal synthetic document built in code, a test that fails before the fix and passes after. A two-arm sweep of 10,215 unique real Office documents against v0.1.12 then found nine regressions introduced by those fixes; all nine are fixed below, each with its own regression test, and the re-run sweep shows no crash, no timeout, no unintended new failure and no real slowdown.

Verified

Every Office document under ~/projects — 16,247 files across 13 projects, 10,215 unique by content hash (.docx 3,446, .xlsx 3,039, .xls 1,177, .pptx 1,139, .doc 793, .ppt 413 and 208 macro/template/binary variants) — swept arm-to-arm with v0.1.12 on four surfaces (text, markdown, html, ir), 40,860 observations per arm, compared with scripts/regression-sweep/compare_tree.py (status transitions, word multisets with split/join awareness, timing).

	v0.1.12	0.1.13
crashes / timeouts	0 / 0	0 / 0
files newly failing	—	11, all intended: 10 password-protected .ppt decks that v0.1.12 returned as empty text now fail with Encrypted, and one package with case-only duplicate part names (5 bytes under v0.1.12) is refused as POI refuses it
slowdowns (≥ 1.5× and ≥ 200 ms, re-timed serially)	—	0 for the same output; 3 pairs are slower only because they now produce correct content v0.1.12 dropped (compressed WMF pictures inflated into valid metafiles, an external-source pivot's cached data, real per-cell fills and borders)

The 0.1.13 sweeps found eleven regressions introduced by this release's own fixes (listed under Fixed); each was fixed with a regression test and the full sweep re-run after every fix, the last on the release head. Every remaining word-level difference was read and resolved to a deliberate class: first-page headers/footers of sections without titlePg (Word does not show them), PowerPoint master placeholder prompts, v0.1.12's synthetic SheetN names replaced by real BIFF5 names, the in-text nested-table notice moved to Metadata::warnings, relationship ids no longer written as markdown image targets, linked-picture URLs moving from text into <img src>, and superscripts rendered as <sup>. 1,476 file/surface pairs only gained words.

Security

Resource bounds for untrusted input — each was reachable from a small file through every binding and the MCP server:

• CFB (.doc/.xls/.ppt): the header's mini-stream cutoff no longer sizes an allocation (the spec's fixed 4096 is used, as POI does), and mini-stream reads reserve at most the mini stream; FAT construction is bounded by the sectors the file holds, a FAT sector listed twice is an error, and DIFAT slots past the declared FAT count are ignored.
• XLS / XLSX to_ir(): merged-range and hyperlink-range expansion is clipped to the cells that exist and bounded by a per-sheet work budget — a 2 KB file declaring a full-grid merge no longer hangs; ranges past the budget are reported with a notice.
• DOCX: text boxes nested in text boxes are capped (16 levels, measured against a 2 MiB stack) with a visible truncation notice; one wide table row no longer makes every row cost the full width in to_ir() and the renderers.
• IR renderers and IR writers: recursion over a deserialized DocumentIR is depth-bounded on every surface (plain text, markdown, HTML, DOCX/XLSX/PPTX writers); a skipped subtree leaves a visible notice.
• PPT: table-grid clustering arithmetic is widened, so extreme shape anchors no longer overflow.
• OPC packages: the zip central directory is walked independently of the zip crate, so a ZIP64 archive or an understated EOCD count can no longer hide a duplicate entry; a package's entry count (100,000) and total decompressed bytes (2 GiB) are bounded (limits::max_package_entries, limits::max_package_bytes) with a new core::Error::PackageLimit.
• FFI: every extern "C" export contains panics, so a bug can no longer unwind into — and abort — the host process (Node, Go, .NET, CPython).

Fixed

• XLS (#422, #411): a defined name, conditional format or comment on row 65,536 no longer overflows (panic in debug, row 0 in release); BIFF5 sheet names, FORMAT and STRING records are decoded with the BIFF5 layouts; chart, dialog and VBA-module substreams are no longer read as worksheets full of plotted values; Excel 4.0 macro sheets keep their cells; encrypted BIFF2–4 files are refused; a truncated SST is flagged only when a cell loses its string, and a malformed SST header no longer fails the workbook; MULRK/MULBLANK column arithmetic stays in range; sheets are paired with their substreams by stream offset; macros are detected through the _VBA_PROJECT_CUR storage Excel actually writes.
• XLSX / XLSB (#407): sparse rows and columns are placed by cell reference in plain_text, to_csv and to_markdown; set_cell writes into <sheetData/> and resolves sheets through the workbook relationships; a sheet with a missing part is reported and hidden flags stay aligned; chartsheets and dialog sheets surface as named sections with their chart text and no cells, macro sheets with their cells; sheet headers/footers, table parts, pivot tables (and pivot cache records when the source is not in the workbook), t="d" dates, cell alignment, wrap text, fills and borders are read; defined names, sheet visibility and xml:space="preserve" are written.
• DOCX (#406): table rows and cells wrapped in w:ins/w:moveTo/w:customXml are kept; ruby guides stay out of the base text; fonts and sizes follow the script of the text (eastAsia/hAnsi/cs, szCs/bCs); full lvlOverride levels, level indents, marker patterns and alignment are read; comments keep their anchor and round-trip as comments; table styles apply their borders, shading and conditional run/paragraph formatting consistently in to_ir() and the direct renderers; hyperlink runs inside w:ins/w:sdt/w:smartTag, <w:tab></w:tab>, linked pictures, section page numbering and note settings are read; replace_text matches text split across runs and reaches headers, footers, notes and comments; nested lists are written under their parent item.
• DOC (#410): reference-mark and hyphen control characters no longer leak into text; every section has its own headers/footers and IR section; hidden, strike, super/subscript, highlight, colour and line-spacing SPRMs are decoded; negated ilfo values, piece Prm modifiers, PICF pictures (including all Word 6.0/95 pictures) are resolved; each text box is its own element, placed after the paragraph holding its anchor; a flattened nested table is a metadata warning instead of fabricated document text.
• PPT (#412): speaker notes are extracted from real files; encrypted decks fail with PptError::Encrypted instead of returning empty text; header/footer text follows its container, flags and per-slide overrides; typefaces, internal-jump hyperlinks, media placeholders and master text styles at every level are resolved, with masters found through the master list rather than a masked persist id; hyperlink and style ranges are measured in UTF-16 units; master boilerplate is excluded by structure, not English prompt strings; static master text and the shown notes/handout header and footer appear once per deck.
• PPTX (#408): real SmartArt text is read from the diagram data part; replace_text reaches every slide, notes, layout and master part; the full text-style inheritance chain is resolved; comment authors, linked pictures, media and OLE previews, paragraph spacing/indents/tabs and percent spacing are read; one policy for unreadable slide, notes and comment parts; static layout/master text appears once per deck, placeholder prompts never.
• CFB (#409): compressed EMF/WMF/PICT pictures are inflated (one shared BLIP decoder); the mini stream is bounded by the root entry's size; short stream reads are reported; directory names compare Unicode case-insensitively; SummaryInformation is found by FMTID.
• OPC core (#414): case-only duplicate part names are rejected; a repeated relationship Id resolves to its first occurrence; _rels filtering, the main-part fallback, root-close check and Strict namespace alternates are exact.
• Metadata (#419): app.xml keeps entity references; lastModifiedBy, revision, category, content status, language, company, manager, custom properties, signature presence and the thumbnail reach the IR, the CLI and MCP info, and are written back; every writer emits docProps/app.xml; legacy DocumentSummaryInformation is read.
• Write path (#415): speaker-note hyperlinks resolve in the notes part; ordered lists are written with buAutoNum; no XML-illegal characters in comments or relationship targets; the DOCX page background is displayed; notesMasterIdLst is declared; an empty text box holds a paragraph; markdown keeps # Learn C# and an ordered list's start number; w:outlineLvl is clamped.
• Bindings (#416): Python and JS writers store booleans as booleans; Go, C# and JS surface writer status codes as errors; FFI error codes follow the error variant; formulas can be written from every binding; from_bytes editing and markdown with images are available in Go, JS, C# and Python; integers beyond 2^53 are refused rather than rounded.
• CLI / MCP (#417): an empty search string is an error in the library (it used to overwrite the original through MCP); in-place saves are atomic; MCP no longer replies to notifications; stdout errors are reported instead of panicking; info reports every set property and the reader's warnings.
• Parsed-but-inert (#418): hyperlink tooltips, title_page, row height rules, the gutter, the decorative-picture flag, table styles, numbering marker text, shading patterns, XLSX fills/borders and theme fonts now reach the IR (and the writers).
• Text with entity references keeps its spaces (see A & B was read as see A&B) in every reader that trims text.
• Regressions the release sweep found in this release's own fixes, each with a regression test: a CDATA sheet header failed the whole sheet; a CRC-damaged part failed its whole document (it is now read and reported in Metadata::warnings) and an XLSX sheet whose part failed to read could fall back to another sheet's cells; the HTML renderer cut the deepest levels of a table the reader had kept; sprmCFVanish operand 0x81 hid ordinary visible text; macro sheets lost their cells and chart/dialog sheets their tab names; static slide-master text and shown notes/handout headers and footers vanished from .ppt; a first-page header a later titlePg section inherits was hidden; pivot caches were parsed once per pivot even when a workbook table made them unnecessary (4.7× slower open on a 17-pivot workbook).

Performance

• DOC piece-table lookups binary-search in CP and FC (#421); PPTX shared layouts, images and charts are read once per deck; DOCX altChunk HTML is flattened in linear time, each paragraph is converted once and each style chain folded once per conversion; XLSX date styles are found once and custom number formats compiled once per render.

Changed

... (truncated)

Changelog

Sourced from office_oxide's changelog.

[0.1.13] - 2026-09-30

Every finding of the 2026-09-27 audit — 19 issues, 165 checklist items — plus ten resource-bound defects reported privately, fixed test-first: each with a minimal synthetic document built in code, a test that fails before the fix and passes after. A two-arm sweep of 10,215 unique real Office documents against v0.1.12 then found nine regressions introduced by those fixes; all nine are fixed below, each with its own regression test, and the re-run sweep shows no crash, no timeout, no unintended new failure and no real slowdown.

Verified

Every Office document under ~/projects — 16,247 files across 13 projects, 10,215 unique by content hash (.docx 3,446, .xlsx 3,039, .xls 1,177, .pptx 1,139, .doc 793, .ppt 413 and 208 macro/template/binary variants) — swept arm-to-arm with v0.1.12 on four surfaces (text, markdown, html, ir), 40,860 observations per arm, compared with scripts/regression-sweep/compare_tree.py (status transitions, word multisets with split/join awareness, timing).

	v0.1.12	0.1.13
crashes / timeouts	0 / 0	0 / 0
files newly failing	—	11, all intended: 10 password-protected .ppt decks that v0.1.12 returned as empty text now fail with Encrypted, and one package with case-only duplicate part names (5 bytes under v0.1.12) is refused as POI refuses it
slowdowns (≥ 1.5× and ≥ 200 ms, re-timed serially)	—	0 for the same output; 3 pairs are slower only because they now produce correct content v0.1.12 dropped (compressed WMF pictures inflated into valid metafiles, an external-source pivot's cached data, real per-cell fills and borders)

The 0.1.13 sweeps found eleven regressions introduced by this release's own fixes (listed under Fixed); each was fixed with a regression test and the full sweep re-run after every fix, the last on the release head. Every remaining word-level difference was read and resolved to a deliberate class: first-page headers/footers of sections without titlePg (Word does not show them), PowerPoint master placeholder prompts, v0.1.12's synthetic SheetN names replaced by real BIFF5 names, the in-text nested-table notice moved to Metadata::warnings, relationship ids no longer written as markdown image targets, linked-picture URLs moving from text into <img src>, and superscripts rendered as <sup>. 1,476 file/surface pairs only gained words.

Security

Resource bounds for untrusted input — each was reachable from a small file through every binding and the MCP server:

• CFB (.doc/.xls/.ppt): the header's mini-stream cutoff no longer sizes an allocation (the spec's fixed 4096 is used, as POI does), and mini-stream reads reserve at most the mini stream; FAT construction is bounded by the sectors the file holds, a FAT sector listed twice is an error, and DIFAT slots past the declared FAT count are ignored.
• XLS / XLSX to_ir(): merged-range and hyperlink-range expansion is clipped to the cells that exist and bounded by a per-sheet work budget — a 2 KB file declaring a full-grid merge no longer hangs; ranges past the budget are reported with a notice.
• DOCX: text boxes nested in text boxes are capped (16 levels, measured against a 2 MiB stack) with a visible truncation notice; one wide table row no longer makes every row cost the full width in to_ir() and the renderers.
• IR renderers and IR writers: recursion over a deserialized DocumentIR is depth-bounded on every surface (plain text, markdown, HTML, DOCX/XLSX/PPTX writers); a skipped subtree leaves a visible notice.
• PPT: table-grid clustering arithmetic is widened, so extreme shape anchors no longer overflow.
• OPC packages: the zip central directory is walked independently of the zip crate, so a ZIP64 archive or an understated EOCD count can no longer hide a duplicate entry; a package's entry count (100,000) and total decompressed bytes (2 GiB) are bounded (limits::max_package_entries, limits::max_package_bytes) with a new core::Error::PackageLimit.
• FFI: every extern "C" export contains panics, so a bug can no longer unwind into — and abort — the host process (Node, Go, .NET, CPython).

Fixed

• XLS (#422, #411): a defined name, conditional format or comment on row 65,536 no longer overflows (panic in debug, row 0 in release); BIFF5 sheet names, FORMAT and STRING records are decoded with the BIFF5 layouts; chart, dialog and VBA-module substreams are no longer read as worksheets full of plotted values; Excel 4.0 macro sheets keep their cells; encrypted BIFF2–4 files are refused; a truncated SST is flagged only when a cell loses its string, and a malformed SST header no longer fails the workbook; MULRK/MULBLANK column arithmetic stays in range; sheets are paired with their substreams by stream offset; macros are detected through the _VBA_PROJECT_CUR storage Excel actually writes.
• XLSX / XLSB (#407): sparse rows and columns are placed by cell reference in plain_text, to_csv and to_markdown; set_cell writes into <sheetData/> and resolves sheets through the workbook relationships; a sheet with a missing part is reported and hidden flags stay aligned; chartsheets and dialog sheets surface as named sections with their chart text and no cells, macro sheets with their cells; sheet headers/footers, table parts, pivot tables (and pivot cache records when the source is not in the workbook), t="d" dates, cell alignment, wrap text, fills and borders are read; defined names, sheet visibility and xml:space="preserve" are written.
• DOCX (#406): table rows and cells wrapped in w:ins/w:moveTo/w:customXml are kept; ruby guides stay out of the base text; fonts and sizes follow the script of the text (eastAsia/hAnsi/cs, szCs/bCs); full lvlOverride levels, level indents, marker patterns and alignment are read; comments keep their anchor and round-trip as comments; table styles apply their borders, shading and conditional run/paragraph formatting consistently in to_ir() and the direct renderers; hyperlink runs inside w:ins/w:sdt/w:smartTag, <w:tab></w:tab>, linked pictures, section page numbering and note settings are read; replace_text matches text split across runs and reaches headers, footers, notes and comments; nested lists are written under their parent item.
• DOC (#410): reference-mark and hyphen control characters no longer leak into text; every section has its own headers/footers and IR section; hidden, strike, super/subscript, highlight, colour and line-spacing SPRMs are decoded; negated ilfo values, piece Prm modifiers, PICF pictures (including all Word 6.0/95 pictures) are resolved; each text box is its own element, placed after the paragraph holding its anchor; a flattened nested table is a metadata warning instead of fabricated document text.
• PPT (#412): speaker notes are extracted from real files; encrypted decks fail with PptError::Encrypted instead of returning empty text; header/footer text follows its container, flags and per-slide overrides; typefaces, internal-jump hyperlinks, media placeholders and master text styles at every level are resolved, with masters found through the master list rather than a masked persist id; hyperlink and style ranges are measured in UTF-16 units; master boilerplate is excluded by structure, not English prompt strings; static master text and the shown notes/handout header and footer appear once per deck.
• PPTX (#408): real SmartArt text is read from the diagram data part; replace_text reaches every slide, notes, layout and master part; the full text-style inheritance chain is resolved; comment authors, linked pictures, media and OLE previews, paragraph spacing/indents/tabs and percent spacing are read; one policy for unreadable slide, notes and comment parts; static layout/master text appears once per deck, placeholder prompts never.
• CFB (#409): compressed EMF/WMF/PICT pictures are inflated (one shared BLIP decoder); the mini stream is bounded by the root entry's size; short stream reads are reported; directory names compare Unicode case-insensitively; SummaryInformation is found by FMTID.
• OPC core (#414): case-only duplicate part names are rejected; a repeated relationship Id resolves to its first occurrence; _rels filtering, the main-part fallback, root-close check and Strict namespace alternates are exact.
• Metadata (#419): app.xml keeps entity references; lastModifiedBy, revision, category, content status, language, company, manager, custom properties, signature presence and the thumbnail reach the IR, the CLI and MCP info, and are written back; every writer emits docProps/app.xml; legacy DocumentSummaryInformation is read.
• Write path (#415): speaker-note hyperlinks resolve in the notes part; ordered lists are written with buAutoNum; no XML-illegal characters in comments or relationship targets; the DOCX page background is displayed; notesMasterIdLst is declared; an empty text box holds a paragraph; markdown keeps # Learn C# and an ordered list's start number; w:outlineLvl is clamped.
• Bindings (#416): Python and JS writers store booleans as booleans; Go, C# and JS surface writer status codes as errors; FFI error codes follow the error variant; formulas can be written from every binding; from_bytes editing and markdown with images are available in Go, JS, C# and Python; integers beyond 2^53 are refused rather than rounded.
• CLI / MCP (#417): an empty search string is an error in the library (it used to overwrite the original through MCP); in-place saves are atomic; MCP no longer replies to notifications; stdout errors are reported instead of panicking; info reports every set property and the reader's warnings.
• Parsed-but-inert (#418): hyperlink tooltips, title_page, row height rules, the gutter, the decorative-picture flag, table styles, numbering marker text, shading patterns, XLSX fills/borders and theme fonts now reach the IR (and the writers).
• Text with entity references keeps its spaces (see A & B was read as see A&B) in every reader that trims text.
• Regressions the release sweep found in this release's own fixes, each with a regression test: a CDATA sheet header failed the whole sheet; a CRC-damaged part failed its whole document (it is now read and reported in Metadata::warnings) and an XLSX sheet whose part failed to read could fall back to another sheet's cells; the HTML renderer cut the deepest levels of a table the reader had kept; sprmCFVanish operand 0x81 hid ordinary visible text; macro sheets lost their cells and chart/dialog sheets their tab names; static slide-master text and shown notes/handout headers and footers vanished from .ppt; a first-page header a later titlePg section inherits was hidden; pivot caches were parsed once per pivot even when a workbook table made them unnecessary (4.7× slower open on a 17-pivot workbook).

Performance

• DOC piece-table lookups binary-search in CP and FC (#421); PPTX shared layouts, images and charts are read once per deck; DOCX altChunk HTML is flattened in linear time, each paragraph is converted once and each style chain folded once per conversion; XLSX date styles are found once and custom number formats compiled once per render.

... (truncated)

Commits

• 7fce609 Release v0.1.13 — all 2026-09-27 audit findings fixed test-first, resource bo...
• 642ea18 Release v0.1.12 — legacy-format structure, 183 read/write fidelity fixes, eve...
• 14ce2cf chore(ci): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#129)
• 9147f92 chore(deps): bump koffi from 3.1.6 to 3.2.1 in /js (#198)
• 719e0da chore(deps): bump encoding_rs from 0.8.35 to 0.8.41 (#222)
• See full diff in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates trybuild from 1.0.121 to 1.0.122

Release notes

Sourced from trybuild's releases.

1.0.122

• Avoid triggering cargo::unused_workspace_dependencies warning in synthesized workspace (#344, thanks @​tamaro-skaljic)

Commits

• 3f6a324 Release 1.0.122
• ce13e9b Merge pull request 344 from tamaro-skaljic/fix/issue-343-unused-workspace-dep...
• d027c0b Copy only inherited workspace dependencies into generated manifest
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.