Bump the dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the dependencies group with 5 updates in the / directory:

Package	From	To
sqlx	0.8.6	0.9.0
thiserror	2.0.18	2.0.19
serde_json	1.0.149	1.0.151
serde	1.0.228	1.0.229
mlua	0.11.6	0.12.0

Updates sqlx from 0.8.6 to 0.9.0

Changelog

Sourced from sqlx's changelog.

0.9.0 - 2026-05-06

Important Announcements

New Github Organization

Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization: https://github.com/transact-rs/

This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been informally transferred to the collective ownership of its principal authors. Moving the repository to a new organization makes this change more clear, and also allows for potentially inviting outside collaborators.

Cargo.lock Removed from Tracking

The Cargo.lock has been removed from tracking in Git. CI should now always test with the latest versions of all dependencies by default, alongside our pass that checks with cargo generate-lockfile -Z minimal-versions.

This should eliminate the need for any PRs that update dependencies to also update Cargo.lock or contend with an endless stream of merge conflicts against it.

N.B. cargo install --locked sqlx-cli will no longer work. However, cargo install sqlx-cli has always used the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran cargo update sporadically, so relying on SQLx's lockfile offered few guarantees anyway.

See [the manual page for cargo install][man-cargo-install] for details.

Breaking

As per our MSRV policy, the supported Rust version for this release cycle is 1.94.0.

• [#3383]: feat: create sqlx.toml format [[@​abonander]]
  • SQLx and sqlx-cli now support per-crate configuration files (sqlx.toml)
  • New functionality includes, but is not limited to:
    • Rename DATABASE_URL for a crate (for multi-database workspaces)
    • Set global type overrides for the macros (supporting custom types)
    • Rename or relocate the _sqlx_migrations table (for multiple crates using the same database)
    • Set characters to ignore when hashing migrations (e.g. ignore whitespace)
  • More to be implemented in future releases.
  • Enable feature sqlx-toml to use.
    • sqlx-cli has it enabled by default, but sqlx does not.
    • Default features of library crates can be hard to completely turn off because of [feature unification], so it's better to keep the default feature set as limited as possible. [This is something we learned the hard way.][preferred-crates]
  • Guide: see sqlx::_config module in documentation.
  • Reference: [Link]
  • Examples (written for Postgres but can be adapted to other databases; PRs welcome!):
    • Multiple databases using DATABASE_URL renaming and global type overrides: [Link]
    • Multi-tenant database using _sqlx_migrations renaming and multiple schemas: [Link]
    • Force use of chrono when time is enabled (e.g. when using tower-sessions-sqlx-store): [[Link][preferred-crates]]
      • Forcing bigdecimal when rust_decimal is enabled is also shown, but problems with chrono/time are more common.

... (truncated)

Commits

• 75bc048 Release 0.9.0 (#4256)
• 6956cef Prefer to give real data to .bind() in README.md (#4257)
• 45ba990 Add the possibility to skip migrations (#3846)
• 66533fa Ensure Deterministic Migration Order (#4136)
• db47fe3 ci: check direct minimal versions (#4173)
• 9ecb76d Unescape PostgreSQL passfile password (#3993)
• c0a3218 breaking(any+mysql): correctly convert text and blob types to AnyTypeInfo (...
• d82b781 test(sqlite): add regression test for ORDER BY + LIMIT nullability (#4223)
• b77ba16 chore: update to axum 0.8 (#4253)
• c0ec9c0 fix(tls): potential deadlock in StdSocket::poll_ready() (#4251)
• Additional commits viewable in compare view

Updates thiserror from 2.0.18 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

• Update to syn 3

Commits

• e13a785 Release 2.0.19
• 0a0e76c Update to syn 3
• ec42ea7 Update actions/upload-artifact@v6 -> v7
• 4178c4a Update actions/checkout@v6 -> v7
• 7214e0e Ignore items_after_statements pedantic clippy lint in test
• febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
• c50e387 chore: improve thiserror maintenance path
• d4a2507 Raise minimum tested compiler to rust 1.85
• 99e8a6c Unpin CI miri toolchain
• 9ac165c Pin CI miri to nightly-2026-02-11
• Additional commits viewable in compare view

Updates serde_json from 1.0.149 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates mlua from 0.11.6 to 0.12.0

Release notes

Sourced from mlua's releases.

v0.12.0

Highlights

More ergonomic UserData building blocks

• Declaratively implement UserData with #[derive(UserData)] and register methods/fields with the new #[mlua::userdata_impl] attribute macro.
• UserDataOwned<T> wrapper takes ownership of userdata and implements FromLua
• UserDataMethods::add_method_once/add_async_method_once
• __todebugstring metamethod for pretty-printing userdata when debugging
• MaybeSync trait for userdata under the send feature

Reorganized public API

Types are now grouped into focused modules: chunk, debug, error, function, table, string, state, thread, userdata and luau.

Thread lifecycle callbacks

Hook into coroutine create/resume/yield events across all Lua versions (when using mlua API).

Luau improvements

Latest Luau with extended require-by-string support and JIT options.

Garbage-collector interface refactor

Lua::gc_inc / Lua::gc_gen are replaced by a Lua::gc_set_mode, with GcIncParams/GcGenParams for fine-grained tuning.

What's Changed (since v0.12.0-rc.2)

• Crate root re-exports are refactored (only essentials are re-exported, the rest is in the new submodules)
• Added ThreadStatus::Normal and Thread::is_normal (mimic coroutine.status)
• Added Lua::set_jit_options with support of Luau JIT inliner (Luau)
• Added Value::as_vector/Value::is_vector (Luau)
• Added Table::remove
• serde: tables with the array metatable are always encoded as arrays (incl. detect_mixed_tables option)
• impl Hash for BorrowedStr/BorrowedBytes
• Lua::current_thread resolves implicit async threads to their root owner (#706)
• Bugfixes and improvements

Full Changelog: mlua-rs/mlua@v0.11.6...v0.12.0

v0.12.0-rc.2

The new stable version is almost ready and will be released after some testing

What's Changed

• Add #[derive(UserData)] and #[userdata_impl] macros
• Support thread create/resume/yield callbacks for all Lua versions (including Luau)
• Support to_alias_override/to_alias_fallback in Require trait (Luau)
• Prevent XRc overflow when dropping RawLua with foreign Lua state

... (truncated)

Changelog

Sourced from mlua's changelog.

v0.12.0 (Jul 05, 2026)

Changes since v0.12.0-rc.2

• Create root re-exports are refactored (only essentials are re-exported, the rest is in the new submodules)
• Added ThreadStatus::Normal and Thread::is_normal (mimic coroutine.status)
• Added Lua::set_jit_options with support of Luau JIT inliner (Luau)
• Added Value::as_vector/Value::is_vector (Luau)
• Added Table::remove
• serde: tables with the array metatable are always encoded as arrays (incl. detect_mixed_tables option)
• impl Hash for BorrowedStr/BorrowedBytes
• Lua::current_thread resolves implicit async threads to their root owner (#706)
• Bugfixes and improvements

v0.12.0-rc.2 (Jun 06, 2026)

• Add #[derive(UserData)] and #[mlua::userdata_impl] macros
• Support thread create/resume/yield callbacks for all Lua versions (including Luau)
• Support to_alias_override/to_alias_fallback in Require trait (Luau)
• Prevent XRc overflow when dropping RawLua with foreign Lua state
• implement Not for StdLib (#699)
• Fix String::to_pointer return NULL in Lua <5.4

v0.12.0-rc.1 (Apr 21, 2026)

• Rust 2024 edition
• Removed Error::ToLuaConversionError variant as it was unused (and not practically useful)
• New modules to group data types: chunk, debug, error, function, table, string, state, thread, userdata, luau
• Support __todebugstring metamethod for pretty formatting userdata value (for debugging)
• New MaybeSync trait that is required for userdata types
• Removed lifetime from BorrowedStr and BorrowedBytes
• New Thread methods: is_resumable, is_running, is_finished, is_error
• Added Thread::state to get raw Lua state pointer
• Luau TextRequirer is renamed to FsRequirer
• GC interface refactor: Lua::gc_inc/Lua::gc_gen is replaced with gc_set_mode
• Added GcIncParams and GcGenParams for GC tuning
• New UserDataMethods::add_method_once and UserDataMethods::add_async_method_once
• Initial Luau integer64 type support
• Changed interface of Function::wrap/wrap_mut/wrap_async to support any Error type
• Changed AnyUserData::type_name to return LuaString instead
• Added UserDataOwned<T> wrapper to take ownership of userdata T and implements FromLua

Commits

• 8eddf85 v0.12.0
• 46d3783 Update CHANGELOG
• 7ddcdc1 Add Table::remove
• 6b19eeb Make VmState as non_exhaustive
• b64da48 Make NavigateError as non_exhaustive (Luau)
• cddbcc5 Refactor crate-root re-exports and drop hidden backward-compat aliases
• 1af17ec Various doc updates and refinement
• eef5985 Rename LuaJitOptions to LuauJitOptions in prelude
• 9099d5f Rename JitOptions::set_inliner to JitOptions::inliner for consistency
• 34825d6 Fix Lua::gc_set_mode panic when GC is internally stopped (Lua 5.4/5.5)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions