From 90b21e07fa4c8435e19e47f2b7eaf33464803e60 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 4 May 2026 01:58:55 +0000
Subject: [PATCH 1/2] chore(deps): update rust crates

---
 Cargo.toml                     | 18 +++++++++---------
 crates/pty_terminal/Cargo.toml |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index e1e16cef9..78766b52c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,9 +39,9 @@ multiple_crate_versions = "allow"
 future_not_send = "allow"
 
 [workspace.dependencies]
-allocator-api2 = { version = "0.2.21", default-features = false, features = ["alloc", "std"] }
+allocator-api2 = { version = "0.4.0", default-features = false, features = ["alloc", "std"] }
 anyhow = "1.0.98"
-assert2 = "0.3.16"
+assert2 = "0.4.0"
 assertables = "9.8.1"
 async-trait = "0.1.89"
 base64 = "0.22.1"
@@ -64,7 +64,7 @@ cow-utils = "0.1.3"
 cp_r = "0.5.2"
 crossterm = { version = "0.29.0", features = ["event-stream"] }
 csv-async = { version = "1.3.1", features = ["tokio"] }
-ctor = "0.6"
+ctor = "0.13"
 ctrlc = "3.5.2"
 derive_more = "2.0.1"
 diff-struct = "0.5.3"
@@ -82,7 +82,7 @@ fspy_shared = { path = "crates/fspy_shared" }
 fspy_shared_unix = { path = "crates/fspy_shared_unix" }
 futures = "0.3.31"
 futures-util = "0.3.31"
-jsonc-parser = { version = "0.29.0", features = ["serde"] }
+jsonc-parser = { version = "0.32.0", features = ["serde"] }
 libc = "0.2.185"
 libtest-mimic = "0.8.2"
 memmap2 = "0.9.7"
@@ -100,7 +100,7 @@ notify = "8.0.0"
 path-clean = "1.0.1"
 pathdiff = "0.2.3"
 petgraph = "0.8.2"
-phf = { version = "0.11.3", features = ["macros"] }
+phf = { version = "0.13.0", features = ["macros"] }
 portable-pty = "0.9.0"
 pretty_assertions = "1.4.1"
 pty_terminal = { path = "crates/pty_terminal" }
@@ -110,14 +110,14 @@ ratatui = "0.30.0"
 rayon = "1.10.0"
 ref-cast = "1.0.24"
 regex = "1.11.3"
-rusqlite = "0.37.0"
+rusqlite = "0.39.0"
 rustc-hash = "2.1.1"
 # SeccompAction::UserNotif (SECCOMP_RET_USER_NOTIF) was added after the latest published release (v0.5.0)
 seccompiler = { git = "https://github.com/rust-vmm/seccompiler", rev = "08587106340b8e3cb361c7561411510039436857" }
 serde = "1.0.219"
 serde_json = "1.0.140"
 serde_norway = "0.9.42"
-sha2 = "0.10.9"
+sha2 = "0.11.0"
 shared_memory = "0.12.4"
 shell-escape = "0.1.5"
 similar = "2.7.0"
@@ -126,7 +126,7 @@ snapshot_test = { path = "crates/snapshot_test" }
 stackalloc = "1.2.1"
 subprocess_test = { path = "crates/subprocess_test" }
 supports-color = "3.0.1"
-syscalls = { version = "0.6.18", default-features = false }
+syscalls = { version = "0.8.0", default-features = false }
 tar = "0.4.45"
 tempfile = "3.14.0"
 test-log = { version = "0.2.18", features = ["trace"] }
@@ -159,7 +159,7 @@ wax = "0.7.0"
 which = "8.0.0"
 widestring = "1.2.0"
 winapi = "0.3.9"
-winsafe = { version = "0.0.24", features = ["kernel"] }
+winsafe = { version = "0.0.27", features = ["kernel"] }
 xxhash-rust = { version = "0.8.15", features = ["const_xxh3"] }
 ntest = "0.9.5"
 terminal_size = "0.4"
diff --git a/crates/pty_terminal/Cargo.toml b/crates/pty_terminal/Cargo.toml
index 67cd3f94c..77643cef6 100644
--- a/crates/pty_terminal/Cargo.toml
+++ b/crates/pty_terminal/Cargo.toml
@@ -21,7 +21,7 @@ terminal_size = { workspace = true }
 
 [target.'cfg(unix)'.dev-dependencies]
 nix = { workspace = true }
-signal-hook = "0.3"
+signal-hook = "0.4"
 
 [lints]
 workspace = true

From ae8043e64ab4aa855fbb264d03a3ccf6b37f75de Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 5 May 2026 07:34:20 +0000
Subject: [PATCH 2/2] fix: adapt to breaking changes in updated rust crates

- Revert allocator-api2 to 0.2.21 (bumpalo still requires 0.2.x)
- ctor 0.13: add `unsafe` to ctor attributes
- jsonc-parser 0.32: parse_to_serde_value is now generic; specify type
- sha2 0.11: finalize() output no longer implements LowerHex; format hex manually
- assert2 0.4: replace deprecated let_assert! with assert!(let ...)
---
 Cargo.lock                                 | 275 +++++++++++++++------
 Cargo.toml                                 |   2 +-
 crates/fspy_preload_unix/src/client/mod.rs |   2 +-
 crates/subprocess_test/src/lib.rs          |   2 +-
 crates/vite_path/src/absolute/mod.rs       |   6 +-
 crates/vite_path/src/relative.rs           |  22 +-
 crates/vite_task_bin/src/lib.rs            |   8 +-
 crates/vite_task_plan/src/envs.rs          |  12 +-
 8 files changed, 234 insertions(+), 95 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cd8ea0b06..65143ebd4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -138,20 +138,22 @@ checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
 
 [[package]]
 name = "assert2"
-version = "0.3.16"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d6c710e60d14b07d8f42d0e702b16120865eea39edb751e75cd6bf401d18f14"
+checksum = "a1f7e619706e24555d32d89b4446960bec3d085d1f488c659874b0929998bc28"
 dependencies = [
  "assert2-macros",
  "diff",
+ "terminal_size",
+ "unicode-width",
  "yansi",
 ]
 
 [[package]]
 name = "assert2-macros"
-version = "0.3.16"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9008cbbba9e1d655538870b91fd93814bd82e6968f27788fc734375120ac6f57"
+checksum = "347ba98d9bd5467cf7e5b5ea0a90b509d9b589060b302fcc0d9ae6268ff7e02e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -268,6 +270,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -539,6 +550,12 @@ dependencies = [
  "static_assertions",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const_format"
 version = "0.2.35"
@@ -607,6 +624,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -655,7 +681,7 @@ dependencies = [
  "mio",
  "parking_lot",
  "rustix",
- "signal-hook",
+ "signal-hook 0.3.18",
  "signal-hook-mio",
  "winapi",
 ]
@@ -679,6 +705,15 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "csscolorparser"
 version = "0.6.2"
@@ -686,7 +721,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eb2a7d3066da2de787b7f032c736763eb7ae5d355f81a68bab2675a96008b0bf"
 dependencies = [
  "lab",
- "phf",
+ "phf 0.11.3",
 ]
 
 [[package]]
@@ -716,20 +751,14 @@ dependencies = [
 
 [[package]]
 name = "ctor"
-version = "0.6.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "424e0138278faeb2b401f174ad17e715c829512d74f3d1e81eb43365c2e0590e"
+checksum = "3429e8f8e3ce0ffe475c411850f70468c70d7a87d2ac3d15dd44703fb885aede"
 dependencies = [
- "ctor-proc-macro",
- "dtor",
+ "link-section",
+ "linktime-proc-macro",
 ]
 
-[[package]]
-name = "ctor-proc-macro"
-version = "0.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1"
-
 [[package]]
 name = "ctrlc"
 version = "3.5.2"
@@ -917,8 +946,19 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.0",
+ "const-oid",
+ "crypto-common 0.2.1",
 ]
 
 [[package]]
@@ -969,21 +1009,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
-[[package]]
-name = "dtor"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "404d02eeb088a82cfd873006cb713fe411306c7d182c344905e101fb1167d301"
-dependencies = [
- "dtor-proc-macro",
-]
-
-[[package]]
-name = "dtor-proc-macro"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
-
 [[package]]
 name = "either"
 version = "1.15.0"
@@ -1201,7 +1226,7 @@ dependencies = [
  "nix 0.31.2",
  "ouroboros",
  "rustc-hash",
- "sha2",
+ "sha2 0.11.0",
  "subprocess_test",
  "tar",
  "tempfile",
@@ -1212,7 +1237,7 @@ dependencies = [
  "which",
  "winapi",
  "wincode",
- "winsafe 0.0.24",
+ "winsafe 0.0.27",
 ]
 
 [[package]]
@@ -1264,7 +1289,7 @@ dependencies = [
  "widestring",
  "winapi",
  "wincode",
- "winsafe 0.0.24",
+ "winsafe 0.0.27",
 ]
 
 [[package]]
@@ -1319,7 +1344,7 @@ dependencies = [
  "fspy_shared",
  "memmap2",
  "nix 0.31.2",
- "phf",
+ "phf 0.13.1",
  "stackalloc",
  "wincode",
 ]
@@ -1502,11 +1527,11 @@ dependencies = [
 
 [[package]]
 name = "hashlink"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+checksum = "ea0b22561a9c04a7cb1a302c013e0259cd3b4bb619f145b32f72b8b4bcbed230"
 dependencies = [
- "hashbrown 0.15.5",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -1533,6 +1558,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "id-arena"
 version = "2.3.0"
@@ -1664,11 +1698,11 @@ dependencies = [
 
 [[package]]
 name = "jsonc-parser"
-version = "0.29.0"
+version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9eb0774546269185d38da823d8583e94448ba0e158e3f50759d9c79aba946ca5"
+checksum = "8c2e5dea04f54739ca5694ee06e4448ffda065a55b3427d2b131bd5ea697ea2c"
 dependencies = [
- "serde_json",
+ "serde",
 ]
 
 [[package]]
@@ -1749,9 +1783,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.35.0"
+version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
+checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1779,6 +1813,18 @@ dependencies = [
  "bitflags 2.10.0",
 ]
 
+[[package]]
+name = "link-section"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea2c24837c4fd5ab6a31d64133eae954f5199247523cf29586117e85245c0dd3"
+
+[[package]]
+name = "linktime-proc-macro"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a44cd706ff0d503ee32b2071166510ca27e281228de10cd3aa8d35ff94560f81"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -2406,7 +2452,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
 dependencies = [
  "pest",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -2428,8 +2474,19 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
 dependencies = [
- "phf_macros",
- "phf_shared",
+ "phf_macros 0.11.3",
+ "phf_shared 0.11.3",
+]
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros 0.13.1",
+ "phf_shared 0.13.1",
+ "serde",
 ]
 
 [[package]]
@@ -2438,8 +2495,8 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
 ]
 
 [[package]]
@@ -2448,18 +2505,41 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
- "phf_shared",
+ "phf_shared 0.11.3",
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared 0.13.1",
+]
+
 [[package]]
 name = "phf_macros"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -2474,6 +2554,15 @@ dependencies = [
  "siphasher",
 ]
 
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -2611,7 +2700,7 @@ dependencies = [
  "nix 0.31.2",
  "ntest",
  "portable-pty",
- "signal-hook",
+ "signal-hook 0.4.4",
  "subprocess_test",
  "terminal_size",
  "vt100",
@@ -2892,11 +2981,21 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
 
+[[package]]
+name = "rsqlite-vfs"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8a1f2315036ef6b1fbacd1972e8ee7688030b0a2121edfc2a6550febd41574d"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "rusqlite"
-version = "0.37.0"
+version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
+checksum = "a0d2b0146dd9661bf67bb107c0bb2a55064d556eeb3fc314151b957f313bcd4e"
 dependencies = [
  "bitflags 2.10.0",
  "fallible-iterator",
@@ -2904,6 +3003,7 @@ dependencies = [
  "hashlink",
  "libsqlite3-sys",
  "smallvec 1.15.1",
+ "sqlite-wasm-rs",
 ]
 
 [[package]]
@@ -3089,8 +3189,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -3154,6 +3265,16 @@ dependencies = [
  "signal-hook-registry",
 ]
 
+[[package]]
+name = "signal-hook"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a0c28ca5908dbdbcd52e6fdaa00358ab88637f8ab33e1f188dd510eb44b53d"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
 [[package]]
 name = "signal-hook-mio"
 version = "0.2.5"
@@ -3162,7 +3283,7 @@ checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
 dependencies = [
  "libc",
  "mio",
- "signal-hook",
+ "signal-hook 0.3.18",
 ]
 
 [[package]]
@@ -3230,6 +3351,18 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b2c760607300407ddeaee518acf28c795661b7108c75421303dbefb237d3a36"
+dependencies = [
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "stackalloc"
 version = "1.2.1"
@@ -3328,9 +3461,9 @@ dependencies = [
 
 [[package]]
 name = "syscalls"
-version = "0.6.18"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43d0e35dc7d73976a53c7e6d7d177ef804a0c0ee774ec77bcc520c2216fd7cbe"
+checksum = "81c645a4de0d803ced6ef0388a2646aa1ef8467173b5d59a2c33c88de4ab76e7"
 
 [[package]]
 name = "tar"
@@ -3383,7 +3516,7 @@ checksum = "d4ea810f0692f9f51b382fff5893887bb4580f5fa246fde546e0b13e7fcee662"
 dependencies = [
  "fnv",
  "nom",
- "phf",
+ "phf 0.11.3",
  "phf_codegen",
 ]
 
@@ -3420,9 +3553,9 @@ dependencies = [
  "ordered-float",
  "pest",
  "pest_derive",
- "phf",
- "sha2",
- "signal-hook",
+ "phf 0.11.3",
+ "sha2 0.10.9",
+ "signal-hook 0.3.18",
  "siphasher",
  "terminfo",
  "termios",
@@ -3749,9 +3882,9 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
 [[package]]
 name = "ucd-trie"
@@ -4043,7 +4176,7 @@ dependencies = [
  "rustc-hash",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.11.0",
  "shell-escape",
  "snapshot_test",
  "supports-color 3.0.2",
@@ -4291,7 +4424,7 @@ checksum = "692daff6d93d94e29e4114544ef6d5c942a7ed998b37abdc19b17136ea428eb7"
 dependencies = [
  "getrandom 0.3.4",
  "mac_address",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 1.0.69",
  "uuid",
 ]
@@ -4586,9 +4719,9 @@ checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
 
 [[package]]
 name = "winsafe"
-version = "0.0.24"
+version = "0.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4271ae8f63c109d73bc6fcf352b117166757fabcce6a769649ef18303dbf2491"
+checksum = "bcfff8264c3af1b0352006934e2265365ecb5a145aee88e770dc8b82e0456f4f"
 
 [[package]]
 name = "wit-bindgen"
diff --git a/Cargo.toml b/Cargo.toml
index 78766b52c..c359e6a89 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,7 +39,7 @@ multiple_crate_versions = "allow"
 future_not_send = "allow"
 
 [workspace.dependencies]
-allocator-api2 = { version = "0.4.0", default-features = false, features = ["alloc", "std"] }
+allocator-api2 = { version = "0.2.21", default-features = false, features = ["alloc", "std"] }
 anyhow = "1.0.98"
 assert2 = "0.4.0"
 assertables = "9.8.1"
diff --git a/crates/fspy_preload_unix/src/client/mod.rs b/crates/fspy_preload_unix/src/client/mod.rs
index b9e3eeb10..aad7b46be 100644
--- a/crates/fspy_preload_unix/src/client/mod.rs
+++ b/crates/fspy_preload_unix/src/client/mod.rs
@@ -137,7 +137,7 @@ pub unsafe fn handle_open(path: impl ToAbsolutePath, mode: impl ToAccessMode) {
 }
 
 #[cfg(not(test))]
-#[ctor::ctor]
+#[ctor::ctor(unsafe)]
 fn init_client() {
     CLIENT.set(Client::from_env()).unwrap();
 }
diff --git a/crates/subprocess_test/src/lib.rs b/crates/subprocess_test/src/lib.rs
index 50fa7c83a..f9f81b970 100644
--- a/crates/subprocess_test/src/lib.rs
+++ b/crates/subprocess_test/src/lib.rs
@@ -63,7 +63,7 @@ macro_rules! command_for_fn {
         assert_arg_type(&$arg, $f);
 
         // Register an initializer that runs the provided function when the process is started
-        #[::ctor::ctor]
+        #[::ctor::ctor(unsafe)]
         unsafe fn init() {
             $crate::init_impl(ID, $f);
         }
diff --git a/crates/vite_path/src/absolute/mod.rs b/crates/vite_path/src/absolute/mod.rs
index a7b2476ea..4ecc4f44d 100644
--- a/crates/vite_path/src/absolute/mod.rs
+++ b/crates/vite_path/src/absolute/mod.rs
@@ -402,17 +402,17 @@ mod tests {
     fn strip_prefix_invalid_relative() {
         use std::{ffi::OsStr, os::unix::ffi::OsStrExt};
 
-        use assert2::let_assert;
+        use assert2::assert;
 
         let mut abs_path = b"/home/".to_vec();
         abs_path.push(0xC0);
         let abs_path = AbsolutePath::new(Path::new(OsStr::from_bytes(&abs_path))).unwrap();
 
         let prefix = AbsolutePath::new(Path::new("/home")).unwrap();
-        let_assert!(Err(err) = abs_path.strip_prefix(prefix));
+        assert!(let Err(err) = abs_path.strip_prefix(prefix));
 
         assert_eq!(err.stripped_path.as_os_str().as_bytes(), &[0xC0]);
-        let_assert!(InvalidPathDataError::NonUtf8 = err.invalid_path_data_error);
+        assert!(let InvalidPathDataError::NonUtf8 = err.invalid_path_data_error);
     }
 
     #[test]
diff --git a/crates/vite_path/src/relative.rs b/crates/vite_path/src/relative.rs
index 82c040fac..f1eb9f0fc 100644
--- a/crates/vite_path/src/relative.rs
+++ b/crates/vite_path/src/relative.rs
@@ -338,14 +338,14 @@ mod tests {
     #[cfg(windows)]
     use std::os::windows::ffi::OsStringExt as _;
 
-    use assert2::let_assert;
+    use assert2::assert;
 
     use super::*;
 
     #[test]
     fn non_relative() {
-        let_assert!(
-            Err(FromPathError::NonRelative) =
+        assert!(
+            let Err(FromPathError::NonRelative) =
                 RelativePathBuf::new(if cfg!(windows) { "C:\\Users" } else { "/home" })
         );
     }
@@ -356,8 +356,8 @@ mod tests {
         use std::{ffi::OsStr, os::unix::ffi::OsStrExt as _};
 
         let non_utf8_os_str = OsStr::from_bytes(&[0xC0]);
-        let_assert!(
-            Err(FromPathError::InvalidPathData(InvalidPathDataError::NonUtf8)) =
+        assert!(
+            let Err(FromPathError::InvalidPathData(InvalidPathDataError::NonUtf8)) =
                 RelativePathBuf::new(non_utf8_os_str),
         );
     }
@@ -368,8 +368,8 @@ mod tests {
         use std::ffi::OsString;
         // ill-formed UTF-16: X<high surrogate>Y
         let non_utf8_path = OsString::from_wide(&[0x0058, 0xD800, 0x0059]);
-        let_assert!(
-            Err(FromPathError::InvalidPathData(InvalidPathDataError::NonUtf8)) =
+        assert!(
+            let Err(FromPathError::InvalidPathData(InvalidPathDataError::NonUtf8)) =
                 RelativePathBuf::new(non_utf8_path),
         );
     }
@@ -377,8 +377,8 @@ mod tests {
     #[cfg(unix)]
     #[test]
     fn backslash_in_component() {
-        let_assert!(
-            Err(FromPathError::InvalidPathData(InvalidPathDataError::BackslashInComponent)) =
+        assert!(
+            let Err(FromPathError::InvalidPathData(InvalidPathDataError::BackslashInComponent)) =
                 RelativePathBuf::new("foo\\bar")
         );
     }
@@ -386,7 +386,7 @@ mod tests {
     #[cfg(windows)]
     #[test]
     fn backslash_in_component() {
-        let_assert!(Ok(path) = RelativePathBuf::new("foo\\bar"));
+        assert!(let Ok(path) = RelativePathBuf::new("foo\\bar"));
         assert_eq!(path.as_str(), "foo/bar");
     }
 
@@ -453,7 +453,7 @@ mod tests {
     #[test]
     fn clean_malformed_drive_path() {
         let rel_path = RelativePathBuf::new(r"foo\C:\bar").unwrap();
-        let_assert!(Err(FromPathError::NonRelative) = rel_path.clean());
+        assert!(let Err(FromPathError::NonRelative) = rel_path.clean());
     }
 
     #[test]
diff --git a/crates/vite_task_bin/src/lib.rs b/crates/vite_task_bin/src/lib.rs
index 32dc72f3d..87a402a2a 100644
--- a/crates/vite_task_bin/src/lib.rs
+++ b/crates/vite_task_bin/src/lib.rs
@@ -127,12 +127,12 @@ impl vite_task::loader::UserConfigLoader for JsonUserConfigLoader {
             }
             Err(err) => return Err(err.into()),
         };
-        let json_value = jsonc_parser::parse_to_serde_value(
+        let json_value: Option<serde_json::Value> = jsonc_parser::parse_to_serde_value(
             &config_content,
             &jsonc_parser::ParseOptions::default(),
-        )?
-        .unwrap_or_default();
-        let user_config: vite_task::config::UserRunConfig = serde_json::from_value(json_value)?;
+        )?;
+        let user_config: vite_task::config::UserRunConfig =
+            serde_json::from_value(json_value.unwrap_or_default())?;
         Ok(Some(user_config))
     }
 }
diff --git a/crates/vite_task_plan/src/envs.rs b/crates/vite_task_plan/src/envs.rs
index 4ea4fbf4a..ab6c39efd 100644
--- a/crates/vite_task_plan/src/envs.rs
+++ b/crates/vite_task_plan/src/envs.rs
@@ -1,4 +1,4 @@
-use std::{collections::BTreeMap, ffi::OsStr, mem::MaybeUninit, sync::Arc};
+use std::{collections::BTreeMap, ffi::OsStr, fmt::Write as _, mem::MaybeUninit, sync::Arc};
 
 use rustc_hash::FxHashMap;
 use serde::{Deserialize, Serialize};
@@ -140,11 +140,17 @@ impl EnvFingerprints {
                 let value: Arc<str> = if sensitive_patterns.is_match(name) {
                     let mut hasher = Sha256::new();
                     hasher.update(value.as_bytes());
+                    let digest = hasher.finalize();
                     #[expect(
-                        clippy::disallowed_macros,
+                        clippy::disallowed_types,
                         reason = "result is converted to Arc<str>, not Str"
                     )]
-                    format!("sha256:{:x}", hasher.finalize()).into()
+                    let mut hex = std::string::String::with_capacity(7 + digest.len() * 2);
+                    hex.push_str("sha256:");
+                    for b in digest {
+                        write!(&mut hex, "{b:02x}").unwrap();
+                    }
+                    hex.into()
                 } else {
                     value.into()
                 };