chore(deps): monthly dependency round 2026-10

[srperens]

Monthly dependency round, 2026-10. The lockfile moves 250 crates forward, adds 58 and removes 31. No requirements are raised. This replaces #924 (2026-09).

Recreated 2026-10-08 on main@91ecaf3: the earlier head 401c5bf conflicted with main after #1034, #1043 and #1045 changed Cargo.lock/Cargo.toml. Per the round's rules a lockfile is never merged by hand, so cargo update was re-run from scratch.

Rebased 2026-10-09 onto main@2143f0c (no conflicts; same two commits). Check (Linux) on the old head 9cc1a51 failed in stinger_prores_test (3 of 4, e.g. frame -8: old source before the cut). That base was itself red on Linux (gpu_nv12, fixed by #1050), and the stinger tests changed since in #1051 and #1054, so the old run could not separate the lockfile from the base. main@2143f0c is green on Check (Linux). If the new head still fails there, the lockfile is the cause and the crate gets held back.

Updated (notable only: direct dependencies and anything GStreamer):
gstreamer and gstreamer-* 0.25.x -> 0.25.4 (gstreamer-sdp -> 0.25.3), glib 0.22.7 -> 0.22.10, gio 0.22.8 -> 0.22.10, gst-plugin-webrtc / -webrtchttp / -rtp / -audiofx -> 0.15.4, tokio 1.52.3 -> 1.53.2, uuid 1.23.4 -> 1.27.0, serde 1.0.228 -> 1.0.229, serde_json 1.0.150 -> 1.0.151, rustls 0.23.41 -> 0.23.45, wgpu 29.0.3 -> 29.0.4, clap 4.6.1 -> 4.6.7, bytes 1.11.1 -> 1.12.1

Carried over: commit 2 is the maintainer's 401c5bf (authorship kept, applied cleanly), which enables gst-plugin-webrtchttp's rustls-ring feature. Without it 0.15.4 panics in plugin_register_static() with No rustls crypto provider is configured (Check (Linux) on #924). cargo metadata --locked exits 0 with it applied, so the lockfile needs no further change.

Held back: none.

Behind (not taken):

• egui / eframe / egui_extras 0.34 -> 0.36, egui_plot 0.35 -> 0.37, egui-phosphor 0.12 -> 0.14: an egui-family bump that needs reading. https://github.com/emilk/egui/blob/main/CHANGELOG.md
• utoipa 5.5 -> 6.0, utoipa-swagger-ui 9 -> 10: a major bump that would likely change openapi.json. Not attempted.
• sqlx 0.8 -> 0.9, nvml-wrapper 0.12 -> 0.13, tokio-tungstenite 0.29 -> 0.30, base64 0.22 -> 0.23: 0.x minor bumps. Not attempted, because the backend cannot be built here.

Verified (rustup-installed cargo 1.98.1, at head 81013c38): cargo metadata --locked exits 0 after the rebase. At the earlier head 9cc1a512: cargo test in types/ (105 passed; 0 failed), WASM clippy in frontend/ with -D warnings (no warnings), cargo fmt --all -- --check (clean). The rebase changed no Rust source.

Not run locally: backend clippy and tests (strom), and the native frontend tests. This runner has no GStreamer development environment. CI on 81013c38 concluded 2026-10-12: Check (Linux), Build (Linux x86_64), Build (Linux ARM64), Check & Build (WASM), API Contract Check and Static JS Tests pass; Build (macOS) and Build (Windows) were skipped, as on every PR by default (run https://github.com/Eyevinn/strom/actions/runs/37915573688). The stinger failure on the old head did not recur, so the lockfile was not its cause.

🤖 Generated with Claude Code