[dependabot]

Bumps the cargo group with 3 updates in the / directory: ort, sha2 and zip.

Updates ort from 2.0.0-rc.14 to 2.0.0-rc.15

Release notes

Sourced from ort's releases.

v2.0.0-rc.15

2.0.0-rc.15

💖 If you find ort useful, please consider supporting us on Open Collective 💖

🤔 Need help upgrading? Ask questions in GitHub Discussions or in the pyke.io Discord server!

✨ Supporters get priority (<24h) issue resolution & support!

---

rc.15 fixes over 30 instances of undefined behavior and adds no new features. It is highly recommended to upgrade to rc.15 as soon as possible, as multiple memory leaks/memory safety issues were fixed.

Alternative backends will be updated sometime before Oct 23.

• run_async now only accepts owned inputs.
• ExecutionProviderLibrary::unregister has been removed. You can still unregister EP libraries via the unsafe -sys API.
• ValueRefMut no longer implements DerefMut to Value. It has the same methods as &mut Value and can be used in the same places in the ort API. It is recommended to take ValueRefMut anywhere you used to take &mut Value.
• InMemorySession no longer implements DerefMut to Session. It has the same methods as &mut Session.
• Kernel now requires Send; ThreadManager requires Send + Sync.
• SessionBuilder::with_external_initializer_file_in_memory now takes Arc<[u8]> instead of Cow<'static, [u8]>.

---

Commits

• 5c564c5 2.0.0-rc.15
• 5acdda4 fix!: take external initializer file buffers as Arc\<[u8]>
• 24cc24a fix(editor): attribute/initializer UAFs
• 43bac17 fix!: prevent moves out of DerefMut for in-memory sessions/ValueRefMut
• 8993b93 fix: wasm & no_std build
• 262d9aa fix: 2 potential IoBinding UAFs
• 5fe022f fix(sys): make OrtAllocator::default const
• 593d821 fix: tensors can have MemoryInfo but no AllocatorHandle
• a27c6f9 fix(adapter): hold onto the Allocator that created it
• 6fe7776 fix(sys): add missing graph & tensor op attr variants
• Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates zip from 9.0.4 to 9.0.5

Release notes

Sourced from zip's releases.

v9.0.5

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

Changelog

Sourced from zip's changelog.

9.0.5 - 2026-10-17

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

Commits

• 0123ed1 chore: release v9.0.5 (#1093)
• 00cf82b docs: Repeal policy of yanking versions with known vulnerabilities, add menti...
• 52165b9 chore: Enable release-plz on backport branches in future (#1079)
• ca51e64 docs: Remove doc links that break when doc build doesn't enable all features ...
• 6639687 fix: use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• 5e06fa8 fix(write): prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)
• b6f9fb8 Merge commit from fork
• ea2ccfe Merge commit from fork
• 8068ab4 Merge commit from fork
• 0b51128 doc: Clarifications to security policy (#1074)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Low Risk
Dependency-only patch/rc bumps with no code changes; the ort upgrade reduces known memory-safety issues in the inference stack.

Overview
Bumps Rust dependencies with no application source changes—only crates/earshot/Cargo.toml and Cargo.lock.

ort is pinned from 2.0.0-rc.14 to 2.0.0-rc.15 (with matching ort-sys) for ONNX inference in earshot. That release is mainly memory-safety and UB fixes; earshot’s usage (Session, Tensor, ort::inputs!) is unchanged in this PR.

sha2 (0.11.0 → 0.11.1) and zip (9.0.4 → 9.0.5) update only in the lockfile as transitive/patch bumps.

^{Reviewed by Cursor Bugbot for commit b8daa79. Bugbot is set up for automated code reviews on this repo. Configure here.}