Update anyhow, memmap2 and quick-xml for security advisories

[LinuxJedi]

Audited the locked tree against the OSV/RustSec advisory database ahead of the
release. Three advisories have fixes available in range; this takes them and
nothing else.

Taken

Crate	Advisory	Issue	Now
anyhow 1.0.102	RUSTSEC-2026-0190	Unsoundness in Error::downcast_mut()	1.0.104
memmap2 0.9.10	RUSTSEC-2026-0186	Unchecked pointer offset	0.9.11
quick-xml 0.39.4	RUSTSEC-2026-0194 / -0195	Quadratic parse, unbounded allocation DoS	0.41.0

anyhow is a direct dependency on every platform. memmap2 arrives through
winit / smithay-client-toolkit / sctk-adwaita on the Linux window path.
quick-xml is build-time only -- the wayland-scanner proc-macro parsing the
protocol XML shipped inside the crate -- so neither DoS is reachable from guest
or user input; taken because it costs nothing. wayland-scanner moves
0.31.10 -> 0.31.11 as the parent permitting that bump.

Deliberately surgical: a bare cargo update moves 97 crates, which is not a
change to make the day before a release. Exactly four move here, with no crates
added or removed.

Not taken, and why

bincode 1.3.3, paste 1.0.15 and ttf-parser 0.25.1 carry unmaintained
notices with no patched version to move to. bincode is the save-state
encoding specifically, so a 1 -> 2 migration would invalidate every existing
state -- not a drive-by change.

wasmtime

27 advisories match wasmtime 27.0.0 in the database and none are reachable in
this configuration. The engine is Cranelift-only (excluding the four Winch
advisories, including the aarch64 sandbox escape), builds without the WASI,
component-model and threads features (excluding eight more), sets
wasm_simd(false) in make_engine (excluding the f64x2.splat Cranelift one),
and uses the default allocator rather than the pooling one.

The advisory that would have mattered -- GHSA-jhxm-h53p-jm7w, aarch64 Cranelift
miscompile enabling sandbox escape -- is introduced in 32.0.0, so 27 predates
it. The RustSec mirror over-reports it with a range starting at zero; the
upstream GHSA has the accurate bounds.

Worth tracking separately (not here): 27.x is an unsupported line that receives
no backports, so the next advisory will not be fixed there either. Moving to the
36.x LTS is a real piece of work rather than a version bump, since the =27.0.0
pin exists for save-state determinism of plugin linear memory.

Verification

cargo-sources.json regenerated from the new lock (the Flatpak workflow fails
on a stale file); the diff touches only those four crates. Both nested workspace
lockfiles still resolve --locked.

Release build clean; fmt clean; clippy --all-targets --all-features --locked -D warnings clean; unit suite 1839 passing; 22 golden renders passing; full
--ignored suite passing (image_regression 8/8, mb_ram 3/3, vamiga_ts
1/1). Re-querying OSV against the updated lock leaves only the three
unmaintained notices above.

[Copilot]

Pull request overview

Updates a small set of Rust dependencies specifically to pick up fixes for reported security advisories, while keeping the dependency tree otherwise stable ahead of a release.

Changes:

• Bump anyhow to 1.0.104 to address RUSTSEC-2026-0190.
• Bump memmap2 to 0.9.11 to address RUSTSEC-2026-0186.
• Bump quick-xml to 0.41.0 (and wayland-scanner to 0.31.11) to address RUSTSEC-2026-0194 / -0195, and keep build-time Wayland XML scanning in sync.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
packaging/flatpak/cargo-sources.json	Regenerates Flatpak vendored crate source entries (URLs, SHA256s, dest paths) to match the updated locked crate versions.
Cargo.lock	Locks updated versions/checksums for anyhow, memmap2, quick-xml, and wayland-scanner in line with the stated advisory-driven bumps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.