deps(deps): bump glam from 0.33.10 to 0.33.12 in the rust-dependencies group

[dependabot]

Bumps the rust-dependencies group with 1 update: glam.

Updates glam from 0.33.10 to 0.33.12

Changelog

Sourced from glam's changelog.

0.33.12 - 2026-10-01

Added

• (assert) report caller location for glam_assert panics (#884)

Fixed

• (quat,mat) add missing glam_assert and correct panic docs (#882)
• (mat) only return a finite inverse from try_inverse/inverse_or_zero (#880)

Other

• (mat2) speed up NEON Mat2 determinant and inverse (#878)

0.33.11 - 2026-09-27

Added

• (rkyv) add a rkyv-08 feature, which archives each glam type to a dedicated Archived* type at glam::rkyv_08 instead of archiving the native type, so archives are endianness explicit and independent of the SIMD backend glam was built with (#766)
• (rkyv) add bytemuck::Pod and bytemuck::Zeroable impls for the rkyv-08 archived types, so they can still be cast to bytes for a GPU upload or file write without a serializer
• (rkyv) add From conversions between each type and its rkyv-08 archived form
• (rkyv) add Archive::COPY_OPTIMIZATION to the rkyv-08 impls whose archived form is a byte-for-byte copy of the native form, so slices serialize with a single memcpy
• (vec) add lerp_monotonic methods to the float vector types; they interpolate using the monotonic form self + (rhs - self) * s, which preserves equal inputs exactly and is monotonic in s, avoiding the rounding jitter that lerp can introduce between nearly equal values (#823)
• (features) add versioned features for the pre-1.0 dependencies in glam's public API: approx-05, mint-05, rand-010, speedy-08 and zerocopy-08, so each integration can add support for a new dependency version without a breaking change (#857)

Changed

• (floatext) FloatExt::lerp for f32 and f64 now uses the same form as the vector lerp methods, self * (1 - s) + rhs * s

Deprecated

• (rkyv) deprecate the rkyv feature, whose implementation is unsound and will be removed in the next major release; use rkyv-08 instead (#766)
• (features) deprecate the unversioned approx, encase, mint, rand, speedy and zerocopy features; they are aliases for their versioned features and will be removed in the next major release (#857)

Fixed

• (rkyv) only implement NoUndef on the rkyv-08 archived types where they carry no padding, so uninitialised padding is no longer copied into archives
• (rkyv) implement Portable on the rkyv-08 archived types, which have a layout identical on all targets, instead of the native types that depended on the SIMD backend

Commits

• e7d680e Prepare 0.33.12 release (#879)
• 83304df chore(msrv): document policy and tighten MSRV checks (#887)
• 8c887f0 build(deps): update gungraun requirement from 0.19 to 0.20 (#886)
• 2770689 refactor(euler): inline Mat4/Quat euler extraction (#885)
• 273140f feat(assert): report caller location for glam_assert panics (#884)
• 5f53d8f chore(bench): add Mat3/Mat3A transform gungraun benches (#883)
• 116925d fix(quat,mat): add missing glam_assert and correct panic docs (#882)
• aa08b71 test: cover glam_assert panics across vec, mat, quat and affine APIs (#881)
• 62800d8 fix(mat): only return a finite inverse from try_inverse/inverse_or_zero (#880)
• d49f4f5 perf(mat2): speed up NEON Mat2 determinant and inverse (#878)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[FunKite]

Reviewed PR #184's complete dependency diff and all discussion/review threads. GitHub confirms the established dependabot[bot] identity (account ID 49699333) and a valid GitHub-signed original commit. No substantive review findings are currently present.

Added the required Unreleased changelog entry in commit 06a64301d4dcb20b81884a7f2885fb15eda13a27. The final diff is limited to the glam 0.33.10 → 0.33.12 lockfile version/checksum and that changelog entry.

Validation passed in an isolated Cargo cache: the safe default suite (149 tests + 22 doctests) and gis_geojson suite (152 tests + 22 doctests), with the helper's documented slow ESDF test excluded locally and covered by full CI. The glam crate archive matches the lockfile checksum; upstream MSRV remains 1.68.2, within this project's 1.90 minimum. No upstream glam/rkyv integration is enabled here. The local cargo-deny parser cannot read CVSS 4.0 metadata, so the helper used its documented fallback; fresh GitHub Cargo Deny and Rust Security Audit checks passed on both the final head and merged main.

All 26 checks passed on final head 06a64301d4dcb20b81884a7f2885fb15eda13a27, including all 14 required checks. GitHub accepted the formal approval, and a normal squash merge completed at 2026-10-08 15:11:13 UTC as e4eb4f5447d0626f8a54ffdf2b17fd8262c8c315. No protection bypass was used.

Post-merge validation is complete: all 25 checks on the exact main commit passed. Rust CI, Security, Book Quality, and CodeQL all reached terminal success; the last workflow finished at 15:18:44 UTC. Main's code-scanning query returned no open alerts. No remaining review or CI blocker.

[FunKite]

Reviewed the complete final diff, all PR discussions/reviews, and automated security findings on 06a6430. Established Dependabot identity and original GitHub signature verified. No substantive issues remain. The required Unreleased changelog entry is included.

Local default tests (149 + 22 doctests) and the glam-enabling gis_geojson suite (152 + 22 doctests) pass; the documented slow ESDF test was excluded locally and covered by full CI. The crate archive checksum, unchanged feature selection, and compatible upstream MSRV were verified. The local cargo-deny CVSS parser limitation was handled by the safe helper's documented fallback; fresh GitHub Cargo Deny advisories/bans/licenses/sources and Rust Security Audit passed.

All 26 checks on this exact final head passed, including all 14 required checks, the complete platform/toolchain matrix, GPU checks, Book Quality, and CodeQL. PR-specific code-scanning alert query returned no open alerts. Approved for normal squash merge under the existing branch rules.