chore(deps): bump rio-vt from 0.5.19 to 0.5.25

[dependabot]

Bumps rio-vt from 0.5.19 to 0.5.25.

Release notes

Sourced from rio-vt's releases.

v0.5.25

Full Changelog: https://rioterm.com/changelog

v0.5.24

Full Changelog: https://rioterm.com/changelog

v0.5.23

No release notes provided.

v0.5.22

No release notes provided.

v0.5.21

No release notes provided.

v0.5.20

Full Changelog: https://rioterm.com/changelog

Commits

• 24d4a98 prepare 0.5.25
• 549b6b2 hints: Show the hovered link target in a bottom-left pill (#1874)
• 926a398 close the right tab when a background pty exits, and only that tab
• 8cd6d36 macos: weak-link coregraphics so hdr colorspace imports don't abort launch on...
• 4242d04 fix fmt
• 8784acc librio: report mouse button and motion to the pty
• a0fb6da trail: converge thin shapes onto drawn cursor geometry, clamp vi row
• 5432ea8 Rework cursor trail: exact easing, visibility fade, config surface (#1871)
• 7f1178b request a frame after opening a latched hint
• 916ef7f record damage when a latched hint clears its highlight
• Additional commits viewable in compare view

[github-actions]

Thanks @dependabot[bot] for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

[Hmbown]

@dependabot rebase

[claude]

Claude finished @Hmbown's task in 59s —— View job

---

Review: bump rio-vt 0.5.19 → 0.5.25

• Gather context (dependabot PR, Cargo.lock only)
• Inspect diff (git diff origin/main...HEAD)
• Check for rio-vt/rio usage in the workspace that could be affected
• Post review findings

Scope: Cargo.lock only (+51/-103). crates/tui/Cargo.toml:123 pins rio-vt = "0.5.1" (a caret range), so no manifest change was needed — 0.5.25 resolves within the existing constraint. No source files changed.

What the lockfile diff actually contains:

• rio-vt 0.5.19 → 0.5.25, pulling in rio-grapheme-width/rio-graphics 0.5.19 → 0.5.26 and a new transitive dep rio-unicode 0.5.26.
• Unrelated-looking but expected cargo update fallout: duplicate cfg-if 0.1.10 entry removed (unified on cfg-if 1.0.4), duplicate windows 0.42.0/0.62.2 entries collapsed to a single windows, and corcovado 0.5.19 → 0.5.26 (dropping now-unused deps: fuchsia-zircon, fuchsia-zircon-sys, iovec, slab, socket2). These are transitive resolution side effects of the bump, not manual edits — consistent with a straight cargo update -p rio-vt.

Assessment against the review checklist:

1. Correctness — N/A, no source changes.
2. Provider/model/route safety (EPIC v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608) — N/A, unrelated to model/provider routing.
3. Reuse/simplification — the diff net-reduces duplicate dependency versions (cfg-if, windows), which is a genuine improvement, not scope creep.
4. Tests — none needed for a lockfile-only bump.
5. Security — no secret handling, exec, or input-validation surface touched. Checksums are present for all new/changed entries (standard cargo registry provenance).

Not verified: I could not run cargo check/cargo build in this sandbox (command required interactive approval that isn't available here), so I did not independently confirm the new dependency tree compiles. If you want that confirmed before merge, CI's own build step is the authoritative check — recommend just watching that. If you'd like me to attempt the build with expanded tool permissions, let me know.

No blocking issues found. This looks safe to merge pending green CI.

[claude]

Claude finished @Hmbown's task in 42s —— View job

---

Review: bump rio-vt 0.5.19 → 0.5.25

• Gather context (dependabot PR, re-check diff after rebase)
• Inspect diff (git diff origin/main...HEAD)
• Check for rio-vt/rio usage in the workspace that could be affected
• Post review findings

Scope: Cargo.lock only (+51/-103), unchanged in substance from the prior review — this update just carries the branch through a rebase onto current main. crates/tui/Cargo.toml:123 pins rio-vt = "0.5.1" (caret range), so no manifest edit is needed; 0.5.25 resolves within the existing constraint. No source files changed.

Lockfile diff contents:

• rio-vt 0.5.19 → 0.5.25, with rio-grapheme-width/rio-graphics 0.5.19 → 0.5.26 and a new transitive rio-unicode 0.5.26. rio-vt's own deps also swap unicode-width-16 for web-time (used by rio-graphics/rio-vt internally) — this is upstream's dependency choice, not something the PR touches directly.
• Expected cargo update fallout: duplicate cfg-if 0.1.10 removed (unified on cfg-if 1.0.4), duplicate windows 0.42.0/0.62.2 collapsed to one windows, and corcovado 0.5.19 → 0.5.26 (dropping unused fuchsia-zircon, fuchsia-zircon-sys, iovec, slab, socket2).

1. Correctness: N/A — no source changes. The one consumer of rio_vt in-tree, crates/tui/tests/support/qa_harness/frame.rs, imports rio_vt::{ansi, config::colors, crosswords::*, event, performer::handler} — none of these module paths are renamed/removed per the upstream commit list (hints pill, tab-close fix, cursor-trail rework, mouse-report additions). No API break expected, but see note below on verification.

2. Provider/model/route safety (EPIC #2608): N/A — unrelated to model/provider routing.

3. Reuse/simplification: Net positive — the diff removes duplicate dependency versions (cfg-if, windows) and unused transitive deps from corcovado.

4. Tests: None needed for a lockfile-only bump; existing qa_harness coverage exercises the rio_vt surface already.

5. Security: No secret handling, exec, or input-validation surface touched. All new/changed lockfile entries carry checksums (standard registry provenance).

Not verified: cargo check/cargo build require approval this sandbox doesn't grant (same limitation as the prior pass on this PR), so the new dependency tree's compilation isn't independently confirmed here. CI's build step is the authoritative check — recommend watching that before merge.

No blocking issues. Safe to merge pending green CI.

[dependabot]

A newer version of rio-vt exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.