chore(deps): bump noyalib from 0.0.15 to 0.0.17

[dependabot]

Bumps noyalib from 0.0.15 to 0.0.17.

Release notes

Sourced from noyalib's releases.

noyalib v0.0.17

What's Changed

• release: v0.0.17 — lockstep republish (no core change) (#212) (c98a945)

Checksums

179fb3ecf8e64246b67049033e61c739c467c7bb1d79b2c1a65c1ac13f87512a  noyalib-0.0.17.crate

noyalib v0.0.16

What's Changed

• release: v0.0.16 — build fix, MSRV 1.86, dependency refresh (#209) (00ee7b9)
• test(ci): run every example + smoke-run every bench; fix 3 budget-broken benches (#192) (346a9b0)
• docs: correct accuracy and consistency across README, rustdoc, examples, benches, and doc/ (#191) (1954ffc)

Checksums

c11d7b3d5d0b3d22eecbf678f9830b25444e90e773510ac3092d406082164d69  noyalib-0.0.16.crate

Changelog

Sourced from noyalib's changelog.

[v0.0.17] - 2026-07-25

A lockstep-only cut. The core crate has no code or behaviour change since v0.0.16 — main was byte-identical to the v0.0.16 tag. It is republished at 0.0.17 solely so the satellite crates, which carry real fixes, can pin =0.0.17 under the ADR-0005 strict-lockstep contract.

Satellite fixes shipping in this lockstep

• noyalib-lsp — textDocument/formatting is no longer a silent no-op. It used a byte-faithful CST round-trip and always returned an empty edit list; it now calls cst::format. (The v0.0.16 changelog claimed this was fixed; it was not — this is the actual fix.)
• noyalib-lsp / noya-cli — crossbeam-epoch bumped to 0.9.20 (RUSTSEC-2026-0204, invalid-pointer-dereference), which was present in their v0.0.16 lockfiles via a transitive dependency.

Repository hardening (all crates, CI/docs only)

• Coverage, MSRV, CodeQL, and OpenSSF Scorecard gates brought to parity across the four satellites; noyalib-wasm gained a CI wasm-test job (wasm-pack test --node) gating its wasm-bindgen surface.
• Upstream cargo-vet audit imports added to the satellites; branch- protection tightened so commit signing is unskippable.

[v0.0.16] - 2026-07-22

A build-fix + dependency-refresh cut. main was left unbuildable under --all-targets by a feature-gated import, and the dependency set had drifted. No public API change (cargo-semver-checks green); two deserialiser error-message strings change wording — see Fixed.

Full narrative: https://github.com/sebastienrousseau/noyalib/blob/main/RELEASE-NOTES-v0.0.16.md.

Lockstep versioning: noyalib bumps 0.0.15 → 0.0.16. Satellites publish =0.0.16 from their own repos:

• sebastienrousseau/noyalib-wasm@0.0.16
• sebastienrousseau/noyalib-mcp@0.0.16
• sebastienrousseau/noyalib-lsp@0.0.16
• sebastienrousseau/noya-cli@0.0.16

Satellite note — noyalib-lsp carries a user-facing fix in this cut. textDocument/formatting was a silent no-op: the server derived its output from a byte-faithful CST round-trip, so it always returned an empty TextEdit[] and no editor ever saw a formatting change. Fixed by calling cst::format. See that repo's CHANGELOG.md. Nothing in the core crate changed as a result — the bug was in the LSP wrapper.

Fixed

... (truncated)

Commits

• c98a945 release: v0.0.17 — lockstep republish (no core change) (#212)
• 00ee7b9 release: v0.0.16 — build fix, MSRV 1.86, dependency refresh (#209)
• 346a9b0 test(ci): run every example + smoke-run every bench; fix 3 budget-broken benc...
• 1954ffc docs: correct accuracy and consistency across README, rustdoc, examples, benc...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)