chore(deps): bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: github.com/microsoft/vcpkg, fmt and tbb.

Updates github.com/microsoft/vcpkg from master to 2026.07.29

Release notes

Sourced from github.com/microsoft/vcpkg's releases.

2026-07-29 Release

Total port count: 2858

Total port count per triplet (tested): https://dev.azure.com/vcpkg/public/_build/results?buildId=135143&view=results

triplet	ports available
x86-windows	2648
x64-windows	2779
x64-windows-release	2779
x64-windows-static	2658
x64-windows-static-md	2717
arm64-windows	2455
arm64-windows-static-md	2439
arm64-osx	2597
x64-linux	2800
arm-neon-android	2229
x64-android	2291
arm64-android	2257
arm64-linux	2301

The following vcpkg-tool releases have occurred since the last registry release:

• https://github.com/microsoft/vcpkg-tool/releases/tag/2026-07-13
• https://github.com/microsoft/vcpkg-tool/releases/tag/2026-07-24
• https://github.com/microsoft/vcpkg-tool/releases/tag/2026-07-27

In those tool releases, the following changes are particularly meaningful:

• SBOM features and bugfixes:
  • Emit a PURL in generated SPDX SBOMs by @​JamieMagee in microsoft/vcpkg-tool#2049
  • Use canonical vcpkg PURLs in dependency snapshots by @​JamieMagee in microsoft/vcpkg-tool#2072
  • Fix dependency snapshot relationships and correlators by @​JamieMagee in microsoft/vcpkg-tool#2073
  • Add Git tree gitoids to SPDX SBOMs by @​JamieMagee in microsoft/vcpkg-tool#2074
  • Fix unreplaced CMake variables in SBOMs. by @​BillyONeal in microsoft/vcpkg-tool#2075
• z-applocal bugfixes:
  • Fix Qt plugins deployment with z-applocal by @​vicroms in microsoft/vcpkg-tool#2048
  • Fix CopyOptions::update_existing creating a 0 byte file when the destination is nonexistent. by @​BillyONeal in microsoft/vcpkg-tool#2068
• Add "min-version" to vcpkg-tools.json. by @​BillyONeal in microsoft/vcpkg-tool#2067
• Fix collide on shared .partial extraction directory on POSIX by @​Erik-White in microsoft/vcpkg-tool#2036
• [curl] Add VCPKG_SSL_REVOKE_BEST_EFFORT to fix Schannel proxy revocation errors by @​sdn9002 in microsoft/vcpkg-tool#2043
• Support CURL_CA_BUNDLE like the curl command line tool by @​Matus-p in microsoft/vcpkg-tool#2042
• Add vcpkg print-usage + hueristic affirmation by @​BillyONeal in microsoft/vcpkg-tool#2045
• Do not abort when stdout is a broken pipe by @​ricardoofnl in microsoft/vcpkg-tool#2059

Thank you again @​JamieMagee @​Erik-White @​sdn9002 @​Matus-p and @​ricardoofnl

port	version
box3d	0.1.0
cofetch	0.1.2

... (truncated)

Commits

• 9e593bb Release vcpkg-tool 2026-07-27. (#53109)
• 827a2e1 [simd] Avoid build race. (#53108)
• e4300a9 [skills] Pass header files to vcpkg_install_copyright when no separate lice...
• fd3dde7 [iceoryx] Update to 2.0.8 (#52806)
• 3ad1f44 [qca] Update to 2.3.10 (#52994)
• 21576b4 [sfparse] New port [nghttp3] Update to 1.18.0 [vcpkg-ci-sfparse] New ci port ...
• 9d7f79f Use distinct links for telemetry docs and privacy statement (#53101)
• 9885cff Use forwarding link to privacy notice in bootstrap (#53098)
• 0382773 [c4core] Update to 0.6.0 (#53095)
• 5aa5c40 [aws-crt-cpp] Update to 0.43.0 (#53094)
• Additional commits viewable in compare view

Updates fmt from 12.2.0 to 12.2.0#1

Commits

• See full diff in compare view

Updates tbb from 2023.0.0 to 2023.1.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated the project’s build tooling and package baseline to newer approved versions.
  • Refreshed platform verification data for Windows systems.

[acgetchell]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a9a308df-ac81-4e97-bf4f-21e31e847b68

📥 Commits

Reviewing files that changed from the base of the PR and between 99630f1 and 0225dbc.

📒 Files selected for processing (2)

• scripts/bootstrap_vcpkg.py
• vcpkg.json

---

Walkthrough

The PR updates the pinned vcpkg release and trusted Windows digests. It also updates the vcpkg builtin baseline hash.

Changes

vcpkg toolchain update

Layer / File(s)	Summary
Update vcpkg release and baseline scripts/bootstrap_vcpkg.py, vcpkg.json	The bootstrap script now targets vcpkg 2026-07-27 with updated Windows SHA-256 digests. The manifest now uses the newer builtin baseline hash.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• acgetchell/CDT-plusplus#139: Updates Dependabot configuration for weekly vcpkg updates.

Suggested reviewers: acgetchell

Poem

vcpkg pins move ahead,
Fresh hashes guard the trail,
A newer baseline leads,
Toolchain updates sail.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies a dependency-group update with three changes, matching the pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/vcpkg/dependencies-5e1f103695

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[acgetchell]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.