chore(deps): bump diesel from 2.3.12 to 2.3.13

[dependabot]

Bumps diesel from 2.3.12 to 2.3.13.

Changelog

Sourced from diesel's changelog.

[2.3.13] 2026-09-4

• Fixed interaction between then_order_by and distinct_on to reject otherwise broken SQL queries
• Fix a clippy::redundant_field_names lint warning generated by #[derive(QueryableByName)]
• MySQL and MariaDB now decode a value according to the signedness the server reports for its column, so a SMALLINT UNSIGNED holding 40000 read as Integer returns 40000 rather than -25536
• Potential stackoverflow on deeply nested JSONB values for the SQLite backend
• Fixed a possible null pointer dereference in the custom SQLite aggregate function support when SQLite fails to allocate the aggregate state
• Fixed undefined behavior in SqliteConnection::serialize_database_to_buffer when SQLite returns a null buffer for an empty deserialized database or an allocation failure. SerializedDatabase::as_slice is deprecated in favor of the new SerializedDatabase::try_as_slice, which reports the allocation failure as an error instead of panicking.
• Fixed SQLite value reads to panic instead of creating invalid slices or returning incorrect data when SQLite allocation fails. Row iteration reports a failed value duplication as an error instead.
• Fixed a use after free where reading a SQLite value in a second representation, for example a blob as text, invalidated slices another SqliteValue of the same field had returned. Such a read now works on a copy of the value.
• Fixed broken prepared statement caching for queries using positional ordering and window functions with frame offset clauses
• Fixed a potential panic while deserializing a PgInterval type from a too short buffer
• Fixed encoding floating point values without a decimal part in a roundtrip safe way in SQLite's jsonb encoding
• Fixed a potential panic while deserializing a PgInterval type from a too short buffer
• Fixed potential code injections in the generated schema.rs file caused by malicious database identifiers

Commits

• 9628f5c Fix encoding negative integers
• 3eb6cf4 Fix old serde
• d2b770f Fix compilation
• 1abf780 Merge branch 'main' into fix/rust_code_injections
• 396ea4a Merge pull request #5195 from LucaCappelletti94/fuzz-sqlite-jsonb-float-writer
• ba02e3a Merge pull request #5196 from weiznich/fix_bigdecimal_cpu_burn
• 86ae22e Merge pull request #5194 from weiznich/fix_panic_in_pg_interval
• b9e01d7 Merge pull request #5193 from weiznich/fix_query_id
• 529f0bd Merge pull request #5183 from LucaCappelletti94/sqlite-serialize-oom-safety
• 8bd540d Merge pull request #5182 from LucaCappelletti94/sqlite-value-oom-safety
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Allure Report Summary

	Name	Duration	Stats	New	Flaky	Retry	Report
	Allure Rust – Pull request #45	26m 48s	238	238	0	0