chore(deps): update vendored c++ deps

[renovate]

This PR contains the following updates:

Package	Update	Change
CedricGuillemet/ImGuizmo	digest	5ab7676 → 18cef5e
ValveSoftware/GameNetworkingSockets	digest	a7f4a60 → e707b3a
assimp/assimp	digest	a8278e3 → 50d7679
google/googletest	digest	1b6f64d → d89aac5
jbeder/yaml-cpp	digest	3eb39d5 → 2f64971
ocornut/imgui	digest	b48d1af → 83f6686
wolfpld/tracy	minor	v0.13.1 → v0.14.0
yhirose/cpp-httplib	minor	v0.52.0 → v0.53.0

---

Release Notes

wolfpld/tracy (wolfpld/tracy)

v0.14.0: Tracy Profiler 0.14

Compare Source

For a more detailed change list, see https://github.com/wolfpld/tracy/blob/v0.14.0/NEWS.

Automated capture

Added two new CLI tools: tracy-capture-daemon and tracy-merge. The daemon automatically discovers Tracy clients over UDP and captures each to its own file. The merge tool combines multi-process traces into one view.

In the current implementation, the merge tool preserves zones, messages, and plots only. GPU zones, memory events, and call stacks are lost.

Sections: mark program execution phases

Use the TracySectionEnter and TracySectionLeave macro pair to mark high-level phases of the application (e.g., game levels). Sections can overlap freely, may be assigned to user-defined categories for filtering, and can be used to set time range limits.

Zone call stack reconstruction

Tracy will now perform heuristic reconstruction of call stacks for zones captured without them (requires sampling to be enabled). Such call stacks are indicated with a magic-wand icon.

This, along with the "parent zones" list, replaces the previous "zone trace" functionality, which was too inconvenient to be useful.

Frame image playback improvements

The playback can now be looped, and the frame range can be limited either by setting the ranges manually or by copying the range from annotations/sections/time ranges.

Timeline UX

The sample markers on the timeline are now color coded. Green markers show that your code was executing. Blue markers indicate that execution was in an external library code. Red markers are for time spent in kernel.

The order of threads can now be sorted in the trace settings window.

In-profiler user manual

The embedded user manual, previously experimental, has received many improvements. The manual sections are now separated, with a tree navigation available. The rendering quality has been vastly improved. The cross-section navigation links are now working as intended.

Data consistency

It's a bit embarrassing, but previously the timing data displayed in the sampling statistics window, in the sample entry stacks window, and in the symbol view window didn't really match, with each window having its own opinion on how the time should be calculated. This has been fixed, and now each window displays matching time data.

The sample entry stacks window now has a control for what should be counted. The modes of operation are: count the symbol if it was executing (on top of stack), which was the only option available previously. The two new options are to count if the symbol was reached somewhere on the stack (i.e., also count if the symbol made a function call), either skipping or including recursion.

Flame graph improvements

The sampling flame graph no longer skips unknown symbols, which are crucial in understanding what the program does. These frames are now aggregated by the executable image name.

It is now possible to group sampling flame graph entries by name instead of the symbol address. A practical example of when this could happen would be inline expansion of the same function at multiple call sites within the enclosing symbol.

The flame graph can now be zoomed and panned with the mouse.

flame3.mp4

Frame statistics

The frame statistics view, previously available in the Trace Info window, has been moved to its own window. There's now a full array of statistical data displayed. The frame range can now be narrowed down not only to the timeline view, but also to a specific time range, matching other places in the profiler where you can limit time range.

Compare traces improvements

The comparison between two traces now has full statistical parity with the Find Zone window (including the newly added coefficient of variation), in both the Zone and Frames comparison modes. The more/less markers are now color-coded to indicate the amount of change, with greater disparity making the color of the text more saturated to show importance.

It is now possible to limit time ranges in the two compared traces using either the newly added sections feature, or manually created annotations.

Call stack window improvements

The external frames are now hidden by default (except in the wait stacks) and are dimmed when they are turned on. The originating thread is now displayed in the window. Optional LLM description of the call stack can be generated either manually or automatically.

Call stacks are now also displayed in various tooltips.

Settings sidecar overhaul

Handling of trace-specific settings was reworked. Now, everything is stored in a single file. By default, this file is still stored deep in the profiler configuration directory, but the configuration sidecar can now be made public in the Trace Information window.

This will move the settings file to the directory where the trace is stored. Both files can then be easily copied to another machine.

Bonus feature: it is now possible to generate a random trace name.

Symbol view improvements

The child call list can now be resized.

symbolchildren.mp4

The child-call time percentage is now shown as a percentage of calls (as it was before), and also as a percentage of total symbol time.

Display of the HW sample statistics is now disabled by default.

Message window improvements

Added support for setting message's source and severity with the TracyLogString macro.

Multi-line messages are now properly trimmed to a single line on the list, with full message content available in the tooltip.

Added context menu for each message, with an option to copy to clipboard.

Visible threads list UX

The list of visible threads in various windows is now a scrollable multi-column view.

Annotations improvements

Improved the way annotations are rendered on the timeline. Annotations can be hidden.

Newly created annotations are assigned a randomly generated nonsense name.

Tracy Assist

The LLM assistant integration has been vastly improved, bringing support for modern llama.cpp model integration and protocol. This rework makes small (4B) models usable for simple tasks; the time on the screenshot below is for pure on-CPU calculation.

Tracy exposes data it captured to the LLM, which allows it to perform analysis of the code. Here we have a crash call stack that was intercepted by Tracy:

This call stack can be attached to the chat with the assistant by clicking on the robot icon. Better yet, open the context menu of that icon and choose one of the preset queries. Tracy will even suggest the next question you may want to ask! The screenshot below shows a 31B model that you can fit on a mid-high-tier gaming GPU.

With the amount of data exposed by Tracy, you can even ask "How can I optimize my program?" and get an answer like on the screenshot below. This reply was generated in 2 min 44 s with a model that you can fit on a workstation GPU.

As a reminder, Tracy does not support paid AI providers. You have to use a local model running on your own hardware.

MCP server

The new Model Context Protocol server lets AI coding assistants load .tracy captures, run arbitrary analysis via the Worker bindings, and compare traces. For example, to verify that an optimization actually reduced frame time.

Extended platform support

Added support for profiling WebGPU, and for Windows on ARM64. Experimental system tracing has been added on Apple devices.

Ready-made binaries: macOS + Linux

Binary releases are now available on macOS. Manual quarantine handling is required.

Binary releases are now available on Linux. The build baseline is Ubuntu 24.04. Profiler GUI is delivered as an AppImage with the Wayland requirement.

yhirose/cpp-httplib (yhirose/cpp-httplib)

v0.53.0

Compare Source

What's Changed

Breaking changes

• WebSocketClient::connect() now returns httplib::ws::Result instead of bool (issue #​2531). ws::Result supports explicit operator bool(), error(), and flattened accessors for the upgrade response (status(), headers(), get_header_value(), has_header()), plus ssl_error()/ssl_backend_error() on SSL builds, matching how ClientImpl/SSLClient already report Result. A new Error::WebSocketHandshake covers upgrade-validation failures (non-101 status, bad Sec-WebSocket-Accept, bad Upgrade/Connection headers), and the handshake response is now parsed with detail::parse_status_line instead of a "HTTP/1.1 101" substring match, so a non-101 response surfaces its real status and headers instead of being silently discarded. This is source-breaking only for code that assigns the result directly to bool (e.g. bool ok = cli.connect();); if (cli.connect()) and gtest's ASSERT_TRUE/EXPECT_FALSE still work via contextual conversion

WebSocketClient/SSLClient API alignment (closes #​2531)

• WebSocketClient gains the setters SSLClient already had: enable_server_hostname_verification(), a PemMemory client-certificate constructor for mutual TLS, a (ca_cert_file_path, ca_cert_dir_path) overload for set_ca_cert_path(), and the std::chrono::duration overloads for its read/write/connection timeouts
• The TLS session setup the two clients had each implemented separately is now one shared detail::setup_client_tls_session(). As part of merging them, WebSocketClient moves from calling tls::set_hostname() (which turns on OpenSSL's in-handshake verification) to SSLClient's SNI-then-post-handshake-verify approach, and the default Host/User-Agent header logic is shared between both clients as well
• That merge exposed two backend-parity bugs, now fixed: on Mbed TLS and wolfSSL, enable_server_hostname_verification(false) had no effect on DNS hosts, because mbedtls_ssl_set_hostname() and wolfSSL_check_domain_name() bind SNI and identity checking together; and Mbed TLS reported the generic Error::SSLServerVerification on a genuine hostname mismatch instead of Error::SSLServerHostnameVerification. set_sni() now takes a verify_hostname flag, and map_mbedtls_error() inspects which verify flag actually fired

Bug fixes

• Match mount points on a path segment boundary in handle_file_request() (#​2529, thanks @​metsw24-max). The mount point was compared as a plain byte prefix, so set_mount_point("/mount", "./www2") also served /mountdir/... out of ./www2. Nothing escaped the base directory (is_valid_path() still rejects traversal), but a mount became reachable under URLs outside the prefix it declared, which is enough to slip past a reverse-proxy location, auth filter, or cache rule keyed on /mount/. A mount point ending in / (the root mount included) is unaffected
• Drain the socket gracefully before closing it in Server::process_and_close_socket() (#​2534, root cause identified by @​Hyukya in #​2533). Closing a connection while the receive queue still has unread data, or bytes are still in flight, can make the OS send an abortive RST instead of a graceful FIN; on Windows this surfaces as WSAECONNABORTED/WSAECONNRESET on the peer's read, making an otherwise fully-written response look like a failed request. This was a likely contributor to the intermittent ServerTest.HTTP2Magic failures on the Windows CI job (#​2533). detail::drain_and_close_socket() half-closes the write side, drains queued/in-flight bytes (bounded to 100ms / 1MB), then does the final shutdown+close

Development

• Document the WebSocketClient/SSLClient TLS parity gaps closed above in both READMEs, and add two Cookbook recipes (W05: wss:// TLS setup, W06: WebSocketClient's three timeouts) so this content lives in the WebSocket section instead of scattered asides in the mTLS/timeout/CA pages
• Document Headers/Params/FormFields/FormFiles ordering guarantees (added in v0.52.0) in the README, including the iterator-invalidation note
• Auto-comment on issue #​2533 with the run URL, commit, and failed-test lines when the windows-without-SSL job fails, to build up failure-pattern history while that flakiness is tracked down (temporary instrumentation)
• Fix a stale filename in the example/server.cc header comment (#​2532, thanks @​shaozk)

Full Changelog: yhirose/cpp-httplib@v0.52.0...v0.53.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.