chore(deps): bump the minor-and-patch group in /backend with 2 updates

[dependabot]

Bumps the minor-and-patch group in /backend with 2 updates: thiserror and grib.

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates grib from 0.18.5 to 0.18.6

Changelog

Sourced from grib's changelog.

[0.18.6] - 2026-09-27

Security fixes

This version fixes 3 types of panic cases.

A panic does not necessarily cause denial of service. Depending on the application's panic handling and configured panic strategy (unwind or abort), a panic may interrupt a processing thread or terminate the process. This can become a denial-of-service vulnerability when an attacker can supply input to the affected operation and the resulting failure disrupts service for legitimate users. A failure confined to the attacker's request does not by itself establish service-wide denial of service; the impact depends on how the application isolates failures and maintains processing capacity.

The 3 types of fixed panic mentioned above are as follows:

• A panic during deserialization when encountering an unrecognized template number. This panic occurs not only with invalid data but also with valid data for which the template is not supported. (GHSA-6j96-629m-89w4 (thanks @​amoutiers))
• A panic during reading forecast-time metadata from a truncated GRIB product definition. This panic does not occur with valid GRIB2 data. (GHSA-m5w8-9hc6-j8x8 (thanks @​amoutiers))
• A panic when short section buffers are passed to the decoder. 　　This panic does not occur with valid data, nor does it occur when constructing the decoder based on submessages. (GHSA-v8g4-j727-859g (thanks @​amoutiers))

Versions

grib 0.18.6
grib-cli 0.18.6
grib-template-derive 0.2.2

Commits

• 055e6ce Bump to v0.18.6
• 5160956 Merge branch 'advisories' into maint
• 6774dd4 Fix a lint warning from clippy::needless_borrow
• 2f33484 Validate the section slices passed to the decoder constructor
• f237f34 Reject undersized decoder section vectors
• c303306 Simplify the fix
• eef828a Avoid panics on short product definition payloads
• b2e710e Apply a common approach to testing unsupported template numbers
• b002fd1 Return errors for unsupported template discriminants
• 75be887 Change the publication status of 3 advisories to final
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions