Update cpal requirement from 0.17 to 0.18

[dependabot]

Updates the requirements on cpal to permit the latest version.

Release notes

Sourced from cpal's releases.

cpal 0.18.1

A quick follow-up to 0.18.0 primarily to fix the docs.rs build failure.

• docs.rs: Excluded pipewire, whose system dependency isn't available in that sandboxed build environment.
• WASM: Fixed the audioworklet feature failing to compile on wasm32-wasip1 and other non-browser wasm32 targets.

No API or behavioral changes.

Links

• https://crates.io/crates/cpal
• https://docs.rs/cpal/0.18.1
• https://github.com/RustAudio/cpal/releases/tag/v0.18.1
• https://github.com/RustAudio/cpal/blob/v0.18.1/CHANGELOG.md

Changelog

Sourced from cpal's changelog.

[0.18.1] - 2026-06-07

Fixed

• Exclude pipewire from the docs.rs build; system dependency not available in its environment.
• Fix wasm-bindgen causing compile errors on non-browser wasm32 targets such as wasm32-wasip1.

[0.18.0] - 2026-06-06

Added

• New ErrorKind variants for the unified error type: BackendError (platform error without a specific mapping); DeviceBusy (retryable device access, e.g. EBUSY/EAGAIN); DeviceChanged (audio route changed to another device); InvalidInput (invalid caller-supplied values); PermissionDenied (OS-level access denial); RealtimeDenied (real-time scheduling refused — previously only printed to stderr); ResourceExhausted (OS thread/memory limits); UnsupportedOperation (backend or device does not implement the operation).
• Device now implements PartialEq, Eq, Hash, Display, and Debug on all backends.
• realtime feature for real-time audio thread scheduling without a D-Bus build dependency.
• StreamTrait::now() to query the current instant on the stream's clock.
• StreamTrait::buffer_size() to query the stream's current buffer size in frames per callback.
• SAMPLE_RATE_CD (44100 Hz) and SAMPLE_RATE_48K (48000 Hz) constants.
• SupportedStreamConfigRange::try_with_standard_sample_rate() and with_standard_sample_rate() to select 48 kHz or 44.1 kHz from a range.
• SupportedStreamConfigRange::contains_rate() to test whether a sample rate falls within a range.
• StreamConfig and SupportedStreamConfig now implement Copy.
• BufferSize now implements Default (returns BufferSize::Default).
• SupportedBufferSize now implements Default (returns SupportedBufferSize::Unknown).
• HostTrait::device_by_id() is now backend-dispatched, allowing each host to override the default implementation.
• DSD512 sample rates added to the common rate probe list.
• AAudio: Streams now request PERFORMANCE_MODE_LOW_LATENCY with the realtime feature; reports ErrorKind::RealtimeDenied if not granted.
• ALSA: device_by_id() now accepts PCM shorthand names such as hw:0,0 and plughw:foo.
• CoreAudio: tvOS target support (Tier 3, requires nightly).
• PipeWire: New host for Linux and BSD via the native PipeWire API.
• PulseAudio: New host for Linux and BSD via the PulseAudio API.
• WASAPI: F64 sample format support.

Changed

• Changed per-operation error types (DevicesError, SupportedStreamConfigsError, etc.) and HostUnavailable into a unified Error/ErrorKind. See https://github.com/RustAudio/cpal/blob/master/UPGRADING.md.
• DeviceTrait now requires PartialEq + Eq + Hash + Debug + Display with a stable device ID.
• DeviceTrait::build_*_stream() now takes StreamConfig by value instead of &StreamConfig.
• StreamInstant API changed and extended to mirror std::time::Instant/Duration. See https://github.com/RustAudio/cpal/blob/master/UPGRADING.md for migration details.
• Streams no longer start automatically on build_*_stream(); call play() explicitly. Previously ALSA, CoreAudio, and JACK auto-started streams on creation.
• Default output and input configs now prefer 48 kHz, then 44.1 kHz, then the device maximum.

... (truncated)

Commits

• 94ecb6e fix(ci): docs.rs has libjack-jackd2-dev
• 50d9646 ci: check with all features (#1240)
• 51f96e9 chore: prepare for v0.18.1 release
• 189db47 fix: exclude pipewire from docs.rs (#1239)
• 45fe976 fix(wasm): all features without atomics
• baa3678 doc: finalize changelog and upgrading guide for v0.18 release (#1238)
• 27473ac fix(pipewire): use node.latency and re-promote RT when re-negotiated (#1236)
• 0048977 perf(alsa): optimize enumeration speed (#1233)
• 7d4aedb chore(jack): pin to >= 0.13.5 (#1231)
• d2a2688 fix(pulseaudio): use device names as id (#1228)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mnmaita]

As far as I can see cpal is only a dependency for android targets and we only use rodio's cpal re-export in bevy_audio code, so I'm wondering if we really need to state this dependency directly. Maybe someone can clarify if this is done to ensure platform compatibility.

Besides that, I think we should group these dependency updates (rodio + cpal) to avoid potentially depending on different versions. Let me know what do you think.