Skip to content

chore(deps): bump serde_yml from 0.0.12 to 0.0.13 - #44

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde_yml-0.0.13
Closed

chore(deps): bump serde_yml from 0.0.12 to 0.0.13#44
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde_yml-0.0.13

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 30, 2026

Copy link
Copy Markdown

Bumps serde_yml from 0.0.12 to 0.0.13.

Release notes

Sourced from serde_yml's releases.

v0.0.13 — Final release (deprecation shim, RUSTSEC-2025-0068 fixed)

⚠️ Final release — serde_yml is deprecated

This is the final maintenance release of serde_yml. The crate is no longer under active development. 0.0.13 is a thin compatibility shim that lets existing call sites keep compiling while you migrate to one of the maintained alternatives listed below.

If you are reading this because cargo audit flagged your build, upgrading to 0.0.13 resolves RUSTSEC-2025-0068 structurally — see Security below.

TL;DR

  # Cargo.toml
- serde_yml = "0.0"
+ serde_yml = "0.0.13"

Your existing call sites compile unchanged. The compiler now emits a #[deprecated] warning at every use serde_yml::* import pointing at the migration guide. The C-FFI libyml parser is no longer in your dependency graph.

When you're ready to fully migrate, see the migration guide.

Security: RUSTSEC-2025-0068 fixed

RUSTSEC-2025-0068 (also GHSA-hhw4-xg65-fp2x) flagged every serde_yml ≤ 0.0.12 as unsound — the serde_yml::ser::Serializer.emitter field could cause a segmentation fault via the C-FFI libyaml parser.

0.0.13 removes the vulnerable surface entirely:

  • The C-FFI libyml dependency is gone from the graph.
  • serde_yml::ser::Serializer is now a re-export of a pure-Rust unit struct (pub struct Serializer;) with no emitter field — code that referenced .emitter no longer compiles, which is the desired outcome.
  • The backend (noyalib) enforces #![forbid(unsafe_code)] workspace-wide.

Verification:

cargo update -p serde_yml --precise 0.0.13
cargo tree -p serde_yml | grep libyml   # → no output

The RustSec advisory database PR adding patched = ["^0.0.13"] is pending review at rustsec/advisory-db#2915. Until it merges, cargo audit may still warn against 0.0.13 — the 0.0.13 release itself ships .cargo/audit.toml + deny.toml ignore entries so the self-referential warning doesn't block your own CI.

Maintained alternatives

Three crates are realistic destinations. Pick the one that fits.

Crate Migration shape Best fit

... (truncated)

Commits
  • 2bdacd5 ci: commit Cargo.lock for reproducible audits
  • 57983ac ci: ignore RUSTSEC-2025-0068 in cargo-audit / cargo-deny
  • c236ddd style: apply rustfmt (max_width=72)
  • 795e112 ci: include master in push triggers (default branch is master)
  • 5497552 Deprecate serde_yml — 0.0.13 shim forwarding to noyalib (#52)
  • ab3c49e Merge pull request #34 from horacimacias/master
  • c7ba7ac Merge pull request #35 from lucasvr/lucas/anchors
  • 140d00b Merge pull request #38 from nc7s/fix-cstr-pointer-type
  • a19e5c2 Merge pull request #18 from Mingun/remove-duplicated-clone
  • 6ffe205 fix: hard coded CStr pointer type, use ffi::c_char
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump serde_yml from 0.0.12 to 0.0.13
f8618c0 
Bumps [serde_yml](https://github.com/sebastienrousseau/serde_yml) from 0.0.12 to 0.0.13.
- [Release notes](https://github.com/sebastienrousseau/serde_yml/releases)
- [Commits](sebastienrousseau/serde_yml@v0.0.12...v0.0.13)

---
updated-dependencies:
- dependency-name: serde_yml
  dependency-version: 0.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 30, 2026
@dean0x dean0x closed this May 31, 2026
@dean0x
dean0x deleted the dependabot/cargo/serde_yml-0.0.13 branch May 31, 2026 20:31
@dependabot @github

dependabot Bot commented on behalf of github May 31, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dean0x added a commit that referenced this pull request Jul 18, 2026
@dean0x @claude
fix(ts): restore sync-throw error contract, model CheckOptions hierar…
d1db88c 
…chy, strengthen W-SM3 (avoids PF-007)

Fixes three pre-classified issues from Group F triage.

**#35 (Careful) — drop `async` from `checkFile` and `lintFile` in node.ts**

`compileFile` has always been a plain function; adding `async` to the two
siblings was an unintended contract change that silently converted the
pre-existing `assertReady()` throw and `assertKnownKeys` throw into promise
rejections.  KB:359 documents errors as "thrown (not rejected promises)";
the test section header reads "reject unknown keys synchronously" — both
confirm the async change was unintended.

Node.js v22 `assert.rejects(fn, validatorFn)` does NOT intercept
synchronous throws from `fn`; the error escapes the validator — exactly why
the original tests did not catch the regression.  U-OV-12/U-OV-13 are
flipped from `assert.rejects` (non-discriminating) to `assert.throws` (sync
only) so a future revert to `async` causes a clear test failure rather than
a silent masking.  Discriminating regression tests also added to
source-map.spec.mjs (describe block "file-op error contract — sync throw
regression #35").

KB:359 is correct again after this fix.

**#10 (Careful) — model CheckOptions/CompileOptions/FileOptions hierarchy in types.ts**

`CompileOptions extends CheckOptions` makes "check accepts a strict subset of
compile's options" a type-system fact rather than a convention.  `vars` is no
longer duplicated between the two; `FileOptions extends CompileOptions` closes
the doc-wording drift that had already diverged since the split.  Public type
shapes are semantically equivalent to callers; no breaking change.

**#44 (Standard) — replace per-field W-SM3 assertions with full deepEqual (avoids PF-007)**

The test comment stated "the ENTIRE sourceMap object is now identical" but
only asserted four fields — `file` was unasserted and future fields silently
uncovered.  Overstating parity coverage is the mechanism by which PF-007
survived every gate.  Replaced the four individual asserts with a single
`assert.deepEqual(nativeResult.sourceMap, wasmResult.sourceMap)` so any new
field is automatically covered.  The differential property of W-SM3/W-SM3b
(comparing backends to each other, not to per-surface snapshots) is
preserved.

Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dean0x