Repository navigation
fix: replace the unmaintained YAML parser - #2279
Merged
Merged
Conversation
Replace serde_yaml and unsafe-libyaml with deserialize-only serde-saphyr to clear RUSTSEC-2024-0449 without suppressing advisories. Preserve language ordering and duplicate-language diagnostics, strict schema fields, YAML 1.2 booleans, and surgery operation validation for non-finite values. Add regressions for duplicate fields, numeric spellings, and all six shipped surgery examples. Refs #2278.
inureyes
added
status:review
Cover non-finite add coefficients and interpolation ratios, including the deliberately accepted quoted canonical special values. Record the parser migration and completed validation in bilingual reports; the added test execution and Clippy gate remain pending at report preparation. Refs #2278.
6 tasks
inureyes
added a commit
that referenced
this pull request
Oct 12, 2026
Merge main at fc45284 so PR #2277 uses the maintained safe-Rust YAML parser and no longer inherits the RUSTSEC-2024-0449 cargo-deny failure. The split-mtp source remains unchanged. Validation: configured version, kernel, Llama, ROCm, Python, and WebUI contracts pass; cargo deny check, formatting, and diff checks pass. Refs #1784, #2279
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the CLI and surgery YAML parser with deserialize-only
serde-saphyr 1.3.0, removingserde_yamlandunsafe-libyamlfrom the lockfile and resolving RUSTSEC-2024-0449 without an advisory exception.Preserve ordered language priorities,
DuplicateLanguageCode, duplicate schema-field rejection, YAML 1.2 booleans, and ordinary merge-key handling. Recover canonical non-finite values from Serde's tagged/untagged buffering so existing operation-specific finite-value validation remains effective. Quoted canonical.nan/.inf/-.infnow follow the same handling as their unquoted forms; malformed-input diagnostic formatting comes from the new parser.Validation: all 34 focused language-bias tests and all 28 surgery configuration tests pass, including all six shipped surgery examples.
cargo deny checkpasses all four checks; formatting and diff checks pass. Repository contract checks also pass (123 Python tooling tests and 49 WebUI fixtures). The alpha/ratio and quoted-special regressions pass. CI Clippy, CPU-only link, and cargo-deny pass on dd36abb; the duplicate local CUDA Clippy rebuild was stopped after CI succeeded.Closes #2278