Skip to content

deps(deps): bump serde from 1.0.228 to 1.0.229 - #58

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde-1.0.229
Closed

deps(deps): bump serde from 1.0.228 to 1.0.229#58
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde-1.0.229

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps serde from 1.0.228 to 1.0.229.

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, rust, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​serde@​1.0.228 ⏵ 1.0.2298110093100100

View full report

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown

🔒 Security Validation Report

Generated: Mon Jul 20 10:58:49 UTC 2026

📊 Summary

  • NIST compliance: success
  • Cryptographic validation: success
  • Constant-time operations: success
  • Memory safety: success
  • Dependency security: success
  • WASM security: success

✅ Overall Security Status: PASSED

All critical security validations passed successfully.

🔍 Details

This report covers:

  • NIST post-quantum algorithm compliance
  • Constant-time operation verification
  • Memory safety and zeroization checks
  • Dependency vulnerability scanning
  • WASM build artifact validation

📋 Next Steps

✅ Security validation passed. Code is ready for deployment.

✅ Security validation passed! This code meets all security requirements.

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown

🔍 Pull Request Summary

Generated: Mon Jul 20 11:01:20 UTC 2026

📋 Validation Results

  • Core Validation: success
  • Security Validation: success
  • Test Coverage: success
  • WASM Compatibility: success
  • Documentation: success

✅ Overall Status: PASSED

🔒 Security Checklist

  • No classical cryptographic algorithms
  • Only SHA-3 family hash functions
  • Constant-time operations
  • Proper memory zeroization
  • Input validation
  • Error handling

📝 Review Notes

Please review the security implications of this change carefully.
All cryptographic changes require security team review.

✅ Automated validation passed! This PR is ready for review.

@dependabot
deps(deps): bump serde from 1.0.228 to 1.0.229
fc87745 
Bumps [serde](https://github.com/serde-rs/serde) from 1.0.228 to 1.0.229.
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

---
updated-dependencies:
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/serde-1.0.229 branch from 767b9ca to fc87745 Compare July 28, 2026 21:38
@Nexlab-One Nexlab-One mentioned this pull request Jul 28, 2026
Merged
@Nexlab-One

Nexlab-One commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Superseded by #68. This was Cargo.lock-only but went stale once five other bumps landed on main, and GitHub reported it CONFLICTING. #68 regenerates the same bump (serde 1.0.228 -> 1.0.229) on current main via cargo update --precise.

@Nexlab-One Nexlab-One closed this Jul 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/cargo/serde-1.0.229 branch July 28, 2026 21:42
@github-actions

github-actions Bot commented Jul 28, 2026

Copy link
Copy Markdown

🔍 Pull Request Summary

Generated: Tue Jul 28 21:58:04 UTC 2026

📋 Validation Results

  • Core Validation: success
  • Security Validation: success
  • Test Coverage: cancelled
  • WASM Compatibility: cancelled
  • Documentation: cancelled

❌ Overall Status: FAILED

🔒 Security Checklist

  • No classical cryptographic algorithms
  • Only SHA-3 family hash functions
  • Constant-time operations
  • Proper memory zeroization
  • Input validation
  • Error handling

📝 Review Notes

Please review the security implications of this change carefully.
All cryptographic changes require security team review.

❌ Automated validation failed! Please address the issues above before merging.

@github-actions

github-actions Bot commented Jul 28, 2026

Copy link
Copy Markdown

🔒 Security Validation Report

Generated: Tue Jul 28 21:58:13 UTC 2026

📊 Summary

  • NIST compliance: success
  • Cryptographic validation: success
  • Constant-time operations: success
  • Memory safety: cancelled
  • Dependency security: success
  • WASM security: cancelled

❌ Overall Security Status: FAILED

Critical security validations failed. Please review the issues above.

🔍 Details

This report covers:

  • NIST post-quantum algorithm compliance
  • Constant-time operation verification
  • Memory safety and zeroization checks
  • Dependency vulnerability scanning
  • WASM build artifact validation

📋 Next Steps

❌ Security issues detected. Please address before deployment.

❌ Security validation failed! Please address security issues before merging.

Nexlab-One added a commit that referenced this pull request Jul 29, 2026
@Nexlab-One
deps: bump serde 1.0.228 -> 1.0.229 and serde_json 1.0.150 -> 1.0.151 (…
e0f6744 
…#68)

Supersedes dependabot PRs #58 and #57, which were both Cargo.lock-only but had
gone stale: five other dependency bumps landed on `main` first, so their locks no
longer applied and GitHub reported #58 CONFLICTING. Regenerating both on current
`main` with `cargo update --precise` is equivalent to what those PRs did and
avoids waiting on a dependabot rebase cycle.

serde pulls its workspace-internal companions with it (serde_core, serde_derive
1.0.228 -> 1.0.229); that is the normal coupled set, not extra scope.

Lockfile-only: no Cargo.toml, no source, no API change.

Note for the record: #57 previously showed a red Test Matrix, and it was NOT
caused by this bump. It failed on a flaky wall-clock assertion in
lib-q-k12/tests/constant_time.rs at merge-base 123fc27, before `min_time`
(repeated-measurement minimum) existed on main.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Nexlab-One