fix(deps): update rust crate serde-saphyr to 0.0.29

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
serde-saphyr	dependencies	patch	0.0.21 → 0.0.29

---

Release Notes

bourumir-wyngs/serde-saphyr (serde-saphyr)

v0.0.29: Hardening release

Compare Source

• Summarizing results of automated fuzzing and static analysis, robustness against malformed (bad intent) YAML input was further hardened.
• Docker-compose, whose syntax serde-saphyr emulates, supports property nesting, so implemented nesting support for serde-saphyr as well. In the previous release, "${SET:-${B}}" with SET=value resolves to "value}".
• Fixed incorrect acceptance on Rust's float grammar (inf/Infinity/nan). YAML 1.2 only recognizes the .inf/.nan forms.
• Fixed caret misaligned in secondary snippet windows when line numbers exceed one digit
• FoldStr wrapping now cares not to start a continuation line with a tab
• Error reporting has been improved, showing location in some cases where previous versions were unable.
• Remove base64 create from deserializer dependencies (faster build)
• New version of (also hardened) granit-parser 0.0.7.

v0.0.28: Property interpolation extensions and even faster builds

Compare Source

Significant extension of property interpolation ( @​CommanderStorm)

• Added support for default property interpolation in plain scalars: ${NAME:-default} now resolves to default when NAME is unset or explicitly empty.
• ${VAR}: Values that must be configured (DB URLs, API keys). An unset var is a misconfiguration, not something to paper over -> a loud error at parse time
• ${VAR-fallback}: Empty value is meaningful and distinct from "not configured".
  F.ex. PREFIX="" -> "no prefix".
• ${VAR:-fallback}: The "regular" default, so f.ex. ${PORT:-8080}
• ${VAR+text}: F.ex. ${DEBUG+--verbose} emits the flag whenever DEBUG exists in the environment, regardless of value.
• ${VAR:+text}: Same as above, but differentiating empty <-> null

Also

• Fix #​120 LastWins not honored when deserializing struct. This was implemented and well tested, but only with maps.
• Reduced owning of comment strings (parsing very heavily commented YAML while discarding comments should be lighter on resources).
• Fixed indentation enforcement (@​CommanderStorm), making sure it also works for multiline scalars.
• Fixed tuple serialization (@​CommanderStorm)
• New SingleQuoted<..> and DoubleQuoted<..> wrappers to emit quoted strings. SingleQuoted may provide additional safety, as control characters will be rejected (with error), rather than written as YAML escape sequences. NullableTilde<T> is like Option and emits tilde ( ~ ) rather than null.

Faster compilation times with serde_core

serde-saphyr now avoids compiling serde_derive by default. The crate core uses serde_core instead that allows building serde-saphyr in parallel with serde_derive. However this also means that we needed to drop the previously built-in (de)serialization support for some serde-saphyr own configuration and reporting types like Options. (De)serialization support for these types can be re-enabled with the new feature serde_derived_types:

serde-saphyr = { version = "...", features = ["serde_derived_types"] }

This does not affect normal use of serde-saphyr for user data, you can still serialize and deserialize your own structs as before.

v0.0.27: Comments

Compare Source

The major extension of this release is comments support.

The long existed wrapper Commented<..> was usable for serialization only until now. Since this release, Commented also captures a comment of the wrapped data structure:

struct DeploymentConfig {
    name: Commented<String>,
    image: Commented<String>,
    ports: Commented<Vec<Commented<u16>>>,
    labels: Commented<BTreeMap<String, Commented<String>>>,
}

would capture all comments for the elements of the structure, like

# deployment manifest
name: checkout
image: registry.example.com/checkout:v1 # container image to deploy
ports: # sequence of exposed ports
  - 80 # public HTTP
  - 443 # public HTTPS
labels: # mapping of Kubernetes labels
  app: checkout # stable app label
  tier: frontend # routing tier
"#;

while assigning them to the relevant YAML element. This became possible after migrating to granit parser 0.0.3, which now captures comments. Comments can be either on the right or above the item they describe.

This release also adds support for figment2 (figment is supported since v0.0.13).

v0.0.26

Compare Source

• UTF-16LE, UTF-16BE, UTF-8 with BOM and UTF-8 without BOM are all supported for the Reader - based methods (stabilized)
• Relaxed from_slice to support borrowed deserialization, aligning its behavior with from_str and from_slice_with_options
• Reduce size of Location data structure in huge_documents mode, using 48 bits only for offsets. This silences Clippy warnings, due these some teams needed to box serde-saphyr Error. The maximal size of documents in huge_documents mode is now 256 Tb that is unlikely a problem (default limit is 4 Gb).
• saphyr-parser-bw, whose primary consumer is serde-saphyr, has been renamed to granit-parser, adjusting serde-saphyr dependencies. The granit-parser crate has undergone a security audit followed by additional hardening.

Merge key handling is now configurable via MergeKeyPolicy. There may be communities that

• Indeed have such a strange keys like << as ordinary, and these are even not quoted, maybe in generated YAML. Handling of this case is supported via AsOrdinary variant.
• Took very strict internal policy disallow merge keys in configurations that is their choice, and want to alert about their presence to automate the code review. Handling them as ordinary may result valid YAML with unexpected result, and would not report the error location properly, so there is an Error variant for this case.
• Have legacy code with merge keys, or see nothing wrong with them (default: Merge)

v0.0.25: Maintenance release

Compare Source

• Fixed deserialization bug (#​100) where mixing tagged and #[serde(untagged)] enum variants caused YAML tags to be ignored, leading to incorrect or failed variant resolution.
• Rewritten unit test (ser_coverage_boost.rs) that was triggering the false positive Socket alert (it never ever tried to access the network)
• Fixed taking numbers with preceding or trailing underscores as valid. 100000 is valid and 1000_000 also, but _10, 10_ are no longer. This is consistent with the serializer's auto-quoting policies.
• Publishing to crates.io now uses a trusted publishing workflow.

v0.0.24: - remove heavy regex crate

Compare Source

• Regex dependency is now removed using much lighter custom code. Regex was only used to detect numeric-looking strings that deserializer needs to quote (serde-saphyr itself does not need this, done for compatibility with other YAML readers).
• Comment position can now be changed between right from the item the comment describes (default), or above the item it describes. Some teams have rules that comments must be above the items they describe, while numerous short comments look better in-line on the right.
• Direct instantiation of parameter structures is not yet fully disabled, but since this release, such code emits deprecation warnings. We need to migrate to macros because adding any field to the public structure is formally a breaking change unless it is #[non_exhaustive], but then it cannot be instantiated, listing fields at all. Use options! { key: value, key2: value2 } macro. After the 1.0.0 release, we still want to keep adding new options without a "major release".

v0.0.23: - compile faster

Compare Source

• Added first-class feature gating for serialize and deserialize, both of which are now enabled by default. Consumers can now build a lighter dependency set by enabling only the side they need. Public re-exports in src/lib.rs are now conditionally exposed based on enabled features:

serde-saphyr = { version = "0.0.23", default-features = false, features = ["deserialize"] }

or

serde-saphyr = { version = "0.0.23", default-features = false, features = ["serialize"] }

Enabling neither feature is now rejected at compile time. This may happen for projects that previously used default-features = false, features=[]. Simple integrations that only specify the version remain backward-compatible.

• This release also fixes serialization of empty Vec at root structure level (#​95)

v0.0.22: - !include and properties

Compare Source

This release introduces support for !include. While not a standard YAML, multiple existing implementations show the need for this capability.

serde-saphyr now can resolve !include tags through a custom resolver configured via Options. The !include functionality is gated behind the include feature and must also be explicitly enabled by providing a resolver. For convenience, a safety-hardened filesystem-based resolver is available as an additional optional feature (include-fs).

This library also now supports properties, implemented in a Docker Compose-like style:

  database_password: ${DATABASE_PASSWORD}

Properties are implemented to prevent their values from being checked into the repository or from leaking via error snippets or other messages in logs. Tests were written to ensure that the value is never printed on error (please supply the security report if it is). Property values are provided via a custom-supplied HashMap, so up to the user how to store them safely, or maybe even generate them.

Other improvements

• Full support for JSON-style Unicode surrogate pairs in quoted strings. serde-saphyr now correctly decodes valid UTF-16 surrogate pair escapes such as \uD834\uDD1E into a single Unicode scalar, matching the equivalent YAML \U form. We also expanded the JSON compatibility test coverage with dedicated cases for objects, arrays, URLs, Unicode escapes, numbers, booleans, and null, and the full related test suite now passes.
• Indentation checking. Adding or removing a single space in YAML indentation may result in a document that is still syntactically correct but semantically wrong. To mitigate such issues, serde-saphyr can enforce indentation rules during deserialization via RequireIndent.
• Support options for to_string_multiple, #​87. Thanks, Eirik A @​clux)
• Fixed merge key expansion that bypassed duplicate-key enforcement. Now, merge keys also require all keys to be unique. However, if you rely heavily on overriding key values during merge, you can set DuplicateKeyPolicy in Options to

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.