build(deps): bump serde from 1.0.228 to 1.0.229

[dependabot]

Bumps serde from 1.0.228 to 1.0.229.

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[Yeachan-Heo]

OWNER_CONFIRMATION_REQUIRED

Reviewed exact head 761bd391a6102ab60fdf598eb6a10537ff3af454 against base f9103a65fb5d34d8e25835f3bc15b9d49522ac59. Scope is exactly one Cargo.lock change (8+/8-): serde, serde_core, and serde_derive move 1.0.228 → 1.0.229; the intentional proc-macro transitively moves syn 2.0.117 → 3.0.2. All records remain checksummed crates.io packages. Locked metadata/tree resolution and a disposable exact cargo update -p serde --precise 1.0.229 convergence check are clean; stable fmt --check, check --all-targets, clippy -D warnings, and test --workspace pass. Hosted exact-head CI is terminal green, and the PR is open, non-draft, mergeable, and clean.

Merge is withheld for the repository MSRV contract. Cargo.toml declares Rust 1.73, but cargo +1.73.0 check --locked --workspace --all-targets fails at unchanged crates/omx-api/src/lib.rs:1597 (trim_matches(['[', ']']) lacks DoubleEndedSearcher). The exact base→head diff does not touch that source, so Serde/Syn did not introduce the failure; the updated crates declare MSRVs 1.56/1.71 and compile on stable. The owner must explicitly waive this existing Rust 1.73 contract violation for this dependency-only merge, or land and validate the separate MSRV source repair first.

Independent adversarial review: dependency architecture is WATCH and recommends owner confirmation rather than approval because the only unresolved issue is the pre-existing declared-MS​​RV failure; no PR-caused graph, source, license, build-script, or CI defect was found.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

OWNER_CONFIRMATION_REQUIRED

Correction/supersession of the prior review record: the final hosted-state refresh returned mergeable: true but mergeStateStatus: BEHIND, not clean. The reviewed head remains exactly 761bd391a6102ab60fdf598eb6a10537ff3af454; hosted CI for that head remains terminal green, but the branch must be updated/revalidated against current dev before any merge decision.

The separate blocker is unchanged: the repository declares Rust 1.73 but fails cargo +1.73.0 check --locked --workspace --all-targets at the unchanged crates/omx-api/src/lib.rs:1597. The lock-only Serde/Syn update is not the cause. Owner confirmation is required to choose an explicit MSRV waiver for this dependency-only PR or a separate MSRV repair, and to refresh the branch/CI afterward. No merge was performed.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

MERGE_READY

Superseding review after rebasing the unchanged dependency-only commit onto exact dev base d5654c2eed8962aa4ba094d9cfd582136597ef1c. Reviewed head: 42e3f8dffe366570f0d220baced239c68eb3de3d. The rebased diff remains exactly Cargo.lock (8+/8-): Serde family 1.0.228 → 1.0.229 and intended syn 2.0.117 → 3.0.2, all checksummed crates.io records.

Fresh validation passed: locked Cargo metadata/tree and duplicate inspection; RustSec cargo audit; stable cargo fmt --check, workspace/all-target check, workspace/all-target clippy -D warnings, and focused serde-consuming package tests (omx-api, omx-mux, omx-runtime-core, omx-runtime). The exact-head hosted CI CI Status and every active lane are terminal green. Final hosted refresh: open, non-draft, head/base match above, mergeable=true, mergeable_state=clean. The Rust 1.73 source failure is unchanged from the prior base and is not part of this dependency update.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Post-merge validation receipt

Squash-merged to dev as e6df012757a2bac57c153c4b1074800d0ae31c79. Canonical origin/dev resolves to that exact commit and is tree-identical to the validated rebased review tree. The merged-dev CI Status and every active hosted lane completed successfully: Rust format/clippy/tests, Node 20 grouped lanes, Node 22 smoke, coverage, macOS preflight, full source build, lint, and typecheck.

After merged-dev CI was green, serialized local dev validation passed without installation or live rollout: cargo +stable build --locked --workspace, npm run build, and built CLI --version / --help dogfood. Worktree remains clean.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]