Skip to content

chore(deps): bump serde_with from 3.12.0 to 3.21.0#20157

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde_with-3.21.0
Open

chore(deps): bump serde_with from 3.12.0 to 3.21.0#20157
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde_with-3.21.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026 •
edited by drmingdrmer
Loading

Copy link
Copy Markdown
Contributor

Bumps serde_with from 3.12.0 to 3.21.0.

Release notes

Sourced from serde_with's releases.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

Added

  • Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

  • Re-enable link-to-definition on docs.rs (#964)

Fixed

  • Fix some doc links to point to the correct types (#963)
  • Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

serde_with v3.20.0

Added

  • Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#943)

Fixed

serde_with v3.19.0

Added

  • Add support for hashbrown v0.17 (#940)

    This extends the existing support for hashbrown to the newly released version.

serde_with v3.18.0

Added

  • Support OneOrMany with more sequence and set types (#929)

Changed

  • Bump MSRV to 1.88 due to the darling dependency

serde_with v3.17.0

Added

... (truncated)

Commits
  • 0f4ca67 Update changelog for 3.21.0 (#967)
  • 7654841 Update changelog for 3.21.0
  • c8a1d82 Protect all collection creations against capacity overflow by using `size_hin...
  • 6ad5fa5 Properly feature gate the vec_with_capacity_cautious function
  • ef7d141 Protect all collection creations against capacity overflow by using `size_hin...
  • a348da3 Add serde_as deserialize_as explain (#958)
  • 2e5bc20 Bump the github-actions group with 3 updates (#965)
  • 927a3d6 Bump the github-actions group with 3 updates
  • 62d14ec Enable link-to-definition on docs.rs again, after the upstream issue was reso...
  • 4584d94 Enable link-to-definition on docs.rs again, after the upstream issue was reso...
  • Additional commits viewable in compare view

This change is Reviewable

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 15, 2026
@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

At least one test kind must be checked in the PR description.
@dependabot[bot] please update it 🙏.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Pull request description must contain CLA like the following:

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

## Summary

Summary about this PR

- Close #issue

@github-actions github-actions Bot added the pr-chore this PR only has small changes that no need to record, like coding styles. label Jul 15, 2026
@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

At least one type of change must be checked in the PR description.
@dependabot[bot] please update it 🙏.

@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

1 similar comment
@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jul 15, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b5c8c5cc8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.lock
[[package]]
name = "serde_with"
version = "3.12.0"
version = "3.17.0"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pin serde_with to the security-fixed release

This security dependency bump still locks serde_with at 3.17.0, but the commit message/release notes say the advisory fix is in 3.21.0. Because CI and release builds use the committed lockfile with --locked, merging this leaves artifacts on the pre-fix version instead of remediating the Dependabot alert; please regenerate/update the lockfile so serde_with and serde_with_macros resolve to 3.21.0.

Useful? React with 👍 / 👎.

@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

1 similar comment
@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@github-actions

github-actions Bot commented Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 CI Job Analysis (Retry 1)

Workflow: 30017729502

📊 Summary

  • Total Jobs: 89
  • Failed Jobs: 4
  • Retryable: 4
  • Code Issues: 0

✅ AUTO-RETRY INITIATED

4 job(s) retried due to infrastructure issues (runner failures, timeouts, etc.)

View Progress

🔍 Job Details

  • 🔄 linux / test_stateless_standalone: ✅ Retryable (Infrastructure)
  • 🔄 linux / test_stateless_cluster: ✅ Retryable (Infrastructure)
  • 🔄 linux / sqllogic / standalone (base, 2c, http): ✅ Retryable (Infrastructure)
  • 🔄 linux / sqllogic / standalone (tpch, 2c, hybrid): ✅ Retryable (Infrastructure)
🤖 About

Automated analysis using job annotations to distinguish infrastructure issues (auto-retried) from code/test issues (manual fixes needed).

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

1 similar comment
@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@dependabot
chore(deps): bump serde_with from 3.12.0 to 3.21.0
d0a15d1 
Bumps [serde_with](https://github.com/jonasbb/serde_with) from 3.12.0 to 3.21.0.
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.12.0...v3.21.0)

---
updated-dependencies:
- dependency-name: serde_with
  dependency-version: 3.21.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/serde_with-3.21.0 branch from 7b5c8c5 to d0a15d1 Compare July 23, 2026 14:50
@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

7 similar comments
@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file pr-chore this PR only has small changes that no need to record, like coding styles. rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants