fix(deps): dependabot remediation 2026-07-16 (tkhq/qos)

[arawal]

Auto-opened by the Dependabot remediation workflow.

serde_with 3.11.0 → 3.21.0 (lockfile-only)

Covers alerts:

• #112 (src/init/Cargo.lock)
• #113 (src/qos_enclave/Cargo.lock)
• #114 (Cargo.lock)

Advisory: GHSA-7gcf-g7xr-8hxj — medium severity

Actual severity: informational · Complexity: trivial · Score: 60

What changed

v3.11.0 → v3.21.0 patches a DoS panic in the KeyValueMap serializer, which subtracted 1 from the caller-visible length before validating that an inner sequence/map entry contained the required first key field (fixed in upstream PR #966; commit c8a1d82). No API changes.

Reachability

Taking the patch defensively; the vulnerable code path is unreachable in tkhq/qos because there are zero uses of KeyValueMap or #[serde_as(...)] in this repo's source. serde_with is a transitive-only dep pulled in via aws-nitro-enclaves-cose 0.5.2 (COSE signing helpers) and bollard-stubs (Docker API stubs).

Required by upstream

serde_with 3.21.0's own manifest requires:

• serde_with_macros = 3.21.0 (exact match, proc-macro sub-crate — bumped in lockstep)
• serde_core ^1.0.225 (new hard normal dep)
• serde_json ^1.0.145 (forced serde_json 1.0.143 → 1.0.150)
• Feature-flag-driven optional deps that consumers of serde_with enable in this workspace: bs58 ^0.5.1, schemars ^0.9.0, schemars ^1.0.2

Cascading forced transitives:

• darling 0.20.11 → 0.23.0 (required by serde_with_macros 3.21.0), which also lockstep-bumps darling_core and darling_macro
• dyn-clone, ref-cast, ref-cast-impl, zmij, tinyvec, tinyvec_macros (added transitively by schemars/serde_json 1.0.150/bs58)
• fnv, ryu removed (no longer required by the new versions)

Note on src/init/Cargo.lock

This lockfile had pre-existing workspace drift from chore: release v0.12.2 (commit 7097d23) which bumped [workspace.package] version in the root manifest but did not refresh this child lockfile. Running cargo update -p serde_with reconciles that as a side-effect, so this PR also updates the internal workspace path-deps qos_core / qos_crypto / qos_hex / qos_json / qos_nsm / qos_p256 from 0.10.0 to 0.12.2. These are internal path-deps (not external supply-chain changes) and were required to keep the lockfile consistent with the workspace manifest.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	serde_json@​1.0.140 ⏵ 1.0.150

View full report