chore(deps): bump transitive serde_with and time out of vulnerable ranges by devin-ai-integration[bot] · Pull Request #606 · luvs01/opencodex

devin-ai-integration · 2026-09-21T09:03:16Z

Summary

serde_with 3.1.0 → 3.23.0 — clears GHSA-7gcf-g7xr-8hxj (Dependabot alert [WRONG BRANCH] fix(routing): enforce hard policy cost ceilings on unknown estimates #4, medium): KeyValueMap serialization panics on empty inner sequence/map entries when serializing attacker-controlled data.
time 0.3.44 → 0.3.55 — clears CVE-2026-25727 (alert [WRONG BRANCH] fix(issue-quality): reject placeholders wrapped in media blocks #3, medium): stack-exhaustion DoS when parsing malicious RFC 2822 input (reached via cookie, plist, tauri-codegen, tauri-plugin-updater).
serde/serde_json pins move =1.0.219/=1.0.140 → =1.0.229/=1.0.151: serde_with ≥3.21 requires serde_core ^1.0.225, unsatisfiable while serde is pinned at 1.0.219.
Not changed: glib (alert [WRONG BRANCH] fix(command-code): disable repository fsmonitor during git metadata collection #1, GHSA-wrw7-89jp-8q8g) — fixing needs glib 0.20, which requires the whole gtk-rs 0.20 ecosystem via tauri/webkit2gtk; that's an upstream ecosystem bump, not a lockfile update. No app code calls glib directly.
Neither affected surface is reachable from this repo's Rust code (no direct serde_with/time usage — verified by grep); both fixes are belt-and-suspenders version bumps.

Verification

cargo update -p serde_with -p time resolved cleanly after the pin bump; lockfile diff reviewed.
cargo tree -i confirmed both crates are transitive-only (pulled by tauri-utils / cookie / plist / tauri-plugin-updater).
Rust compile is exercised by CI (Analyze (rust) + build jobs); this box has no MSVC toolchain for a local cargo check.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Link to Devin session: https://app.devin.ai/sessions/18173a51bcf04824a2e66ca1d2e42ccf
Open in Devin Desktop: https://app.devin.ai/desktop/session/18173a51bcf04824a2e66ca1d2e42ccf?variant=devin
Requested by: @luvs01

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

All CI tests are green on my local testing.
I pushed my PR to the latest dev commit.
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.

- serde_with 3.1.0 -> 3.23.0: fixes GHSA-7gcf-g7xr-8hxj (KeyValueMap serialization panic on empty inner entries). serde_with >=3.21 requires serde_core ^1.0.225, so the serde/serde_json pins move to =1.0.229/=1.0.151 to satisfy it. - time 0.3.44 -> 0.3.55: fixes CVE-2026-25727 (RFC 2822 parse stack exhaustion). Reached transitively via cookie/plist/tauri-codegen/ tauri-plugin-updater. Both are transitive-only deps; no app code calls the affected surfaces directly. glib GHSA-wrw7-89jp-8q8g intentionally untouched: 0.20 needs the whole gtk-rs 0.20 ecosystem via tauri, which is an upstream pin. Co-Authored-By: Epinephrine <luvs01@hanmail.net>

devin-ai-integration · 2026-09-21T09:03:20Z

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

Disable automatic comment, CI, and merge conflict monitoring

coderabbitai · 2026-09-21T09:03:21Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b1a72a4e-d7e4-4949-924a-5c87b46b465e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

Devin Review found 1 potential issue.

⚠️ 1 issue in files not directly in the diff

⚠️ Declared Rust toolchain cannot build

Building with Rust 1.77–1.87 fails because serde_with and time now require Rust 1.88. The manifest still advertises rust-version = "1.77", giving supported builders an unusable dependency graph.

serde_with >=3.21 and time >=0.3.47 both declare rust_version 1.88; the manifest floor follows the dependency graph. CI builds on `stable`, well above 1.88. Co-Authored-By: Epinephrine <luvs01@hanmail.net>

devin-ai-integration · 2026-09-21T09:05:54Z

Devin Review finding addressed in bc840a8 — verified serde_with >=3.21 and time >=0.3.47 both declare rust_version = 1.88, so rust-version is now "1.88". CI builds on stable, well above that floor.

github-actions · 2026-09-21T09:13:23Z

✅ Deterministic PR hygiene checks passed.

github-actions · 2026-09-21T09:25:02Z

✅ READY

all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

✅ All CI tests are green on my local testing.
✅ I pushed my PR to the latest dev commit.
✅ I resolved all correct Codex and CodeRabbit findings.
✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu

…test.ts at 13:42:58, 20-min timeout on 6863dc5; environmental runner stall, no branch code involvement)

devin-ai-integration Bot assigned luvs01 Sep 21, 2026

devin-ai-integration Bot requested a review from luvs01 September 21, 2026 09:03

devin-ai-integration Bot commented Sep 21, 2026

View reviewed changes

chore(deps): raise rust-version to 1.88

bc840a8

serde_with >=3.21 and time >=0.3.47 both declare rust_version 1.88; the manifest floor follows the dependency graph. CI builds on `stable`, well above 1.88. Co-Authored-By: Epinephrine <luvs01@hanmail.net>

github-actions Bot added the chore label Sep 21, 2026

github-actions Bot marked this pull request as draft September 21, 2026 09:25

merge dev to refresh PR head for review gate

6863dc5

github-actions Bot added the review-ready label Sep 21, 2026

github-actions Bot marked this pull request as ready for review September 21, 2026 09:37

ci: retrigger platform-macos (macos 1/2 wedged inside client-connect.…

04611a7

…test.ts at 13:42:58, 20-min timeout on 6863dc5; environmental runner stall, no branch code involvement)

github-actions Bot removed the review-ready label Sep 21, 2026

github-actions Bot marked this pull request as draft September 21, 2026 14:03

github-actions Bot added the review-ready label Sep 21, 2026

github-actions Bot marked this pull request as ready for review September 21, 2026 14:09

Navigation Menu

chore(deps): bump transitive serde_with and time out of vulnerable ranges - #606

chore(deps): bump transitive serde_with and time out of vulnerable ranges#606
devin-ai-integration[bot] wants to merge 4 commits into
devfrom
devin/1789981256-cargo-transitive-bumps

devin-ai-integration Bot commented Sep 21, 2026 •

edited by luvs01

Loading

Uh oh!

devin-ai-integration Bot commented Sep 21, 2026

Uh oh!

coderabbitai Bot commented Sep 21, 2026 •

edited

Loading

Review skipped

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot commented Sep 21, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devin-ai-integration Bot commented Sep 21, 2026 • edited by luvs01 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Checklist

Review readiness checklist

Uh oh!

devin-ai-integration Bot commented Sep 21, 2026

Uh oh!

coderabbitai Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

⚠️ Declared Rust toolchain cannot build

Uh oh!

devin-ai-integration Bot commented Sep 21, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ READY

Review readiness checklist

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devin-ai-integration Bot commented Sep 21, 2026 •

edited by luvs01

Loading

coderabbitai Bot commented Sep 21, 2026 •

edited

Loading

github-actions Bot commented Sep 21, 2026 •

edited

Loading