Repository navigation
build(deps): replace serde_yaml with serde-saphyr - #144
Conversation
serde_yaml is deprecated and pulls in unsafe-libyaml, which RustSec reports as unmaintained (RUSTSEC-2024-0449), so every consumer running `cargo deny check advisories` failed through this crate. - Every config path (ProxyConfig, the transcoding settings, the sections handed to builders, the binary's `runtime:`) reads YAML through one reader on serde-saphyr, safe Rust, deserialization only. - Booleans stay YAML 1.2 (`true`/`false`; `yes`/`on` are refused), JSON text keeps parsing, repeated keys and extra documents are refused. - Errors still name the key path (`runtime.worker_threads: ...`) via serde_path_to_error, already in the tree through axum, on one line. - The unknown-key warnings read the keys in document order without a YAML value type; the moved `shield.trusted_proxies` hint is kept. - Bump the protox dev-dependency to 0.10. Closes #143
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 35 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Summary
Merge Risk: ⚪ Minimal · up to No identified issue blocks merging after normal checks. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Out of Scope Changes check |  |
The protox dev-dependency changes from 0.9 to 0.10. The reviewed evidence does not connect this test-protobuf dependency update to the YAML replacement or to issue #143. The YAML parser changes, par… |
Revert the protox version change unless the author provides evidence that version 0.10 is required for the YAML replacement or its in-scope tests. |
✅ Passed checks (4 passed)
-
Check name Status Explanation Linked Issues check Issue #143requires replacement ofserde_yaml, preserved configuration parsing, preserved unknown-key warnings, and removal ofserde_yamlandunsafe-libyaml.Cargo.tomlusesserde-saphyrwit…Docstring Coverage Docstring coverage is 82.46% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 57 functions across 8 files. (1 skipped: 1 … Title check The title clearly and concisely identifies the main change: replacing serde_yamlwithserde-saphyr.Description check The description directly explains the dependency replacement, configuration parsing changes, testing, and advisory-remediation objective.
Full details: Out of Scope Changes check
-
Explanation
The
protoxdev-dependency changes from 0.9 to 0.10. The reviewed evidence does not connect this test-protobuf dependency update to the YAML replacement or to issue#143. The YAML parser changes, parser tests, and test call-site updates are in scope.
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0cb3fc5968
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The YAML reader took an unquoted scalar for the text it spells wherever
the setting is a string, so `service: { name: true }` or
`forwarded_headers: [123]` loaded as "true" and "123" instead of failing
as they did before. It now reads with the YAML 1.2 core schema's types:
such a value is an error naming its key, and quoting it keeps the text.
- The unknown-key warnings skip a number or boolean key instead of
failing on it, so the typos beside it are still reported.
- Regression tests cover the refused scalars, the quoted forms, the
case variants of `true`/`false` that stay accepted, and the packaged
config template.
## 🤖 New release * `structured-proxy`: 8.1.1 -> 8.1.2 (✓ API compatible changes) <details><summary><i><b>Changelog</b></i></summary><p> <blockquote> ## [8.1.2](v8.1.1...v8.1.2) - 2026-10-12 ### Other - *(deps)* replace serde_yaml with serde-saphyr ([#144](#144)) </blockquote> </p></details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/). Co-authored-by: sw-release-bot[bot] <255865126+sw-release-bot[bot]@users.noreply.github.com>
1 participant
Summary
serde_yaml(and its unmaintainedunsafe-libyaml, RUSTSEC-2024-0449) withserde-saphyr, a YAML deserializer in safe Rust, socargo deny check advisoriespasses for consumers of this crate.Changes
config::parse_yaml: the one YAML reader of every config path (ProxyConfig::from_yaml_str,ProxyServer::from_yaml_str,config::from_yaml, the binary'sruntime:section). It reads with the YAML 1.2 core schema's types: booleans aretrue/falsein any letter case (yes/onare refused), an unquoted number or boolean where text is expected is an error, repeated keys and extra documents are refused, and JSON text parses as before.runtime.worker_threads: ...) throughserde_path_to_error(already in the tree through axum) and stay on one line.unknown_config_keysreads the top-level andstreaming:keys in document order without a YAML value type, skipping number or boolean keys;moved_settingkeeps theshield.trusted_proxieshint.protoxdev-dependency moves to 0.10.Testing
Formatting, clippy and the test suite pass for every CI feature set (rust_crypto, aws_lc_rs, injected verifier, all features), together with doc tests, the MSRV 1.99 check, the publish dry-run and the advisory audit;
serde_yamlandunsafe-libyamlare absent from the dependency tree with every feature.Closes #143