[austinborn]

Summary

This clears all 12 open Dependabot alerts on actual-cli.

serde_yml and libyml have no fixed release, so YAML now goes through serde-saphyr 2, a maintained pure-Rust crate, behind a new src/yaml.rs that keeps its options in one place. The config file, stored credentials and both caches keep their format: files serde_yml 0.0.12 wrote read back to the same values, and v0.9.0 reads what the new code writes. Two serde-saphyr defaults didn't preserve behaviour, so they're changed. Files the CLI writes itself parse without its node budget (a config holding near-cap caches would otherwise fail to load). And the emitter keeps each value on its key's line, because the default folded style moved long API keys past the line-by-line redaction in actual config show; a new test pins that.

jsonwebtoken moves to 10.4 on its rust_crypto backend in place of ring, and the ES256 and RS256 assertions actual mint-token signs still verify, under OpenSSL as well as in the existing tests. rustls, rustls-webpki, quinn-proto and rand take patched releases in the lockfile.

The risk sits in the YAML swap. What a user can see change there is wording, since YAML parse errors read differently. Users get the fixes with the next release, which this PR doesn't cut, and drafts #884 and #898 also edit Cargo.toml and Cargo.lock, so whichever of them merges later rebases its lockfile.

Alerts closed

Alert	Package	Advisory	Severity	Change
1	libyml	GHSA-gfxp-f68g-8x78	high	removed with serde_yml
2	serde_yml	GHSA-hhw4-xg65-fp2x	medium	replaced by serde-saphyr 2.0.0
3	quinn-proto	GHSA-6xvm-j4wr-6v98 (CVE-2026-31812)	high	0.11.13 to 0.11.19
4	rustls-webpki	GHSA-pwjx-qhcg-rvj4	medium	0.103.9 to 0.103.16
6	rustls-webpki	GHSA-965h-392x-2mh5	low	0.103.9 to 0.103.16
7	rustls-webpki	GHSA-xgp8-3hg3-c2mh	low	0.103.9 to 0.103.16
8	rand	GHSA-cq8v-f236-94qc	low	0.9.2 to 0.9.5
9	rand	GHSA-cq8v-f236-94qc	low	0.8.5 to 0.8.8
10	rustls-webpki	GHSA-82j2-j2ch-gfr8	high	0.103.9 to 0.103.16
11	quinn-proto	GHSA-4w2j-m93h-cj5j	high	0.11.13 to 0.11.19
12	jsonwebtoken	GHSA-h395-gr6q-cpjc (CVE-2026-25537)	medium	9.3.1 to 10.4.0
13	rustls	GHSA-2mjx-qc3c-rqvc	medium	0.23.36 to 0.23.46

Read from the live alert list at 2026-10-25T23:20Z; alert 5 had already been withdrawn along with its advisory.

Test plan, choices and supporting detail

Test plan

• cargo build, cargo fmt --check, cargo clippy -- -D warnings (library only, as lint.yml runs it) and cargo check --no-default-features --lib --bins are clean.
• cargo test --workspace --features integration: 4,849 passed, 0 failed, 3 ignored.
• The coverage workflow's cargo llvm-cov command: every changed file at 100% of lines, src/yaml.rs included. The one line short anywhere is analysis/cache.rs:170, the detached-HEAD arm of get_git_branch, which only a detached checkout reaches, as on CI.
• Compatibility forward: tests/fixtures/serde_yml holds a config file covering every field, a credentials file and both caches as serde_yml 0.0.12 wrote them, each beside the JSON image of what serde_yml read it as. The config fixture carries strings that test quoting: numbers, booleans, null, ~, padding, #, : , unicode, an empty string, multi-line text and leading indicator characters. New tests read each fixture back to that image and round-trip it.
• Compatibility back: a throwaway test on main at d464a9d, not committed, read the new code's output for all four files with serde_yml into the same images.
• jwt-bearer: the 31 auth::jwt_bearer unit tests (server-style RFC 7523 verification of iss, sub, aud, lifetime, alg, kid, typ) and the 6 mint_token_cli tests pass. The debug binary also minted an ES256 and an RS256 assertion against a local token endpoint: both requests posted the jwt-bearer grant and the requested scope, both headers and claims were as expected, and OpenSSL 3.0.13 printed Verified OK for both signatures with the matching public keys.
• New crates in the lockfile (serde-saphyr, its parser and the jsonwebtoken backend crates, 23 versions in all) match no open GitHub advisory, by the same query that returns the old versions' advisories.

Choices

• serde-saphyr over serde_yaml (deprecated), serde_yaml_ng and serde_norway (no release since 2024) and serde_yaml_bw, which still emits through a C-to-Rust translation of libyaml like the one these alerts flag. It has no Value type, so the two lenient cache fields in Config read through serde_json::Value, with non-finite floats passed through as null so a stray .nan drops the cache block, not the whole config.
• Errors from the YAML readers carry no source snippet, since the config and credentials files hold API keys and tokens and a snippet quotes the lines around the error.
• rust_crypto over aws_lc_rs: it adds no C toolchain to the four release targets, and its rsa, p256 and hmac crates were already in the lockfile.
• quinn-proto and the rand 0.10 it now pulls are in the lockfile only through reqwest's weak quinn?/ring feature reference; cargo tree finds no consumer, so the bump changes no compiled code.
• The deprecated serde_yaml 0.9 behind semgrep rule merging and rule-file parsing stays, since no alert names it.
• Older open PRs on the same files: Dependabot version bumps build(deps): bump sha2 from 0.10.9 to 0.11.0 #774, build(deps): bump zip from 2.4.2 to 8.6.0 #781, build(deps): bump similar from 2.7.0 to 3.1.0 #782 and build(deps): bump the rust-minor-patch group across 1 directory with 16 updates #800 (April to June) touch the lockfile, and feat: observer CLI — canonicalization, boundaries, hooks, setup #816 and feat: AskUserQuestion hook interceptor for clarification resolution #825 add modules beside the one this adds to src/lib.rs.

---

Generated by the operator's software factory.
• City: city · Agent: local-core__builder-ci-wisp-xylofy
• On behalf of: @austinborn