From ab878233e69834e820cc5923894e8b091de91180 Mon Sep 17 00:00:00 2001
From: Claude Code <github@thedreamlab.uk>
Date: Sat, 17 Oct 2026 10:11:17 +0000
Subject: [PATCH] =?UTF-8?q?fix(ci):=20clear=20RustSec=20advisories=20?=
 =?UTF-8?q?=E2=80=94=20rustls,=20quinn-proto,=20unmaintained=20serde=5Fyam?=
 =?UTF-8?q?l?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bump quinn-proto 0.11.19 and rustls 0.23.46+ via cargo update. Replace the
unmaintained serde_yaml (unsafe-libyaml, RUSTSEC-2024-0449/0320) with the
API-compatible serde_norway, which uses unsafe-libyaml-norway. No ignores added.

Co-Authored-By: jjohare <github@thedreamlab.uk>
---
 Cargo.lock                                | 42 +++++++++++------------
 crates/solid-pod-rs/Cargo.toml            |  4 +--
 crates/solid-pod-rs/src/config/sources.rs |  2 +-
 3 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index af85dba..33247fd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3139,9 +3139,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.17"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "bytes",
  "getrandom 0.4.3",
@@ -3507,9 +3507,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "once_cell",
  "ring",
@@ -3694,6 +3694,19 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_norway"
+version = "0.9.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e408f29489b5fd500fab51ff1484fc859bb655f32c671f307dcd733b72e8168c"
+dependencies = [
+ "indexmap 2.14.0",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml-norway",
+]
+
 [[package]]
 name = "serde_path_to_error"
 version = "0.1.20"
@@ -3768,19 +3781,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "serde_yaml"
-version = "0.9.34+deprecated"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
-dependencies = [
- "indexmap 2.14.0",
- "itoa",
- "ryu",
- "serde",
- "unsafe-libyaml",
-]
-
 [[package]]
 name = "sha1"
 version = "0.10.7"
@@ -3926,7 +3926,7 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_norway",
  "sha2",
  "solid-pod-rs",
  "solid-pod-rs-server",
@@ -4862,10 +4862,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
 [[package]]
-name = "unsafe-libyaml"
-version = "0.2.11"
+name = "unsafe-libyaml-norway"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+checksum = "b39abd59bf32521c7f2301b52d05a6a2c975b6003521cbd0c6dc1582f0a22104"
 
 [[package]]
 name = "unsigned-varint"
diff --git a/crates/solid-pod-rs/Cargo.toml b/crates/solid-pod-rs/Cargo.toml
index 2ef306d..5131781 100644
--- a/crates/solid-pod-rs/Cargo.toml
+++ b/crates/solid-pod-rs/Cargo.toml
@@ -96,7 +96,7 @@ rand = { version = "0.8", optional = true }
 # Sprint 11 (row 120-124): multi-format config loader. YAML + TOML are
 # optional so consumers that only care about JSON aren't dragged in.
 # Gated behind `config-loader`.
-serde_yaml = { version = "0.9", optional = true }
+serde_norway = { version = "0.9", optional = true }
 toml = { version = "0.8", optional = true }
 
 [features]
@@ -184,7 +184,7 @@ dpop-symmetric-test = []
 # Sprint 11 (row 120-124): extends with auto-detected YAML/TOML file
 # loading, env overlay, and CLI overlay. YAML/TOML deps are pulled in
 # only when this feature is enabled.
-config-loader = ["jss-v04", "dep:serde_yaml", "dep:toml"]
+config-loader = ["jss-v04", "dep:serde_norway", "dep:toml"]
 
 # Sprint 6 C: RFC 9421 HTTP Message Signatures on outgoing webhook
 # deliveries, Retry-After handling, circuit breaker. Consumers opt in.
diff --git a/crates/solid-pod-rs/src/config/sources.rs b/crates/solid-pod-rs/src/config/sources.rs
index dac1d94..3ce4677 100644
--- a/crates/solid-pod-rs/src/config/sources.rs
+++ b/crates/solid-pod-rs/src/config/sources.rs
@@ -117,7 +117,7 @@ fn load_file(path: &Path) -> Result<Value, PodError> {
 
     let v: Value = match ext.as_deref() {
         #[cfg(feature = "config-loader")]
-        Some("yaml") | Some("yml") => serde_yaml::from_str(&content).map_err(|e| {
+        Some("yaml") | Some("yml") => serde_norway::from_str(&content).map_err(|e| {
             PodError::Backend(format!("config file {path:?} is not valid YAML: {e}"))
         })?,