[dependabot]

Updates the requirements on serde-saphyr to permit the latest version.

Release notes

Sourced from serde-saphyr's releases.

2.0.0 Performance and compliance release

Breaking changes

• There is a new capture_comments feature that is default on and can be disabled, winning about 10 % percent of performance. This feature was the main reason to advance the first version digit, because formally this is a breaking change.
• Preserving inner error in alias errors in the newly added field in AliasError. The old field (text representation) is still present, but deprecated. Another formally breaking change, even if unlikely to be a problem.
• from_multiple, from_multiple_with_options, from_slice_multiple, and from_slice_multiple_with_options now accept T: Deserialize<'de> instead of T: DeserializeOwned, allowing values to borrow from the input. Direct calls require no changes. Function pointers or callbacks may need adjustments.
• granit_parser 2.0.0 has some corner formally breaking changes, but mostly in very obscure parts (see its changelog for details).

All other changes are backward compatible:

• For projects aiming for very strict YAML compliance rather than drop-in compatibility with mainstream libraries, it is not possible to disable all compromises with strict_indentation flag in Options.
• Value serialization target can now receive Inf and NaN if so configured. Even if most common serde_json::Value cannot take them (produces null instead), many other abstract value receivers can.
• Made huge_documents and serde_derived_types enable deserialize, fixing isolated feature builds with --no-default-features, including autopkgtests of Debian team (as observed).
• Fix borrow support for untagged enum (PR #195, thanks @​Guiguiprim ).
• Added SerializerOptions::no_lang_directive (default false) to suppress the %YAML 1.2 directive independently of yaml_12's quoting (requirement obvious from Nushell code work work arrounds).
• Property interpolation can now be configured to be fully Docker Compose compliant if preferred (we are not fans of undefined property defaulting to empty but may be opinion-based).
• It is possible to deserialize multiple documents into collection other than vector: serde_saphyr::from_str_multiple supports any collection implementing Default + Extend<T>, such as Vec<T>, VecDeque<T>, BTreeSet<T>, or custom storage like SmallVec<T>.

Other fixes

• Keep span offsets relative to the caller's input after a BOM (#212)
• Compare mapping keys regardless of entry order (#211)
• Report a collection where &str is expected, not end of input (#210)
• Replace non-printable characters in Commented comments (#209)
• Implement dedicated YAML trim (#206). Default Rust trim() considers special Unicode whitespace chars that YAML calls to be ignored.
• Improve multi-snippet error rendering (#208). Do not rely on error texts for functionallity.
• Fix serializer indentation after - and ? so output reads back- #207
• Report a parser error after an implicit document end in single-document entry points- #220 #220, thanks @​pcshrosbree

Changelog

Sourced from serde-saphyr's changelog.

2.0.0

YAML changes

• Tags selecting unit enum variants now reject non-null payloads instead of silently discarding them (#236). Use a bare variant name, a tag with empty content, or a tag followed by ~ or null; quoted strings and collections are rejected.
• Composite mapping keys are not compared regardless of entry order (thanks @​yuxi-liu-wired) .
• Commented now writes its output replacing characters not allowed in comments (non printable) by spaces.

Added

• Added public path_map::PathKind, PathKey::segments(), and PathMap::locations_for() for inspecting validation paths and resolving their YAML use/definition locations, including best-effort spelling matches and recorded ancestor/root fallback.
• Added RenderOptions::line_offset and RenderOptions::source_name for displaying embedded YAML diagnostics at their containing document's line numbers and naming the root source in snippet headers, including the new miette::to_miette_report_with_options entry point. Included files retain their own names and coordinates, and stored error locations and spans are unchanged.
• Added PropertySyntax::DockerCompose for Compose-compatible property interpolation.
• Added the default-enabled comments feature, forwarding to granit-parser's matching feature. Builds with default-features = false must enable it to use Commented<T>, CommentPosition, comment options, or comment budget fields and reports. Without it, YAML comments are still accepted and validated, but their text is not retained.
• Added Options::non_finite_float_policy with NonFiniteFloatPolicy::{PassThrough, Reject, AsString} to configure non-finite floats delivered through deserialize_any. Explicit policies override the legacy boolean; leaving the field unconfigured preserves its behavior.
• Added the borrowed_context example showing recursive Serialize adapters that borrow an existing value tree and per-call formatting context, composing with Tagged<T> and style wrappers without building a second container tree or using thread-local state.
• Added SerializerOptions::no_lang_directive (default false) to suppress the %YAML 1.2 directive and its leading --- marker independently of yaml_12's quoting.
• Added from_str_multiple, from_bytes_multiple, and their _with_options variants to deserialize multiple YAML documents into any C: Default + Extend<T>, including vectors, queues, sets, and custom accumulators. Values can borrow from the input string or UTF-8 byte slice. Explicit type arguments specify both the document and collection types, for example from_str_multiple::<String, Vec<_>>(input).
• Added an error: Box<Error> field to Error::AliasError, which keeps the original error when an aliased value fails to deserialize. A custom MessageFormatter or Localizer now applies to that error, and std::error::Error::source returns it (#199).

Changed

• Breaking: from_multiple, from_multiple_with_options, from_slice_multiple, and from_slice_multiple_with_options now accept T: Deserialize<'de> so values can borrow from the input. They retain their names, single type parameter, and Vec<T> returns and are not deprecated. Ordinary calls, including from_multiple::<Config>(input) and generic callers with T: DeserializeOwned, continue to work. Function pointers or callbacks accepting arbitrary input lifetimes may need forwarding closures, such as |input| from_multiple::<String>(input).

... (truncated)

Commits

• e3a4566 Clarified borrowing usage and fixed borrowing test.
• fc4c875 Merge remote-tracking branch 'origin/master'
• e2f8eb3 Make fuzz and miri mandatory steps for release workflow. use granit-parser fr...
• 9728ccb Report a parser error after an implicit document end in single-document entry...
• fb50b1b Improve documentation
• f3f3786 Improve documentation
• d43a925 Removed some too aggressive deprecations, this is not required with the major...
• 2db1993 bw/i205 (#215)
• c09c094 Bump granit-parser from 03889c5 to f4bf73a (#216)
• 70272b7 Update cargo to use granit parser 2.0.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: cfff24fe-8630-42ca-b005-e77c1bc84eb1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}