chore(deps): bump serde_with 3.20.0 → 3.21.0 in src-tauri#345
Merged
Conversation
Fixes a Dependabot alert: KeyValueMap serialization in serde_with < 3.21.0 panics on an empty inner sequence/map entry (subtracts 1 from the length before validating there is a key field). Transitive dep — lockfile-only bump via `cargo update -p serde_with --precise 3.21.0` (also bumps serde_with_macros and prunes three now-unused windows-* crates).
Member
|
Claude finished @sonegillis1's task —— View job E2E Coverage Review
|
mamigot
approved these changes
Jul 16, 2026
mamigot
left a comment
mamigot
left a comment
Member
There was a problem hiding this comment.
✅ E2E Coverage — No Issues
No new app routes were introduced. All existing coverage is intact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
serde_with3.20.0 → 3.21.0insrc-tauri/Cargo.lockto clear the Dependabot alert (serde_with #243 —KeyValueMapserialization panics on an empty inner sequence/map entry; it subtracts 1 from the caller-visible length before validating a key field exists, so attacker-controlled data serialized through#[serde_as(as = "KeyValueMap<_>")]can crash the app).Details
serde_withis a transitive dependency (not inCargo.toml), so this is a lockfile-only change viacargo update -p serde_with --precise 3.21.0.serde_with_macros 3.20.0 → 3.21.0and prunes three now-unused crates (windows-core/windows-result/windows-strings) — normal resolver cleanup.Validated:
cargo updateresolved cleanly (semver-compatible) and a localcargo checkonsrc-tauricompiles. Note the PR CI gate doesn't build Rust, so the Tauri build is validated on the next native build.🤖 Generated with Claude Code