build(deps): drop the unused serde_yaml and bump rustls

[arcaven]

The daily Security Audit has been red since 2026-10-13 because cargo-deny flags unsafe-libyaml as unmaintained (RUSTSEC-2024-0449), and it also fails the checks on open dependency PRs. This clears it by removing a dependency that nothing here uses.

serde_yaml was declared in the workspace and in the SDK crate, but no source file references it (grep over the tree finds only the two Cargo.toml lines). Dropping it removes unsafe-libyaml from Cargo.lock. So there is no YAML migration in this repo, and no behavior to compare.

While checking, cargo deny check advisories also reported four rustls advisories (RUSTSEC-2026-0346 to 0349, fixed in 0.23.46). The lock bumps rustls to 0.23.46, plus yoke-derive off a yanked release. Both are lockfile-only.

Nothing is added to the ignore list in deny.toml.

Checked locally: cargo deny check advisories ok, build, clippy with -D warnings, fmt and the workspace tests pass.

The "override toolchain 'stable-x86_64-unknown-linux-musl' is not installed" line in that job comes from the deny action's container reading rust-toolchain.toml. It is non-fatal and also appears in the last green run, so I left it alone.

[arcavenai]

Agent review (reviewer-claude). Approving. With the head's lockfile, cargo deny check advisories passes against today's advisory database. The base fails the same check on exactly the five advisories the body names. No source file uses serde_yaml, and the workspace builds and tests clean offline.

How I ran it. env -i with a scratch HOME, CARGO_HOME, CARGO_TARGET_DIR and TMPDIR. The network was used only for cargo fetch --locked and cargo deny fetch db into that scratch home. Everything after that ran under sandbox-exec with CARGO_NET_OFFLINE=true. The sandbox denied writes outside scratch, /private/tmp and /dev, denied reads of a decoy path, and allowed outbound network to localhost only. Controls:

• a home write failed with Operation not permitted;
• the decoy read was denied;
• 127.0.0.1:1 was refused;
• 1.1.1.1:443 failed with Operation not permitted.

The toolchain was rustc 1.96.0 and cargo-deny 0.19.9. The commit is signed and verified, one commit on main 72970e4.

1. unsafe-libyaml. It is gone from Cargo.lock at the head: 0 name = lines for unsafe-libyaml or serde_yaml, against 2 at the base.

2. Advisories. The database is rustsec/advisory-db at edb58f5974b83eb8302332821cb6d389777aa351 (2026-10-14T22:18:32+02:00). RUSTSEC-2024-0449 and RUSTSEC-2026-0346 to 0349 are all present in it. cargo deny check --disable-fetch advisories:

• at the head: advisories ok, exit 0;
• at the base, as the control: advisories FAILED, exit 1, naming exactly RUSTSEC-2024-0449 and RUSTSEC-2026-0346, 0347, 0348 and 0349.

deny.toml is not in the diff. Its ignore list still holds only the existing RUSTSEC-2024-0436 entry.

3. No source use. git grep -E 'serde_yaml|serde_yml|serde-yaml' over every .rs file at the head finds nothing. That covers 31 files, including the one build.rs, crates/stave-sdk/build.rs. Over every file at the head it also finds nothing. Controls: the same pattern at the base finds the two manifest lines (Cargo.toml:23 and crates/stave-sdk/Cargo.toml:19), and serde_json is found in the .rs files at the head. The only yaml in Rust source is emit.rs:260, a test that --format yaml is refused as an unknown format.

4. Build and tests offline. cargo build --locked --workspace --all-targets exits 0. cargo test --locked --workspace gives 19 result lines, 376 passed, 0 failed, 2 ignored. Every check at this head is green, including Cargo Deny, Advisory Check, Clippy and Test on Linux and macOS.

Lockfile, all of it. The manifests change by the two removed serde_yaml lines only. In Cargo.lock:

• serde_yaml and unsafe-libyaml are removed;
• rustls goes from 0.23.45 to 0.23.46, and yoke-derive from 0.8.3 to 0.8.4;
• one change the body does not mention: six packages (errno, quinn-udp, rustix, rustls-platform-verifier, tempfile, winapi-util) now take their windows-sys from 0.61.2 instead of 0.52.0.

Both windows-sys versions stay in the lock, the change is lockfile-only, and it affects Windows targets only. So "lockfile-only" holds for every change.