deps: parse compose files with yaml_serde instead of serde_yaml_ng

.cargo/audit.toml

@@ -4,6 +4,4 @@
 # is written in deny.toml. tests/audit_ignore_lists.rs keeps the two equal.
 
 [advisories]
-ignore = [
-    "RUSTSEC-2024-0449",
-]
+ignore = []

Cargo.toml

@@ -76,7 +76,7 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "env-filter"] }
-serde_yaml = { package = "serde_yaml_ng", version = "0.10" }
+serde_yaml = { package = "yaml_serde", version = "0.10" }
 hyper = { version = "1", features = ["client", "http1"] }
 hyper-util = { version = "0.1", features = ["tokio"] }
 http-body-util = "0.1"

deny.toml

@@ -10,15 +10,8 @@ all-features = true
 [advisories]
 version = 2
 yanked = "deny"
-# RUSTSEC-2024-0449: unsafe-libyaml 0.2.11 is unmaintained. It is not a
-# known vulnerability. It comes in through serde_yaml_ng 0.10.0, the latest
-# release, so no bump clears it. What it parses is the compose file of the
-# person running podup. Moving off it is #2035, and that pull request
-# removes this entry and the one in .cargo/audit.toml.
-# tests/audit_ignore_lists.rs keeps the two lists equal.
-ignore = [
-    { id = "RUSTSEC-2024-0449", reason = "unmaintained, not a known vulnerability; pulled by serde_yaml_ng 0.10.0, the latest release; see #2035" },
-]
+# tests/audit_ignore_lists.rs keeps this list and .cargo/audit.toml equal.
+ignore = []
 
 [licenses]
 version = 2

internal/compose/merge.rs

@@ -9,7 +9,7 @@ use crate::error::{ComposeError, Result};
 use std::collections::{HashMap, HashSet};
 
 /// Upper bound on YAML alias references in a document that uses anchors, and on
-/// the size of such a document. serde_yaml_ng already aborts deeply *nested*
+/// the size of such a document. yaml_serde already aborts deeply *nested*
 /// alias expansion (its repetition limit), but a flat document with many alias
 /// references to a non-trivial anchor expands *linearly* while the `Value` tree
 /// is built and can exhaust memory: a ~46 KB file can allocate gigabytes. Real
@@ -25,7 +25,7 @@ const MAX_ALIAS_DOC_BYTES: usize = 512 * 1024;
 /// leaving real compose files untouched.
 const MAX_ALIAS_EXPANSION_BYTES: usize = 4 * 1024 * 1024;
 
-/// Upper bound on flow-style nesting depth (`[`/`{`). serde_yaml_ng's own
+/// Upper bound on flow-style nesting depth (`[`/`{`). yaml_serde's own
 /// recursion cap eventually rejects pathological nesting, but its tokenizer is
 /// O(n^2) in the depth it scans, so a small file of deeply nested flow
 /// collections (`[[[[…]]]]`) can burn quadratic CPU time before that cap fires.
@@ -281,8 +281,8 @@ fn guard_flow_depth(content: &str) -> Result<()> {
 
 /// Count YAML alias references (`*anchor`) outside quoted scalars and comments.
 ///
-/// `serde_yaml_ng`'s event stream is not part of its public API
-/// (`Event::Alias` is `pub(crate)` in `serde_yaml_ng::de`), so we hand-roll a
+/// `yaml_serde`'s event stream is not part of its public API
+/// (`Event::Alias` is `pub(crate)` in `yaml_serde::de`), so we hand-roll a
 /// state machine that mirrors the YAML 1.2 lexer just closely enough to know
 /// where a `*name` could legally be an alias. The previous scanner toggled
 /// `in_single` on every `'` regardless of position inside a plain scalar,
@@ -366,7 +366,7 @@ fn count_alias_refs(content: &str) -> usize {
 
 /// Recursively resolve YAML merge keys (`<<: *anchor`) in a `Value` tree.
 ///
-/// serde_yaml_ng does not expose `apply_merge()`, so this replaces it.
+/// This resolves them itself rather than through the parser's `apply_merge()`.
 /// Merge semantics: keys from the anchor fill in only where the child has no value.
 fn apply_merge_keys(value: &mut serde_yaml::Value) {
 	match value {

internal/compose/merge_tests.rs

@@ -88,7 +88,7 @@ fn guard_allows_normal_anchored_file() {
 
 #[test]
 fn guard_rejects_linear_alias_amplification() {
-	// Many references to one anchor: the OOM vector serde_yaml_ng does not bound.
+	// Many references to one anchor: the OOM vector yaml_serde does not bound.
 	let mut yaml = String::from("anchor: &a [x, y, z]\nlist:\n");
 	for _ in 0..(MAX_ALIAS_REFS + 50) {
 		yaml.push_str("  - *a\n");

internal/startup/config_normalize.rs

@@ -92,7 +92,7 @@ fn normalize_lexically(path: &Path) -> String {
 /// Quote any plain (unquoted) YAML scalar value that a strict YAML 1.1 reader
 /// would misparse as a boolean (`yes`/`no`/`on`/`off`/`y`/`n`/`true`/`false`),
 /// leaving already-quoted scalars, keys, and everything else untouched. Works on
-/// serde_yaml_ng's block output, where each scalar value sits after a `: `
+/// yaml_serde's block output, where each scalar value sits after a `: `
 /// mapping separator or a `- ` sequence marker on its own line.
 pub(super) fn quote_yaml11_booleans(yaml: &str) -> String {
 	let lines: Vec<String> = yaml.lines().map(requote_bool_line).collect();

internal/startup/config_render.rs

@@ -150,7 +150,7 @@ pub(crate) fn render_config_to<W: Write>(
 				serde_yaml::to_value(&redacted).map_err(podup::ComposeError::Parse)?;
 			prune_yaml_nulls(&mut v);
 			let yaml = serde_yaml::to_string(&v).map_err(podup::ComposeError::Parse)?;
-			// serde_yaml_ng emits YAML 1.2, where `yes`/`no`/`on`/`off` are plain
+			// yaml_serde emits YAML 1.2, where `yes`/`no`/`on`/`off` are plain
 			// strings and stay unquoted. A strict YAML 1.1 reader (docker compose's
 			// emitter among them) would misread those as booleans, so quote any
 			// string scalar that looks like a YAML 1.1 boolean to match.