Skip to content

deps(deps): bump the serde-stack group across 1 directory with 2 updates#43

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde-stack-bb1cec214b
Open

deps(deps): bump the serde-stack group across 1 directory with 2 updates#43
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde-stack-bb1cec214b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the serde-stack group with 2 updates in the / directory: serde_json and bincode.

Updates serde_json from 1.0.145 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

v1.0.149

  • Align arbitrary_precision number strings with zmij's formatting (#1306, thanks @​b41sh)

v1.0.148

  • Update zmij dependency to 1.0

v1.0.147

  • Switch float-to-string algorithm from Ryū to Żmij for better f32 and f64 serialization performance (#1304)

v1.0.146

Commits
  • a1ae73a Release 1.0.150
  • 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
  • 2037b63 Reject non-string enum object keys
  • 5d30df6 Resolve manual_assert_eq pedantic clippy lint
  • dc8003a Raise required compiler for preserve_order feature to 1.85
  • a42fa98 Unpin CI miri toolchain
  • 684a60e Pin CI miri to nightly-2026-02-11
  • 7c7da33 Raise required compiler to Rust 1.71
  • acf4850 Simplify Number::is_f64
  • 6b8ceab Resolve unnecessary_map_or clippy lint
  • Additional commits viewable in compare view

Updates bincode from 1.3.3 to 2.0.1

Commits

@dependabot @github

dependabot Bot commented on behalf of github Apr 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@augmentcode

augmentcode Bot commented Apr 27, 2026

Copy link
Copy Markdown
🤖 Augment PR Summary

Summary: Updates core serialization dependencies in the workspace.

Changes:

  • Bumped serde_json from 1.0.145 to 1.0.149.
  • Upgraded bincode from 1.3.3 to 2.0.1 at the workspace level.
  • Adjusted foundry and scaling crate manifests to depend on bincode 2.x.

Technical Notes: bincode 2 is a major release with a new API surface and explicit configuration; confirm migrations and format-compatibility requirements for any persisted or networked data.

🤖 Was this summary useful? React with 👍 or 👎

@augmentcode augmentcode Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 2 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

Comment thread Cargo.toml
libp2p-yamux = { version = "=0.45.2" } # 2025-11-16 sw: Yamux multiplexer
multiaddr = { version = "=0.18.2" } # 2025-11-16 sw: Multiaddr /ip4/... format
bincode = { version = "=1.3.3" } # 2025-11-16 sw: Binary serialization for gossip messages
bincode = { version = "=2.0.1" } # 2025-11-16 sw: Binary serialization for gossip messages

@augmentcode augmentcode Bot Apr 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Upgrading to bincode 2 is a major API change (v2 replaces bincode::serialize/deserialize with bincode::serde::encode_*/decode_* and requires passing an explicit Configuration). Since bincode is used for gossip messages, snapshots, and sled state across the workspace, please ensure all call sites migrate and that a deliberate config (e.g., bincode::config::legacy()) is pinned anywhere format compatibility matters.

Severity: high

Other Locations
  • crates/foundry/Cargo.toml:11
  • crates/scaling/Cargo.toml:26

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

Comment thread Cargo.toml Outdated
# Tier 0 — cryptography, serialization, dedup core (2025-11-03 sw; see docs/dependency-security.md#tier-0)
serde = { version = "=1.0.228", features = ["derive"] } # 2025-11-03 sw: canonical serialization; CT reviewed
serde_json = { version = "=1.0.145" } # 2025-11-03 sw: deterministic JSON for protocol surfaces
serde_json = { version = "=1.0.149" } # 2025-11-03 sw: deterministic JSON for protocol surfaces

@augmentcode augmentcode Bot Apr 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

serde_json 1.0.149 changes float-to-string formatting internals (Ryū → Żmij) and also tweaks arbitrary_precision number string formatting; if any JSON output is used as canonical bytes for hashing/signing or protocol compatibility, this bump could change results. Consider validating any protocol/persistence paths that rely on deterministic JSON serialization.

Severity: low

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

@dependabot dependabot Bot changed the title deps(deps): bump the serde-stack group with 2 updates deps(deps): bump the serde-stack group across 1 directory with 2 updates May 7, 2026
@dependabot dependabot Bot force-pushed the dependabot/cargo/serde-stack-bb1cec214b branch from aabf006 to efd5879 Compare May 7, 2026 22:57
Bumps the serde-stack group with 2 updates in the / directory: [serde_json](https://github.com/serde-rs/json) and [bincode](https://github.com/bincode-org/bincode).


Updates `serde_json` from 1.0.145 to 1.0.150
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.145...v1.0.150)

Updates `bincode` from 1.3.3 to 2.0.1
- [Commits](https://github.com/bincode-org/bincode/commits)

---
updated-dependencies:
- dependency-name: bincode
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: serde-stack
- dependency-name: serde_json
  dependency-version: 1.0.149
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: serde-stack
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/cargo/serde-stack-bb1cec214b branch from efd5879 to 86d8918 Compare May 25, 2026 03:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants