Repository navigation
Replace deprecated serde_yaml with serde-saphyr in compiletest - #5012
Open
jadhavgaurav wants to merge 1 commit into
Open
jadhavgaurav wants to merge 1 commit into
jadhavgaurav wants to merge 1 commit into
Conversation
serde_yaml is deprecated and pulls in the unmaintained unsafe-libyaml (RUSTSEC-2024-0449). Parse the exec-mode config.yml with serde-saphyr instead and drop the matching deny.toml advisory ignore. encoding_rs (BSD-3-Clause, via serde-saphyr) gets a license exception since compiletest is not shipped. Resolves model-checking#5000 Signed-off-by: Gaurav Jadhav <gaurav.vjadhav01@gmail.com>
github-actions
Bot
added
Z-EndToEndBenchCI
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The migration is narrowly scoped to test tooling, preserves configuration handling, and has no identified blocking issues.
0 open findings
What changed in this PR
Replaces compiletest’s deprecated YAML parser with serde-saphyr, removing the dependency behind issue #5000 without changing configuration error handling.
Changes:
- Uses
serde-saphyrwith deserialization only. - Removes the obsolete advisory ignore and adds an
encoding_rslicense exception. - Updates the dependency lockfile.
| File | Description |
|---|---|
tools/compiletest/src/runtest.rs |
Switches the configuration parser. |
tools/compiletest/Cargo.toml |
Replaces the YAML dependency. |
deny.toml |
Updates advisory and license policy. |
Cargo.lock |
Records replacement dependencies and removes the deprecated parser. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #5000
serde_yamlis deprecated and pulls inunsafe-libyaml(RUSTSEC-2024-0449). compiletest only used it to read theconfig.ymlof exec-mode tests. This PR switches that one call toserde-saphyr(the crate the advisory suggests) and removes the advisory entry fromdeny.toml.Changes:
tools/compiletest:serde_yamlreplaced byserde-saphyrwith only thedeserializefeature (no serializer, so fewer transitive crates). The call site is the samefrom_readerintoExecConfig, and the "couldn't parseconfig.yml" error path is unchanged.deny.toml: removed theRUSTSEC-2024-0449ignore. Added a license exception forencoding_rs(BSD-3-Clause), whichserde-saphyrneeds for input decoding. It has the same shape as the existingfoldhashexception, and compiletest is not shipped.Cargo.lockupdated accordingly.Testing done by hand:
cargo build -p compileteston the pinned nightly succeeds.config.ymlfiles undertests/with bothserde_yaml0.9 andserde-saphyrinto the same struct asExecConfig: all parse, and the results are identical.Not run locally:
cargo deny check(cargo-deny is not installed here), so the advisory removal and the new license exception rely on CI to confirm. I also did not run the full exec-mode suites, which need a built Kani.AI assistance: this change was prepared with an AI coding assistant and reviewed and tested by me.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.