[dependabot]

Bumps noyalib from 0.0.28 to 0.0.58.

Release notes

Sourced from noyalib's releases.

noyalib 0.0.58

Highlights ⭐️

• Hardened parser, CST and loader boundaries: cst::Document edits re-parse under the document's own configuration, so a YAML 1.1 yes can no longer slip past duplicate-key detection, and !include and ${...} expansion now count against max_total_scalar_bytes. CST parses and edits run Policy::check_value, the load_all, read_with_config and no_std paths run the shared !include, ${...} and policy pipeline, the tokio decoder no longer splits a document at a --- that ends a read buffer, and figment::Yaml::file rejects directories, FIFOs and oversized files before reading.
• Located unknown and missing field errors: an unknown field or missing field rejected by from_str now carries its line, column and field path (deserialization error at line 3, column 10: server.porrt: unknown field: porrt), as type mismatches already did. A fix from @​or1can. from_value still returns the bare Error::UnknownField and Error::MissingField.
• MSRV is now Rust 1.89.0 across the family: the core library and every satellite share one minimum supported Rust version (ADR-0014); if you are pinned below 1.89, stay on v0.0.57. The msrv-core job now builds on 1.89 instead of stable, and scripts/verify-release-versions.sh checks all 32 MSRV statements in the tree against rust-version.
• serde_yaml_ng retired from dev-dependencies: it depends on unsafe-libyaml, which RUSTSEC-2024-0449 marks unmaintained, so the YAML test suite harness now reads its case files with yaml-rust2 (the same 406 cases from all 351 files) and cargo deny passes with no advisory ignores. tokio is at 1.53.2.

What's Changed

• fix(de): locate unknown and missing field errors from from_str by @​or1can in sebastienrousseau/noyalib#482
• release: v0.0.58 (MSRV 1.89) by @​sebastienrousseau in sebastienrousseau/noyalib#481

New Contributors

• @​or1can made their first contribution in sebastienrousseau/noyalib#482

Checksums

SHA-256 of every asset attached to this release:

07759abb162c52d73b244ef52f04de240af97a069531cc9845a8e9560d98f535  SBOM.cdx.json
cff9290ef1595f71cba720ebb35642d1d43f13e58113167056fd460a623041b8  SBOM.cdx.json.asc
8043a3209b30d41eb00f56f03dc1564066b9a5c33e800aaef6cabd188c3019b4  SBOM.cdx.json.bundle
d634fe23a6bb98e9022ad9302e0c7500e30c3ec6c78a9093e067e166d8224887  SBOM.txt
8c8b7dde6eff54324ed8a6c26e9c132487930dc114d06c31441d927ba5360763  SBOM.txt.asc
fe99735ed338e81a0d284b713f241aa4b02b9490d562042b11632efa5dedeeb4  SBOM.txt.bundle
f184a9e928dea463f8a21a2a8264a9a5d97741671ba1dd2e158d29166d1e657c  SHA256SUMS.txt
ece68f388dc7be8b8d864c972cda666997a8dcfea9506743b7c680b4009fd02d  SHA512SUMS.txt
3fad8f1a552070f6ba5f60f25e880f7b6daeda8fe138f589345141d31a21a3bb  noyalib-0.0.58.crate
f899c6f6d454913c85a539b4deab5bedd5d13e1b71cfbf37a2f2580e8dab48c8  noyalib-0.0.58.crate.asc
7590dfa0a88ab05329c88d3bff8e15fae223e06a2a7e60e22879365123d05dd3  noyalib-0.0.58.crate.bundle

Full Changelog: sebastienrousseau/noyalib@v0.0.57...v0.0.58

noyalib 0.0.57

Highlights ⭐️

• Closer to the spec, found by differential fuzzing: six parse fixes from running noyalib against serde_yaml_ng and libyaml. A plain scalar whose line ends in a space now continues on the next line, an anchor on an empty list item no longer swallows the next item, and folded scalars, escaped line breaks and radix integers follow YAML 1.2 exactly.
• Typed parses read keys as written: a tag elsewhere in the document no longer changes how a typed parse spells a key, so a YAML 1.1 on: key reaches a struct field named on. Duplicate-key checks treat ~ and null, or 0x1F and 31, as the same key on every path.
• Safer CST edits: cst::format keeps NEL, NBSP and other Unicode spaces that YAML reads as content, and two fixes from @​zoosky make removing or overwriting an alias-valued entry, and recursing into an anchored collection, act on the right bytes.
• Breaking parse behaviour: 0X1F and 0x-1 load as strings, folded scalars keep whitespace-only lines indented past their content, a control character in a comment is an error, empty lines after an escaped break are line feeds, and - &a\n- x loads as two items.

What's Changed

• release: v0.0.57, closer to the spec by @​sebastienrousseau in sebastienrousseau/noyalib#478

Checksums

SHA-256 of every asset attached to this release:

... (truncated)

Changelog

Sourced from noyalib's changelog.

[v0.0.58] - 2026-10-15

Security

• cst::Document mutators now re-parse under the document's own configuration. Document::set, replace_collection_value, append_first_entry, guarded_insert, and duplicate_keys_present previously re-parsed the edited buffer with default YAML 1.2 settings instead of self.config, allowing YAML 1.1 scalar aliases (such as yes colliding with true) to bypass duplicate-key detection or trigger false-positive shape rollbacks.
• cst::coerce_to_schema now quotes JSON Pointer segments with path::push_key, requires a string leaf, and skips no-op edits. Keys containing . or [ are bracket-quoted instead of concatenated raw into the CST path, non-string targets are skipped, and values whose coerced form equals the current source text no longer repeat up to the 1,024-iteration cap.
• !include resolution and ${...} property interpolation now enforce max_total_scalar_bytes. IncludeWalk charges scalar bytes across every resolved source (before #fragment narrowing discards sibling entries) and re-checks the combined document tree after substitution; apply_properties bounds expanded scalar text against config.max_total_scalar_bytes.
• tokio_async::YamlDecoder now waits for one lookahead byte past a chunk-ending --- before splitting. A --- at the end of a non-EOF read buffer could be the prefix of a plain scalar or mapping key such as ---: value; next_marker_after_streaming defers the boundary decision until the fourth byte or EOF arrives and rewinds the scan cursor by three bytes.
• Cross-entry-point policy, post-processing, and deserializer option parity. cst::parse_document_with_config, Document::replace_span, and Document::validate now run Policy::check_value; load_all_with_config, load_all_as_with_config, read_with_config, from_str_typed_no_tag_preserve, and the no_std branch of from_str_with_config all run the shared post_process_document pipeline (!include, ${...}, and Policy::check_value) and honour ignore_binary_tag_for_string, plain_scalar_strings, and SpanContext.
• figment::Yaml::file and file_with_config now verify regular-file and length metadata before reading. Non-regular files (directories, FIFOs, device nodes) and regular files larger than max_document_length are rejected via metadata() before reading.

Fixed

• An unknown or missing field rejected by from_str now carries a location and a field path, as a type mismatch or a visitor's own error already did: deserialization error at line 3, column 10: server.porrt: unknown field: porrt. A deny_unknown_fields derive rejects the field while reading its key, so that error is located at

... (truncated)

Commits

• 7529f1b release: v0.0.58, hardened boundaries, MSRV 1.89
• 7f2a72b docs: date v0.0.58 and finish its Highlights
• 78d89a6 docs: measure the ecosystem table for 0.0.58
• 1c84f18 fix(ci): shrink expand_placeholders and gate test
• df65eb7 fix(security): harden parser, CST, and loader boundaries
• aa56969 docs(release): refresh internals.md and add PR #482 to v0.0.58 notes
• e152e93 Merge pull request #482 from or1can/fix/locate-unknown-and-missing-field
• bbaddab chore(release): bump noyalib to v0.0.58
• 0c54c2c fix(de): locate unknown and missing field errors from from_str
• 5fbdcdb chore(deps): retire serde_yaml_ng
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.