chore(deps): bump the cargo group across 1 directory with 1 update

[dependabot]

Bumps the cargo group with 1 update in the /etc/state-sum directory: serde_with.

Updates serde_with from 3.18.0 to 3.21.0

Release notes

Sourced from serde_with's releases.

serde_with v3.21.0

Security

• GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

  Thanks to @​7thParkk for reporting the issue.

Added

• Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

• Re-enable link-to-definition on docs.rs (#964)

Fixed

• Fix some doc links to point to the correct types (#963)
• Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

Commits

• 0f4ca67 Update changelog for 3.21.0 (#967)
• 7654841 Update changelog for 3.21.0
• c8a1d82 Protect all collection creations against capacity overflow by using `size_hin...
• 6ad5fa5 Properly feature gate the vec_with_capacity_cautious function
• ef7d141 Protect all collection creations against capacity overflow by using `size_hin...
• a348da3 Add serde_as deserialize_as explain (#958)
• 2e5bc20 Bump the github-actions group with 3 updates (#965)
• 927a3d6 Bump the github-actions group with 3 updates
• 62d14ec Enable link-to-definition on docs.rs again, after the upstream issue was reso...
• 4584d94 Enable link-to-definition on docs.rs again, after the upstream issue was reso...
• Additional commits viewable in compare view

Updates serde_with from 3.20.0 to 3.21.0

Release notes

Sourced from serde_with's releases.

serde_with v3.21.0

Security

• GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

  Thanks to @​7thParkk for reporting the issue.

Added

• Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

• Re-enable link-to-definition on docs.rs (#964)

Fixed

• Fix some doc links to point to the correct types (#963)
• Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

Commits

• 0f4ca67 Update changelog for 3.21.0 (#967)
• 7654841 Update changelog for 3.21.0
• c8a1d82 Protect all collection creations against capacity overflow by using `size_hin...
• 6ad5fa5 Properly feature gate the vec_with_capacity_cautious function
• ef7d141 Protect all collection creations against capacity overflow by using `size_hin...
• a348da3 Add serde_as deserialize_as explain (#958)
• 2e5bc20 Bump the github-actions group with 3 updates (#965)
• 927a3d6 Bump the github-actions group with 3 updates
• 62d14ec Enable link-to-definition on docs.rs again, after the upstream issue was reso...
• 4584d94 Enable link-to-definition on docs.rs again, after the upstream issue was reso...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Security Scan - Code

Severity: HIGH, CRITICAL

No vulnerabilities found

View scan results

Report Summary

┌─────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│                   Target                    │    Type    │ Vulnerabilities │ Misconfigurations │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ Cargo.lock                                  │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/Cargo.lock      │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/fuzz/Cargo.lock │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/state-sum/Cargo.lock                    │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/tps/package-lock.json                   │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ rayls-contracts/package-lock.json           │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/chaos-network/Dockerfile                │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-network/Dockerfile               │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-replay/Dockerfile                │ dockerfile │        -        │         0         │
└─────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

[github-actions]

Claude finished @kstoykov's task in 2m 30s —— View job

---

PR Review - serde_with bump 3.18.0 → 3.21.0

• Gather context
• Review changed files
• Assess security implications
• Post final review

---

Summary

This PR does more than the title suggests. While it's labeled as bumping serde_with, it also silently includes a major version upgrade of rand from 0.9 → 0.10 in the root Cargo.toml. Both changes are reviewed below.

---

serde_with 3.18.0 → 3.21.0

Security fix included — this part should be merged promptly.

• GHSA-7gcf-g7xr-8hxj (High): KeyValueMap deserialization would panic when receiving attacker-controlled empty sequences or maps due to unbounded allocation. Fixed in 3.21.0 by capping allocation size via size_hint. This is a denial-of-service vector if serde_with's KeyValueMap is used to deserialize untrusted input.
• New bs58 optional dependency added (used for base58 encoding support).
• serde_with_macros now uses syn 2.x — good reduction of the legacy syn 1.x footprint.
• Security scan confirms 0 vulnerabilities across all lockfiles after the bump.

---

rand 0.9 → 0.10 (Cargo.toml:210)

This is a major version bump not mentioned in the PR description, worth explicit attention.

What changed:

• rand 0.10 replaces rand_chacha with a direct chacha20 dependency as the default CSPRNG backend.
• Introduces rand_core 0.10.1 and chacha20 0.10.1 as new transitive deps.
• Both rand 0.9.5 and rand 0.10.2 now coexist in the lock files (expected — different semver-incompatible consumers in the dep tree).

API compatibility: The codebase uses rand::rng(), Rng::random_range(), Rng::fill_bytes(), SeedableRng, StdRng, and seq::IteratorRandom — all present and unchanged in rand 0.10. No breaking API usage detected.

Potential concern — rand_chacha = "0.9" vs rand = "0.10":
rand_chacha 0.9 uses rand_core 0.9, while rand 0.10 uses rand_core 0.10. These are incompatible trait versions. This is safe as long as rand_chacha types are never passed across API boundaries into rand 0.10 consumers. Checking the codebase: rand_chacha is declared in the workspace and pulled by e2e-tests, but no source file actually imports it (use rand_chacha::... is absent). The declaration appears unused — worth cleaning up with Fix this →.

---

Other lock file changes

Change	Assessment
rand 0.9.4 → 0.9.5 (transitive)	Patch bump, safe
rand 0.8.6 → 0.8.7 (state-sum)	Patch bump, safe
syn 1.0.109 → 2.0.x in base16ct	Reduces legacy syn 1.x, good
windows-sys 0.52.0 → 0.59.0 (fuzz lock)	Transitive bump, safe

---

Verdict

Safe to merge. The serde_with security fix is the priority item. The rand 0.10 major version bump is a notable undocumented change but is API-compatible with the codebase. Consider removing the unused rand_chacha dependency as a follow-up cleanup.

[kstoykov]

FYI: v0.10 adds several braking changes