[dependabot]

Bumps the cargo group with 1 update in the /src-tauri directory: serde_with.

Updates serde_with from 3.20.0 to 3.24.0

Release notes

Sourced from serde_with's releases.

serde_with v3.24.0

Added

• Implement JsonSchemaAs for NoneAsEmptyString, so fields using it compile with the schemars_* features (#1014)

Changed

• Make with_prefix! and with_suffix! available with the alloc feature, instead of only with std (#1008)

Fixed

• Handle potential panics in deserialization of chrono and time DateTimes. This was privately reported by @​NotAFlightRisk.

serde_with v3.23.0

Changed

• Update syn and darling dependencies to use syn v3 (#992)
• Update dev-dependencies to newer versions (#993)
• Update base64 to a newer version. This should not have any API change, but some error messages might change. (#993)
• serde_as can now parse cfg_attr(true, ...) and cfg_attr(false, ...) (#995) true/false are new literals as of Rust 1.88 but need to be parsed explicitly with the syn types. This is used when emitting schemars annotations.

serde_with v3.22.0

Added

• Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

• Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

serde_with v3.21.0

Security

• GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

  Thanks to @​7thParkk for reporting the issue.

... (truncated)

Commits

• 35ac84c Bump version to 3.24 (#1016)
• 7b8e561 Bump version to 3.24
• 6e576c8 Bump the github-actions group with 2 updates (#1012)
• 7b1814b Add schemars support for NoneAsEmptyString (#1014)
• 92eeedd Handle potential panic during deserialization for large datetimes (#1015)
• 3404642 Handle potential panic during deserialization for large datetimes
• c7073b9 Add schemars support for NoneAsEmptyString
• 6b32290 Run test with only the alloc feature (#1013)
• 3361c69 Run test with only the alloc feature
• b43bb81 Reduce required feature for with_{prefix,suffix} from std to alloc (#1008)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.