Replace serde_yaml with serde-saphyr to drop unsafe-libyaml

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
       cargo:
         patterns:
           - "*"
+        # serde-saphyr patches only its latest release, and its releases can change how YAML parses,
+        # so its bumps get their own pull request instead of waiting on unrelated breakage.
+        exclude-patterns:
+          - "serde-saphyr"
     cooldown:
       default-days: 7
   - package-ecosystem: "github-actions"

.github/workflows/ci.yml

@@ -32,6 +32,11 @@ jobs:
 
       - name: Run cargo check
         run: cargo check
+
+      - name: Collect the release archives' license notices
+        # The release jobs run only on main, so this catches a dependency change that breaks the
+        # script on its pull request rather than at release time.
+        run: dev/license-notices "$RUNNER_TEMP/licenses"
   test:
     name: Test Suite
     runs-on: ubuntu-latest
@@ -129,10 +134,14 @@ jobs:
           # This combines the intel and m1 binaries into a single binary
           lipo -create -output target/codeowners target/aarch64-apple-darwin/release/codeowners target/x86_64-apple-darwin/release/codeowners
 
-          # Creates artifact for homebrew. -C means run from `target` directory
-          tar -czf target/codeowners-mac.tar.gz -C target codeowners
+          # Notices that some dependencies' licenses require redistributions of the binary to carry
+          dev/license-notices target/licenses
+
+          # Creates artifact for homebrew. -C means run from `target` directory, which keeps the
+          # binary at the archive root, where dotslash-config.json looks for it
+          tar -czf target/codeowners-mac.tar.gz -C target codeowners licenses
 
-          # This tarball is a binary that is executable
+          # This tarball holds the executable binary and the license notices
           gh release upload $NEW_VERSION target/codeowners-mac.tar.gz
 
         env:
@@ -158,8 +167,12 @@ jobs:
           cross build --release --target aarch64-unknown-linux-gnu
       - name: Upload linux binaries
         run: |
-          tar -czf target/x86_64-unknown-linux-gnu.tar.gz -C target/x86_64-unknown-linux-gnu/release codeowners
-          tar -czf target/aarch64-unknown-linux-gnu.tar.gz -C target/aarch64-unknown-linux-gnu/release codeowners
+          # Notices that some dependencies' licenses require redistributions of the binary to carry.
+          # Each -C keeps the binary at its archive's root, where dotslash-config.json looks for it.
+          dev/license-notices target/x86_64-unknown-linux-gnu/release/licenses
+          dev/license-notices target/aarch64-unknown-linux-gnu/release/licenses
+          tar -czf target/x86_64-unknown-linux-gnu.tar.gz -C target/x86_64-unknown-linux-gnu/release codeowners licenses
+          tar -czf target/aarch64-unknown-linux-gnu.tar.gz -C target/aarch64-unknown-linux-gnu/release codeowners licenses
           gh release upload $NEW_VERSION target/x86_64-unknown-linux-gnu.tar.gz
           gh release upload $NEW_VERSION target/aarch64-unknown-linux-gnu.tar.gz
         env:

Cargo.toml

@@ -38,7 +38,9 @@ rayon = "1.10.0"
 regex = "1.11.1"
 serde = { version = "1.0.219", features = ["derive"] }
 serde_json = "1.0.143"
-serde_yaml = "0.9.34"
+# Deserialize only: `default-features = false` leaves out the serializer and YAML comment
+# capture, which we do not use.
+serde-saphyr = { version = "2.0.0", default-features = false, features = ["deserialize"] }
 similar = "3.2.0"
 tempfile = "3.21.0"
 tracing = "0.1.41"

README.md

@@ -47,6 +47,8 @@ You can run `codeowners` without installing a platform-specific binary by using
 2. Download the latest DotSlash text file from a release, for example [https://github.com/rubyatscale/codeowners-rs/releases](https://github.com/rubyatscale/codeowners-rs/releases).
 3. Execute the downloaded file with DotSlash; it will fetch and run the correct binary.
 
+Release archives after v0.5.0 also hold a `licenses` directory next to the `codeowners` binary. It has the license notices that the dependencies listed in `dev/license-notices` require redistributions of the binary to include.
+
 ### Option B: From source with Cargo
 
 Requires Rust toolchain.
@@ -214,6 +216,7 @@ codeowners gv --no-cache
 - `cache_directory` (default: `'tmp/cache/codeowners'`)
 - `ignore_dirs` (default includes: `.git`, `node_modules`, `tmp`, etc.)
 - `executable_name` (default: `'codeowners'`): Customize the command name shown in validation error messages. Useful when using `codeowners-rs` via wrappers like the [code_ownership](https://github.com/rubyatscale/code_ownership) Ruby gem.
+- `yaml_max_nodes` (default: `20000`): The most YAML nodes (mappings, sequences and scalars) allowed in one team file or `package.yml`. A file over it, or over the limits on total scalar bytes and anchor copies that grow with it, fails with a `budget breached` error and a hint to raise this key in the config file in use. Raise it if a large team file hits the limit; real files have at most a few thousand nodes. It does not apply to the config file itself. Raising it also raises how much memory a single file can take: a file crafted to waste memory can make `codeowners` use about 280 MB more at the default and about 700 MB more at 50,000, measured on macOS, while ordinary files add almost nothing. Separately, any of these files, or the config, fails if it nests more than 16 levels deep, counting the top level. That limit can't be raised.
 
 Example configuration with custom executable name: