Skip to content

Bump serde_json from 1.0.145 to 1.0.149#761

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde_json-1.0.149
Open

Bump serde_json from 1.0.145 to 1.0.149#761
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/serde_json-1.0.149

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 14, 2026 •
edited by cursor Bot
Loading

Bumps serde_json from 1.0.145 to 1.0.149.

Release notes

Sourced from serde_json's releases.

v1.0.149

  • Align arbitrary_precision number strings with zmij's formatting (#1306, thanks @​b41sh)

v1.0.148

  • Update zmij dependency to 1.0

v1.0.147

  • Switch float-to-string algorithm from Ryū to Żmij for better f32 and f64 serialization performance (#1304)

v1.0.146

Commits

Note

Medium Risk
Moderate risk because it updates core JSON serialization behavior (float-to-string formatting/perf) by changing serde_json internals and dependency set, which could affect serialized output and tests relying on exact JSON strings.

Overview
Bumps the workspace serde_json dependency from 1.0.145 to 1.0.149.

The lockfile updates serde_json’s transitive deps by dropping ryu and adding zmij (1.0.21), reflecting the upstream switch in float formatting/serialization behavior and performance.

Reviewed by Cursor Bugbot for commit fb3fe56. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot dependabot Bot added Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Apr 14, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 14, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​serde_json@​1.0.145 ⏵ 1.0.1498210093100100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 14, 2026 •
edited
Loading

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Install-time scripts: cargo zmij

Install script: Package overview

Source: undefined

From: ? → cargo/serde_json@1.0.149 → cargo/zmij@1.0.21

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zmij@1.0.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Native binaries present: cargo zmij

Location: Package overview

From: ? → cargo/serde_json@1.0.149 → cargo/zmij@1.0.21

ℹ Read more on: This package | This alert | Why is native code a concern?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zmij@1.0.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@coveralls-official
Copy link
Copy Markdown

coveralls-official Bot commented Apr 14, 2026 •
edited
Loading

Coverage Report for CI Build 25725296786

Coverage remained the same at 87.561%

Details

  • Coverage remained the same as the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats

Coverage Status
Relevant Lines: 8554
Covered Lines: 7490
Line Coverage: 87.56%
Coverage Strength: 23943498.67 hits per line
💛 - Coveralls

@dependabot dependabot Bot force-pushed the dependabot/cargo/serde_json-1.0.149 branch 3 times, most recently from 05eeae1 to 4c55cd6 Compare April 29, 2026 14:51
@dependabot
Bump serde_json from 1.0.145 to 1.0.149
fb3fe56 
Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.145 to 1.0.149.
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.145...v1.0.149)

---
updated-dependencies:
- dependency-name: serde_json
  dependency-version: 1.0.149
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/cargo/serde_json-1.0.149 branch from 4c55cd6 to fb3fe56 Compare May 12, 2026 09:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants