chore(deps): Bump serde from 1.0.228 to 1.0.229

[dependabot]

Bumps serde from 1.0.228 to 1.0.229.

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​serde@​1.0.229

View full report

[msalvatti]

@dependabot rebase

[dependabot]

The base commit for this pull request has not changed.

[msalvatti]

Status: blocked on the supply-chain policy, not on anything wrong with this bump.

cargo deny and cargo audit pass here — no known advisory, no license or ban issue. The only failing step is cargo vet, and it is failing because the new version has no audit yet from any source this repository imports.

#117 has landed and separates the two causes that were tangled together. It refreshed supply-chain/imports.lock, which was five dependencies behind and was making every PR fail for reasons that had nothing to do with the PR, and it pinned CI to cargo vet --locked so the gate answers from what the repository recorded rather than from whatever upstream published that minute. What is left here is genuinely this bump:

$ cargo vet          # with the imports refreshed
Vetting Failed!

(the exact crate is listed in the job log)

Three ways forward, and the right one is a call for the maintainer rather than something to route around:

1. Wait. This is what just happened for anyhow, serde_json, syn and thiserror: Mozilla, Bytecode Alliance and Google published audits between 18 and 22 July, and the versions became vetted with no decision from us. There is no advisory here, so waiting costs nothing.
2. Audit the diff with cargo vet diff, and record it with cargo vet certify. Honest, and real work — the redis 1.3 → 1.5 diff alone is 2377 insertions.
3. Exempt it — record that we accept the version without auditing it. Fastest, and the only one that puts a trust claim in the repository that nobody earned.

Leaving this open rather than forcing it through: a gate that gets bypassed whenever it is inconvenient is not a gate.