Precompiled 2026-08-10-480b58f

Update Rust crate serde_with to v3.22.0 [SECURITY] (#55974)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [serde_with](https://redirect.github.com/jonasbb/serde_with) | workspace.dependencies | minor | `3.21.0` → `3.22.0` |

---

### serde_with: KeyValueMap serialization panics on empty sequence or map entries
[GHSA-7gcf-g7xr-8hxj](https://redirect.github.com/advisories/GHSA-7gcf-g7xr-8hxj)

<details>
<summary>More information</summary>

#### Details
##### Summary

The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = "KeyValueMap<_>")]` can be crashed by an empty inner sequence or map entry.

##### Details

The affected public surface includes:

- Serialization of `#[serde_as(as = "KeyValueMap<_>")]` values through `serde_json::to_string` or any other Serde serializer`
- Public `KeyValueMap` conversions for sequence and map-backed entries`

The root cause is: The `KeyValueMap` serializer preallocating `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> `serde_json::to_string` -> `KeyValueMap<TAs>::serialize_as` -> `SeqAsMapSerializer::{serialize_seq,serialize_map}` -> `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` -> panic

Relevant source locations:

- `serde_with/src/key_value_map.rs:590`
- `serde_with/src/key_value_map.rs:599`
- `serde_with/src/key_value_map.rs:613`
- `serde_with/src/key_value_map.rs:632`
- `serde_with/src/key_value_map.rs:648`

##### PoC

```rust
/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]

#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]

#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}
```

##### Impact

A local attacker who can trigger serialization of attacker-controlled data through `KeyValueMap` can terminate the process, causing a denial of service.

#### Severity
- CVSS Score: 5.1 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`

#### References
- [https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj](https://redirect.github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj)
- [https://github.com/jonasbb/serde_with/pull/966](https://redirect.github.com/jonasbb/serde_with/pull/966)
- [https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389](https://redirect.github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389)
- [https://github.com/jonasbb/serde_with/releases/tag/v3.21.0](https://redirect.github.com/jonasbb/serde_with/releases/tag/v3.21.0)
- [https://github.com/advisories/GHSA-7gcf-g7xr-8hxj](https://redirect.github.com/advisories/GHSA-7gcf-g7xr-8hxj)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-7gcf-g7xr-8hxj) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>jonasbb/serde_with (serde_with)</summary>

### [`v3.22.0`](https://redirect.github.com/jonasbb/serde_with/releases/tag/v3.22.0): serde_with v3.22.0

[Compare Source](https://redirect.github.com/jonasbb/serde_with/compare/v3.21.0...v3.22.0)

##### Added

- Add support for `jiff` v0.2 behind the new `jiff_0_2` feature flag ([#&#8203;936](https://redirect.github.com/jonasbb/serde_with/issues/936))
  `jiff::SignedDuration` works with `DurationSeconds` and its variants.
  `jiff::Timestamp`, `jiff::Zoned`, and `jiff::civil::DateTime` work with `TimestampSeconds` and its variants.
  Deserializing a `jiff::Zoned` uses the system time zone, like `chrono::DateTime<Local>`.

##### Fixed

- Extend the [GHSA-7gcf-g7xr-8hxj](https://redirect.github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj) fix to the duplicate-key-prevention collections.
  The `rust::sets_duplicate_value_is_error`, `rust::maps_duplicate_key_is_error`, `rust::sets_last_value_wins`, and `rust::maps_first_key_wins` adapters created their backing sets/maps with `with_capacity_and_hasher` using the raw deserializer `size_hint`, bypassing the `size_hint_cautious` cap added in [#&#8203;966](https://redirect.github.com/jonasbb/serde_with/issues/966) (the `clippy.toml` `disallowed_methods` lint only covers `Vec::with_capacity`, not `with_capacity_and_hasher`, so these sites were not flagged).
  Attacker-controlled input claiming a huge length could panic with `Hash table capacity overflow` before a single element was read. All such constructions now route through `size_hint_cautious`.

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Los_Angeles)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate).

GitOrigin-RevId: e26a84642ae18e5c50aa9ef2a916977b3962076e