fix: update serde_with to 3.21.0 to resolve GHSA-7gcf-g7xr-8hxj

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln

• Dependency: serde_with bumped from 2.0.1 → 3.21.0 in both completion-metadata/Cargo.toml and command-signatures/Cargo.toml
• Advisory: GHSA-7gcf-g7xr-8hxj
• Dependabot alert Add CI.yml workflow taken from command-corrections crate. #1: https://github.com/warpdotdev/command-signatures/security/dependabot/1
• Dependabot alert Copying over crates from warp-internal repository. #2: https://github.com/warpdotdev/command-signatures/security/dependabot/2
• Verification: cargo audit — 0 advisories; cargo build — clean; cargo test — 10/10 passed

Risky code / where the dependency is used

• completion-metadata/src/fig_types.rs — uses serde_as, NoneAsEmptyString, OneOrMany, skip_serializing_none, formats::{PreferMany, PreferOne}
• command-signatures/src/overrides.rs — uses serde_with traits
• command-signatures/src/powershell_autogenerator/mod.rs — uses serde_as, DefaultOnNull, OneOrMany, formats::PreferMany

The upgrade is major (2→3) but the APIs used are stable across versions; all tests pass.

Special instructions

This is a major-version bump (2.x → 3.x). Cargo.lock is gitignored (library crate), so downstream consumers will resolve the version at their build time.

AFTER YOU MERGE

No post-merge steps required.

[oz-for-oss]

@independabot-soc2[bot]

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR updates serde_with from 2.0.1 to 3.21.0 in both Cargo manifests to address the reported advisory. The attached diff only changes dependency versions, with no code or configuration changes that introduce new behavior.

Concerns

• No blocking correctness, security, or spec-alignment concerns found in the annotated diff.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz