What the developer wrote
Authored by dependabot[bot]
Bump serde_json from 1.0.146 to 1.0.148
Bumps [serde_json](https://github.com/serde-rs/json) from 1.0.146 to 1.0.148.
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.146...v1.0.148)
---
updated-dependencies:
- dependency-name: serde_json
dependency-version: 1.0.148
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is an automated dependency update by Dependabot that bumps the serde_json library from version 1.0.146 to 1.0.148. The change only updates the Cargo.lock file, which records exact package versions. The newer version swaps one internal helper library (ryu) for another (zmij) but does not change electrs's own code. There is no indication in the commit that this fixes a security issue.
No security action required. Treat as routine dependency maintenance. If desired, review serde_json 1.0.148 release notes for any functional changes, but the commit itself presents no security relevance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates a single direct production dependency, serde_json, by two patch versions (1.0.146 → 1.0.148). The diff is confined to Cargo.lock: the serde_json checksum and dependency list change, replacing the ryu crate with the zmij crate as an internal dependency. No electrs source code is modified, and the commit message describes this as a routine semver-patch update. No security advisory, CVE, or vendor security note is referenced.
Changed components
Cargo.lockserde_json dependencyInspect captured patch +9 / −9
diff --git a/Cargo.lock b/Cargo.lock
index 4911571..f670086 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1025,12 +1025,6 @@ dependencies = [
"windows-sys 0.59.0",
]
-[[package]]
-name = "ryu"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
-
[[package]]
name = "scopeguard"
version = "1.2.0"
@@ -1090,15 +1084,15 @@ dependencies = [
[[package]]
name = "serde_json"
-version = "1.0.146"
+version = "1.0.148"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "217ca874ae0207aac254aa02c957ded05585a90892cc8d87f9e5fa49669dadd8"
+checksum = "3084b546a1dd6289475996f182a22aba973866ea8e8b02c51d9f46b1336a22da"
dependencies = [
"itoa",
"memchr",
- "ryu",
"serde",
"serde_core",
+ "zmij",
]
[[package]]
@@ -1436,6 +1430,12 @@ dependencies = [
"syn",
]
+[[package]]
+name = "zmij"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f4a4e8e9dc5c62d159f04fcdbe07f4c3fb710415aab4754bf11505501e3251d"
+
[[package]]
name = "zstd-sys"
version = "2.0.13+zstd.1.5.6"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.