Address serde-yaml deprecation

[alvarocabanas]

As you may know, serde-yaml has been deprecated since last year, are there any plans to use an alternative or fork?

[clux]

Yes, when the ecosystem picks a good replacement basically. Right now we don't use a lot of serde_yaml in kube itself (yaml parsing of the config only) so it should not be a particularly hard task to switch over when needed (e.g. when there's a security vulnerability, or there's a better choice).

[clux]

On ecosystem choice; I did a little bit of searching around to see where the ecosystem was at a few months ago, and there wasn't a conclusive answer. Here's some notes I took;

• dtolnay warns about AI generated serde_yml with "nonsense" or "unsound" additions
• users.rus-lang discusses alternatives and calls out lots of unsafe and unsafe C dep in serde_yaml via unsafe-libyaml. no one really wants to fork it. dtolnay changed yaml-rust to unsafe-libyaml. he notes his criterion for lib choices
• yaml_rust2 a pure rust yaml impl. people requested serde support and direct to saphyr
• saphyr talks about "soon to be saphyr-serde" issue seems dead: serde support saphyr-rs/saphyr#1
• eza mantainer catafk maintains serde_norway but hasn't done much except rename + dependabot. but she is less uncommitted now. could be used, but has same unsafe-libyaml problem

..so. no answer right now is particularly compelling to me yet.

[alvarocabanas]

Thanks for the quick answer, yes, we also concluded there is not a good replacement yet, and we thought about creating a fork for our direct usage but found out kube-client is also having the dependency, so we decided we would wait until it's applied also in this crate.

It's good to know you take it into account.

[michelhe]

Looks like saphyr has some new work going towards serde support :)
saphyr-rs/saphyr#53

[c-thiel]

The serde-yaml crate recently added a number of suspicious dependencies, such as openssl and figlet-rs. They don't belong in this crate.
See also the discussions here: https://users.rust-lang.org/t/serde-yaml-deprecation-alternatives/108868/41

Github now gives it an 8.7/10 score:
GHSA-gfxp-f68g-8x78

I believe even switching to a suboptimal crate would make sense at this point.

[nightkr]

@c-thiel That's for serde-yml (the shady AI slop fork), not the serde-yaml that kube-rs uses.

[DaniD3v]

serde-saphyr looks very promising.