Skip to content

Release v0.12.2

Security Fix - Replace Unsound YAML Dependency

Replaced serde_yml (RUSTSEC-2025-0067, RUSTSEC-2025-0068) with serde_yaml_ng, a maintained fork of dtolnay's original serde_yaml. The previous serde_yml crate and its libyml dependency were flagged as unsound and unmaintained by RustSec.

Changed

Dependencies

  • Replaced serde_yml 0.0.12 with serde_yaml_ng 0.10.0 for YAML parsing
  • serde_yaml_ng is a direct continuation of dtolnay's serde_yaml, based on unsafe-libyaml instead of the unsound libyml
  • Resolves RUSTSEC-2025-0067 (libyml unsound) and RUSTSEC-2025-0068 (serde_yml unsound/unmaintained)
  • cargo audit now passes with zero warnings

Upgrade

bash
# Homebrew
brew upgrade gcop-rs

# Cargo
cargo install gcop-rs

# pip
pip install --upgrade gcop-rs