build(deps): replace serde_yaml with serde-saphyr

.agents/skills/mz-release-signoff/scripts/catalog-diff.sh

@@ -35,14 +35,15 @@ if [[ $# -ne 2 ]]; then
     exit 2
 fi
 
+root=$(git rev-parse --show-toplevel)
 before=$1
 after=$2
 
 # comm compares under the shell's collation, so sort here rather than relying
 # on the extractor's own ordering.
 names() {
     git show "$1:doc/user/data/metrics.yml" \
-        | python3 "$(dirname "$0")/catalog_names.py" \
+        | "$root/bin/pyactivate" "$root/.agents/skills/mz-release-signoff/scripts/catalog_names.py" \
         | LC_ALL=C sort
 }
 

.agents/skills/mz-release-signoff/scripts/catalog_names.py

@@ -10,23 +10,16 @@
 """Read a metrics catalog on stdin and print its metric names, sorted.
 
 The catalog is doc/user/data/metrics.yml, generated by bin/gen-metrics-catalog.
-Parsing it with a regex rather than a YAML library keeps this dependency-free,
-which matters because it runs against arbitrary git refs during a sign-off.
 """
 
-import re
 import sys
 
-NAME = re.compile(r"^- name: '?(.+?)'?$")
+import yaml
 
 
 def main() -> None:
-    names = set()
-    for line in sys.stdin:
-        match = NAME.match(line.rstrip("\n"))
-        if match:
-            names.add(match.group(1))
-    for name in sorted(names):
+    catalog = yaml.safe_load(sys.stdin)
+    for name in sorted({metric["name"] for metric in catalog["metrics"]}):
         print(name)
 
 

.agents/skills/mz-release-signoff/scripts/lint_metrics.py

@@ -17,11 +17,12 @@
 import re
 import sys
 
+import yaml
+
 SKILL = pathlib.Path(".agents/skills/mz-release-signoff")
 CATALOG = pathlib.Path("doc/user/data/metrics.yml")
 ALLOWLIST = SKILL / "scripts" / "metrics-allowlist.txt"
 
-CATALOG_NAME = re.compile(r"^- name: '?(.+?)'?$")
 BACKTICKED = re.compile(r"`([^`]+)`")
 CANDIDATE = re.compile(r"\b(mz_[a-z0-9_]+)\b")
 # Markdown allows a fence to open with backticks or tildes and to be indented by
@@ -46,11 +47,9 @@ def catalog_names():
     a mix of literal names and patterns and membership is not a set lookup.
     """
     exact, globs = set(), set()
-    for line in CATALOG.read_text().splitlines():
-        match = CATALOG_NAME.match(line)
-        if match:
-            name = match.group(1)
-            (globs if "*" in name else exact).add(name)
+    for metric in yaml.safe_load(CATALOG.read_text())["metrics"]:
+        name = metric["name"]
+        (globs if "*" in name else exact).add(name)
     # A base name is resolvable when any member of its family is catalogued.
     bases = {
         name.rsplit("_", 1)[0]

Cargo.toml

@@ -511,12 +511,12 @@ sentry-tracing = "0.49.1"
 serde = { version = "1.0.219", features = ["derive"] }
 serde-aux = "4.7.0"
 serde-reflection = "0.6.0"
+serde-saphyr = { version = "0.0.29", default-features = false, features = ["serialize"] }
 serde_bytes = "0.11.19"
 serde_json = { version = "1.0.150", features = ["raw_value"] }
 serde_plain = "1.0.2"
 serde_repr = "0.1.20"
 serde_urlencoded = "0.7.1"
-serde_yaml = "0.9.34"
 sha1 = "0.11.0"
 sha2 = "0.11.0"
 shell-words = "1.1.1"

ci/test/lint-skill-metrics.sh

@@ -32,7 +32,7 @@ set -euo pipefail
 
 ci_uncollapsed_heading "Linting mz-release-signoff metric names"
 
-try python3 .agents/skills/mz-release-signoff/scripts/lint_metrics.py
+try bin/pyactivate .agents/skills/mz-release-signoff/scripts/lint_metrics.py
 
 try python3 -m doctest .agents/skills/mz-release-signoff/scripts/build-range-query.py
 

deny.toml

@@ -312,10 +312,6 @@ version = 2
 ignore = [
     # Consider `encoding_rs` instead of `encoding` (unmaintained)
     "RUSTSEC-2021-0153",
-    # `proc-macro-error2` (the maintained fork of `proc-macro-error`) is now also
-    # unmaintained. Pulled in transitively via `tabled` -> `tabled_derive`. No
-    # safe upgrade is available.
-    "RUSTSEC-2026-0173",
     # `derivative` is unmaintained; consider using an alternative (unmaintained)
     "RUSTSEC-2024-0388",
     # The creator of the crate `paste` has stated in the [`README.md`](https://github.com/dtolnay/paste/blob/master/README.md) that this project is not longer maintained as well as archived the repository
@@ -328,11 +324,6 @@ ignore = [
     # Allows private key leakage through timing information
     # rsa is required through iceberg-storage-opendal
     "RUSTSEC-2023-0071",
-    # `launchdarkly-server-sdk` requires `lru ^0.16.3` in its latest release.
-    "RUSTSEC-2026-0253",
-    # `unsafe-libyaml` is unmaintained. Pulled in by `serde_yaml`, which
-    # `mz-debug` and `mz-metrics-catalog` use directly.
-    "RUSTSEC-2024-0449",
 ]
 
 # Must be manually kept in sync with about.toml.