chore: Replace unmaintained and vulnerable dependencies

Cargo.toml

@@ -49,10 +49,9 @@ rstest = "0.26"
 semver = { version = "1.0", features = ["serde"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
-serde_yaml = "0.9"
 sha2 = "0.11"
 snafu = { version = "0.9", features = ["futures"] }
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.117.0", default-features = false, features = ["crds", "kube-ws", "kube-http-proxy", "kube-socks5"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.121.0", default-features = false, features = ["crds", "kube-ws", "kube-http-proxy", "kube-socks5"] }
 tera = "2.0"
 termion = "4.0"
 tokio = { version = "1.53", features = ["rt-multi-thread", "macros", "fs", "process", "io-std"] }
@@ -63,10 +62,11 @@ tracing-indicatif = "0.3.9"
 tracing-subscriber = "0.3"
 url = "2.5"
 urlencoding = "2.1.3"
-utoipa = { version = "5.4", features = ["indexmap"] }
-utoipa-swagger-ui = { version = "9.0", features = ["axum"] }
+utoipa = { version = "6.0", features = ["indexmap"] }
+utoipa-swagger-ui = { version = "10.0", features = ["axum"] }
 uuid = { version = "1.10", features = ["v4"] }
 which = "8.0"
+yaml_serde = "0.10"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
 # stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }

rust/stackable-cockpit/Cargo.toml

@@ -18,27 +18,27 @@ helm-sys = { path = "../helm-sys" }
 bcrypt.workspace = true
 clap.workspace = true
 either.workspace = true
+futures.workspace = true
 hex.workspace = true
 indexmap.workspace = true
+indicatif.workspace = true
 rand.workspace = true
 reqwest.workspace = true
 semver.workspace = true
-serde_json.workspace = true
-serde_yaml.workspace = true
 serde.workspace = true
+serde_json.workspace = true
 sha2.workspace = true
 snafu.workspace = true
 stackable-operator.workspace = true
 tera.workspace = true
 tokio.workspace = true
-tracing.workspace = true
 tracing-indicatif.workspace = true
+tracing.workspace = true
 url.workspace = true
 urlencoding.workspace = true
 utoipa = { workspace = true, optional = true }
 which.workspace = true
-futures.workspace = true
-indicatif.workspace = true
+yaml_serde.workspace = true
 
 [dev-dependencies]
 rstest.workspace = true

rust/stackable-cockpit/src/engine/kind/mod.rs

@@ -40,7 +40,7 @@ pub enum Error {
     DockerCheckCommand { source: docker::Error },
 
     #[snafu(display("failed to covert kind config to YAML"))]
-    ConfigSerialization { source: serde_yaml::Error },
+    ConfigSerialization { source: yaml_serde::Error },
 }
 
 #[derive(Debug)]
@@ -80,7 +80,7 @@ impl Cluster {
 
         debug!("Creating kind cluster config");
         let config = Config::new(self.node_count, self.cp_node_count);
-        let config_string = serde_yaml::to_string(&config).context(ConfigSerializationSnafu)?;
+        let config_string = yaml_serde::to_string(&config).context(ConfigSerializationSnafu)?;
 
         debug!("Creating kind cluster");
         let mut kind_cmd = Command::new("kind")

rust/stackable-cockpit/src/helm.rs

@@ -29,7 +29,7 @@ pub struct Chart {
     pub name: String,
     pub repo: ChartRepo,
     pub version: String,
-    pub options: serde_yaml::Value,
+    pub options: yaml_serde::Value,
 }
 
 #[derive(Debug, Deserialize)]
@@ -81,7 +81,7 @@ pub enum Error {
     DeserializeJson { source: serde_json::Error },
 
     #[snafu(display("failed to deserialize YAML data"))]
-    DeserializeYaml { source: serde_yaml::Error },
+    DeserializeYaml { source: yaml_serde::Error },
 
     #[snafu(display("failed to retrieve remote content"))]
     FetchRemoteContent { source: reqwest::Error },
@@ -537,7 +537,7 @@ where
         .await
         .context(FetchRemoteContentSnafu)?;
 
-    serde_yaml::from_str(&index_file_content).context(DeserializeYamlSnafu)
+    yaml_serde::from_str(&index_file_content).context(DeserializeYamlSnafu)
 }
 
 #[cfg(test)]

rust/stackable-cockpit/src/platform/demo/mod.rs

@@ -13,7 +13,7 @@ pub use spec::*;
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DemosV2 {
-    #[serde(with = "serde_yaml::with::singleton_map_recursive")]
+    #[serde(with = "yaml_serde::with::singleton_map_recursive")]
     demos: IndexMap<String, DemoSpec>,
 }
 

rust/stackable-cockpit/src/platform/demo/params.rs

@@ -1,5 +1,5 @@
-use serde_yaml::Mapping;
 use stackable_operator::kvp::Labels;
+use yaml_serde::Mapping;
 
 use crate::platform::operator::ChartSourceType;
 

rust/stackable-cockpit/src/platform/manifests.rs

@@ -63,7 +63,7 @@ pub enum Error {
     /// This error indicates that Helm chart options could not be serialized
     /// into YAML.
     #[snafu(display("failed to serialize Helm chart options"))]
-    SerializeOptions { source: serde_yaml::Error },
+    SerializeOptions { source: yaml_serde::Error },
 
     /// This error indicates that the creation of a kube client failed.
     #[snafu(display("failed to create Kubernetes client"))]
@@ -127,7 +127,7 @@ pub trait InstallManifestsExt {
                     };
 
                     // Serialize chart options to string
-                    let values_yaml = serde_yaml::to_string(&helm_chart.options)
+                    let values_yaml = yaml_serde::to_string(&helm_chart.options)
                         .context(SerializeOptionsSnafu)?;
 
                     // Install the Helm chart using the Helm wrapper

rust/stackable-cockpit/src/platform/operator/listener_operator.rs

@@ -1,12 +1,12 @@
 use clap::ValueEnum;
-use serde_yaml::Value;
 use snafu::ResultExt;
 use stackable_operator::{
     k8s_openapi::api::core::v1::Node,
     kube::{Api, Client, api::ListParams},
 };
 use tokio::sync::OnceCell;
 use tracing::{debug, info, instrument};
+use yaml_serde::Value;
 
 pub static LISTENER_CLASS_PRESET: OnceCell<ListenerClassPreset> = OnceCell::const_new();
 

rust/stackable-cockpit/src/platform/operator/mod.rs

@@ -3,10 +3,10 @@ use std::{fmt::Display, str::FromStr};
 use listener_operator::LISTENER_CLASS_PRESET;
 use semver::Version;
 use serde::Serialize;
-use serde_yaml::{Mapping, Value};
 use snafu::{ResultExt, Snafu, ensure};
 use tracing::{Span, info, instrument};
 use tracing_indicatif::{indicatif_println, span_ext::IndicatifSpanExt};
+use yaml_serde::{Mapping, Value};
 
 use crate::{
     constants::{
@@ -230,7 +230,7 @@ impl OperatorSpec {
             None
         } else {
             Some(
-                serde_yaml::to_string(&helm_values)
+                yaml_serde::to_string(&helm_values)
                     .expect("serializing a small YAML Mapping back to a YAML string can't fail"),
             )
         };

rust/stackable-cockpit/src/platform/release/mod.rs

@@ -10,7 +10,7 @@ use crate::common::list::SpecIter;
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct Releases {
-    #[serde(with = "serde_yaml::with::singleton_map_recursive")]
+    #[serde(with = "yaml_serde::with::singleton_map_recursive")]
     releases: IndexMap<String, ReleaseSpec>,
 }
 

rust/stackable-cockpit/src/platform/release/spec.rs

@@ -2,13 +2,13 @@ use futures::{StreamExt as _, TryStreamExt};
 use indexmap::IndexMap;
 use reqwest::StatusCode;
 use serde::{Deserialize, Serialize};
-use serde_yaml::Mapping;
 use snafu::{ResultExt, Snafu};
 use tokio::task::JoinError;
 use tracing::{Instrument, Span, debug, info, instrument};
 use tracing_indicatif::span_ext::IndicatifSpanExt as _;
 #[cfg(feature = "openapi")]
 use utoipa::ToSchema;
+use yaml_serde::Mapping;
 
 use crate::{
     PROGRESS_BAR_STYLE, helm,

rust/stackable-cockpit/src/platform/stack/mod.rs

@@ -13,7 +13,7 @@ use crate::common::list::SpecIter;
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct StacksV2 {
-    #[serde(with = "serde_yaml::with::singleton_map_recursive")]
+    #[serde(with = "yaml_serde::with::singleton_map_recursive")]
     stacks: IndexMap<String, StackSpec>,
 }
 

rust/stackable-cockpit/src/platform/stack/params.rs

@@ -1,5 +1,5 @@
-use serde_yaml::Mapping;
 use stackable_operator::kvp::Labels;
+use yaml_serde::Mapping;
 
 use crate::platform::operator::ChartSourceType;
 

rust/stackable-cockpit/src/platform/stack/spec.rs

@@ -1,11 +1,11 @@
 use serde::{Deserialize, Serialize};
-use serde_yaml::Mapping;
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::kvp::{Label, LabelError};
 use tracing::{Span, debug, info, instrument, log::warn};
 use tracing_indicatif::span_ext::IndicatifSpanExt as _;
 #[cfg(feature = "openapi")]
 use utoipa::ToSchema;
+use yaml_serde::Mapping;
 
 use crate::{
     common::manifest::ManifestSpec,

rust/stackable-cockpit/src/utils/k8s/client.rs

@@ -67,7 +67,7 @@ pub enum Error {
     },
 
     #[snafu(display("failed to deserialize YAML data"))]
-    DeserializeYaml { source: serde_yaml::Error },
+    DeserializeYaml { source: yaml_serde::Error },
 
     #[snafu(display("failed to run GVK discovery"))]
     GVKDiscoveryRun {
@@ -140,7 +140,7 @@ impl Client {
         // TODO (Techassi): Impl IntoIterator for Labels
         let labels: BTreeMap<String, String> = labels.into();
 
-        for manifest in serde_yaml::Deserializer::from_str(manifests) {
+        for manifest in yaml_serde::Deserializer::from_str(manifests) {
             let mut object = DynamicObject::deserialize(manifest).context(DeserializeYamlSnafu)?;
 
             // Add our own labels to the object
@@ -220,7 +220,7 @@ impl Client {
     /// method will fail if it is unable to parse the CRDs, unable to
     /// resolve GVKs or unable to replace/create the dynamic objects.
     pub async fn replace_crds(&self, crds: &str) -> Result<()> {
-        for crd in serde_yaml::Deserializer::from_str(crds) {
+        for crd in yaml_serde::Deserializer::from_str(crds) {
             let mut object = DynamicObject::deserialize(crd).context(DeserializeYamlSnafu)?;
 
             let object_type = object.types.as_ref().ok_or(

rust/stackable-cockpit/src/utils/yaml.rs

@@ -1,4 +1,4 @@
-use serde_yaml::{Mapping, Value};
+use yaml_serde::{Mapping, Value};
 
 /// Extracts the Helm values for a specific operator from the operator values mapping.
 ///

rust/stackable-cockpit/src/xfer/processor.rs

@@ -10,7 +10,7 @@ pub type Result<T, E = ProcessorError> = std::result::Result<T, E>;
 #[derive(Debug, Snafu)]
 pub enum ProcessorError {
     #[snafu(display("failed to deserialize YAML content"))]
-    DeserializeYaml { source: serde_yaml::Error },
+    DeserializeYaml { source: yaml_serde::Error },
 
     #[snafu(display("failed to deserialize JSON content"))]
     DeserializeJson { source: serde_json::Error },
@@ -74,7 +74,7 @@ where
     type Output = T;
 
     fn process(&self, input: Self::Input) -> Result<Self::Output> {
-        serde_yaml::from_str(&input).context(DeserializeYamlSnafu)
+        yaml_serde::from_str(&input).context(DeserializeYamlSnafu)
     }
 }
 

rust/stackablectl/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Changed
+
+- Bump `stackable-operator` to 0.121.0 ([#473]).
+- Replace unmaintained `serde_yaml` with its maintained fork `yaml_serde` ([#473]).
+
+[#473]: https://github.com/stackabletech/stackablectl/pull/473
+
 ## [1.5.2] - 2026-09-24
 
 ### Changed

rust/stackablectl/Cargo.toml

@@ -13,34 +13,34 @@ publish = false
 stackable-cockpit = { path = "../stackable-cockpit", features = ["openapi"] }
 stackable-operator.workspace = true
 
+clap.workspace = true
 clap_complete.workspace = true
 clap_complete_nushell.workspace = true
-clap.workspace = true
 comfy-table.workspace = true
 dialoguer.workspace = true
 directories.workspace = true
 dotenvy.workspace = true
+futures.workspace = true
 indexmap.workspace = true
+indicatif.workspace = true
 lazy_static.workspace = true
+libc.workspace = true
 rand.workspace = true
 reqwest.workspace = true
 rustls.workspace = true
 semver.workspace = true
-serde_json.workspace = true
-serde_yaml.workspace = true
 serde.workspace = true
+serde_json.workspace = true
 snafu.workspace = true
 tera.workspace = true
+termion.workspace = true
 tokio.workspace = true
 toml.workspace = true
+tracing-indicatif.workspace = true
 tracing-subscriber.workspace = true
 tracing.workspace = true
-tracing-indicatif.workspace = true
-futures.workspace = true
-indicatif.workspace = true
-termion.workspace = true
 urlencoding.workspace = true
-libc.workspace = true
+yaml_serde.workspace = true
 
 [build-dependencies]
 built.workspace = true