chore(deps): bump noyalib from 0.0.51 to 0.0.54

[dependabot]

Bumps noyalib from 0.0.51 to 0.0.54.

Release notes

Sourced from noyalib's releases.

noyalib 0.0.54

Highlights ⭐️

• Reader entry points are bounded: from_reader, from_reader_with_config, from_reader_strict and compat::serde_yaml::from_reader read at most one byte past max_document_length and then fail the length budget. They used to buffer the whole source first, so an unbounded or hostile reader could exhaust memory before any limit applied. Follow-up to GHSA-4xcc-23fx-w2wj.
• Release pages composed from the repository: the release workflow titles the page noyalib <version> and builds it from this file's Highlights, GitHub's generated What's Changed, a SHA-256 of every asset and the Full Changelog link; the version gate requires the file.
• Safer defaults across the family: in lockstep, noyalib-mcp confines its file tools to one directory and parses strictly by default, and noya-cli writes in place atomically and gains noyavalidate --strict. The two MCP changes can refuse input accepted before; --root and --profile standard restore the old reach.

What's Changed

• release: v0.0.54, safer defaults for untrusted input by @​sebastienrousseau in sebastienrousseau/noyalib#471

Checksums

SHA-256 of every asset attached to this release:

67c07e7c606c32b9eb3469c7b71e52a41f28ac67d5873e5733418eb30cdcb46c  SBOM.cdx.json
9728d234100daaacbd0291d2c9c8358106ecc44cb0ab58a2907583874ab38fac  SBOM.cdx.json.asc
96191a2f2dfb34addd859bcf7c12947e92ed8ffc381d02d8c1e0761911f9959f  SBOM.cdx.json.bundle
81d2e65a2e4a6780f516ed66f878d03fb930fa578a73060e261f9a0f3ed863f7  SBOM.txt
2027f98c377958188fe2cea969aebff49abc3879fb4d4436021ca437a737749d  SBOM.txt.asc
e9a138ca0ce535df7e8603f77ba4304d5f7ead23c996b386c39a44a9167b81c8  SBOM.txt.bundle
13dba4166fcb21a8835883f7d794119182976f89828ece0b8d7a0089c4f861d4  SHA256SUMS.txt
3065c88e5a09eaac750a88c367be1793d0d2b1bbcaa5d1de888506142951f877  SHA512SUMS.txt
3414a2eb882cd54548a3a4203a0b79d5d63a80c8a6260a715512ab1d0a613d13  noyalib-0.0.54.crate
087398c056c6882efe6803678c0a65c98a6ef3f647f7892ab4f16fb65723a2f0  noyalib-0.0.54.crate.asc
90ef1a681d2b08b2fd91bd00158cc492ee7f816b57bf5625fe4e478e8a32207f  noyalib-0.0.54.crate.bundle

Full Changelog: sebastienrousseau/noyalib@v0.0.53...v0.0.54

noyalib 0.0.53

Highlights ⭐️

• Every parser budget now applies to typed targets: the streaming deserializer, which serves from_str::<T> with a default-shaped config, never charged max_events, max_nodes, max_total_scalar_bytes, max_merge_keys or the alias ratio, so tightening them had no effect on the common path. One charge point now mirrors the loaders and nine cross-path parity tests pin it. Tracked as GHSA-4xcc-23fx-w2wj, severity Low.
• Green on Rust 1.99: clippy's new assert_is_empty lint is satisfied by giving every bare is_empty assertion a failure message, and the strict rustdoc gate passes again with the cst and fmt module docs in one place.
• Complexity gate: scripts/complexity-baseline.sh and a Complexity baseline CI job hold the 110 functions over 60 lines or cognitive complexity 15 in a committed baseline that may only shrink.
• Dependabot updates funnelled: rustix 1.1.5, smallvec 1.16.2, jsonschema 0.58, the codeql-action 4.38.2 bumps and the rust-toolchain group, with cargo-vet exemptions refreshed.

What's Changed

• release: v0.0.53, Rust 1.99 and budget parity by @​sebastienrousseau in sebastienrousseau/noyalib#470

Checksums

SHA-256 of every asset attached to this release:

2f570335dd5aa0137e210d0b20392463ca889ca941534b945103c302af404242  SBOM.cdx.json
473a37a661719224bce74127d5d643fc56019145142a9e668d87af48e08d3cbe  SBOM.cdx.json.asc
22db3b35fabac2eddf7f457de448272a39039ed89b84d75ec10210fecf85838f  SBOM.cdx.json.bundle
129f2f4453ecf67530c4e94bfa863cd08a768805bf1f11cc317f801a6b365448  SBOM.txt
</tr></table> 

... (truncated)

Changelog

Sourced from noyalib's changelog.

[v0.0.54] - 2026-10-07

Security

• from_reader, from_reader_with_config, from_reader_strict and compat::serde_yaml::from_reader read at most one byte past max_document_length before failing the length budget. They used to buffer the whole source with read_to_string first, so an unbounded or hostile reader could exhaust memory before any limit applied; the &str and &[u8] entry points and the Tokio decoder's frame cap were already bounded. Follow-up to GHSA-4xcc-23fx-w2wj.

Changed

• The GitHub release page is composed by the release workflow in the family's house shape: title noyalib <version>, the hand-written Highlights from docs/release-notes/v<version>.md, the generated What's Changed, a SHA-256 of every attached asset and the Full Changelog link. scripts/verify-release-versions.sh refuses a tag whose Highlights file is missing.
• The satellites ship in lockstep at 0.0.54. noyalib-mcp confines its file tools to a root directory (--root) and parses under the strict YAML 1.2 profile by default (--profile standard restores the previous behaviour); both can refuse input accepted before. noya-cli writes in place atomically and gains noyavalidate --strict.

[v0.0.53] - 2026-10-06

Added

• scripts/complexity-baseline.sh and a Complexity baseline CI job: clippy measures lines per function (ceiling 60) and cognitive complexity (ceiling 15) against the committed scripts/complexity/baseline.tsv, which lists the 110 functions over a ceiling today and may only shrink.

Changed

• Bumped jsonschema to 0.58 (the manifest requirement moves with the lock), smallvec to 1.16.2 and rustix to 1.1.5, and refreshed the cargo-vet exemptions for the new versions.
• Moved the CI actions to current pins: github/codeql-action 4.38.2, dtolnay/rust-toolchain and taiki-e/install-action 2.87.22.

Fixed

• The strict rustdoc gate on Rust 1.99: the cst and fmt module docs live in one place, so their intra-doc links resolve in module scope instead of being reported as redundant without a span.

... (truncated)

Commits

• 60ce81e release: v0.0.54, safer defaults for untrusted input
• 8c6671f release: v0.0.53, Rust 1.99 and budget parity
• aeb719c feat: add structured diagnostics (#459)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[patchwave]

This PR is safe to merge

✅ Safe to merge (1)

Dependency	Update
noyalib	0.0.51 → 0.0.54

View the full report · Analyzed by PatchWave