chore(cargo): replace unmaintained serde_yaml and yaml-rust-davvid by newhoggy · Pull Request #2244 · rust-works/omni-dev

newhoggy · 2026-11-10T00:59:22Z

Description

Replaces the two direct dependencies behind the actionable RustSec warnings in #2242: serde_yaml (RUSTSEC-2024-0449, via unsafe-libyaml) becomes serde_norway, and yaml-rust-davvid (RUSTSEC-2021-0153, via encoding) becomes yaml-rust2. The 52-file migration is a mechanical rename; parsing is unchanged.

Plan and candidate evaluation: #2242 (comment)

Type of Change

Dependency update

Related Issue

Relates to #2242. Deliberately not Closes: three of the five advisories (pin-utils, glib, proc-macro-error) depend on upstream hyper and tao/tray-icon releases and still show in cargo audit. The issue's third acceptance criterion allows them to be "tracked here", so closing it on merge would drop that tracking. Close it by hand if you would rather track them elsewhere.

Changes Made

Core Changes:

Cargo.toml/Cargo.lock: serde_yaml → serde_norway 0.9.42, yaml-rust-davvid → yaml-rust2 0.13. The lockfile change is only what these need (drops unsafe-libyaml, encoding*, ahash, old hashlink).
serde_yaml → serde_norway in 52 files under src/, tests/, examples/ (rename only, then cargo fmt).
src/data/yaml.rs: emitter import switched to yaml_rust2; three new tests pin the changed output.

Why these crates: serde_yaml_ng still depends on unsafe-libyaml, so it fails the acceptance criterion. serde_yaml_bw and serde-saphyr are pure-Rust parsers with YAML 1.2 semantics (and serde-saphyr needs MSRV 1.89, no Value), which would change how existing files parse, and the issue asks to keep behaviour changes out of the migration. serde_norway is API-identical and keeps the same libyaml-port parser; its parser crate is the differently named unsafe-libyaml-norway, which RUSTSEC-2024-0449 does not cover, but it is the same code lineage, so a future advisory against it would apply too.

Documentation: ADR-0001, ARCHITECTURE.md, CLAUDE.md, STYLE_GUIDE.md; changelog fragment changelog.d/2242.changed.md.

Testing

cargo test --features mcp and cargo test: all pass, insta snapshots included, no .snap.new files, no snapshot changes. The src/cli/** files touched by the rename change no flags, subcommands or help text, so no snapshot update applies.
cargo clippy --all-targets -- -D warnings, with and without --features mcp; cargo fmt --check; cargo doc --no-deps --document-private-items with broken intra-doc links denied.
cargo tree -i unsafe-libyaml and cargo tree -i encoding both report "did not match any packages" (also with --all-features).
cargo audit: unsafe-libyaml and encoding are gone; three warnings remain (pin-utils, proc-macro-error, glib). cargo deny check: advisories, bans, licenses, sources ok.
scripts/changelog.py check-pr --base origin/main passes; the commit passes omni-dev git commit message lint.
I did not run ./scripts/build.sh or exercise the Linux menu-bar feature.

Review Focus Areas

Backward compatibility

Output change to review: yaml-rust2's literal-block emitter writes |- for a multiline string with no trailing newline (the old emitter wrote |, which read back with an extra newline) and quotes a string that cannot be a literal block (e.g. trailing whitespace on a line). No existing test or snapshot changed, because their assertions match on : | as a prefix; the new tests assert the exact form. On a probe of 13 multiline shapes the new emitter is never worse than the old one, and CRLF strings now round-trip.

Checklist

I have performed a self-review of my own code
I have made corresponding changes to the documentation
I have added a changelog fragment
New and existing unit tests pass locally with my changes

Security Considerations

Security improvement: removes two unmaintained crates and the unsafe-libyaml C-port from the dependency tree.

Additional Notes

Review findings skipped (pre-existing, not caused by this change):

Some multiline strings still do not round-trip through to_yaml → from_yaml: a first line starting with spaces (" lead\nb"), two or more trailing newlines, and a trailing newline on the last key of a document. All were lossy with yaml-rust-davvid as well (probed side by side). I corrected my changelog and commit wording, which had claimed exact round-trips, but did not widen this diff into an emitter fix.
docs/adrs/adr-0022.md and docs/plan/{project,twiddle}.md still name serde_yaml; they are historical records, so I left them.

Follow-ups (not filed; creating issues was outside what this run was permitted to do):

Track pin-utils (via hyper) and glib/proc-macro-error (Linux GTK tray stack) against upstream releases; re-run cargo audit after each hyper and tao/tray-icon bump; no blanket deny.toml ignores.
Make to_yaml lossless for the multiline shapes above: fall back to a quoted scalar (or |+/an indentation indicator) where a literal block would not round-trip, with a property test over arbitrary multiline strings.

Departure from the plan: the plan said the follow-up issue would carry the advisory tracking; since it could not be filed, this PR uses Relates to instead of Closes.

github-actions · 2026-11-10T01:03:36Z

Coverage

Total: 97.24% ⚪ 0.02 pp vs main

Comparing a593da3..13636c7 (merge-base → PR head)

File	Before	After	Δ
`src/cli/git/create_pr.rs`	53.73%	54.31%	🟢 0.57 pp
`src/mcp/browser_tools.rs`	78.18%	78.9%	🟢 0.72 pp
`src/data/yaml.rs`	93.66%	95.07%	🟢 1.41 pp
`src/mcp/transcript_tools.rs`	48.33%	50%	🟢 1.67 pp
`src/claude/context/discovery.rs`	83.44%	86.4%	🟢 2.96 pp

🔇 56 ignored region(s), 0 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
`src/claude/client.rs`	`ignore`	815-827	both	process-bound: hardcodes SystemEnv with no injectable seam (unlike create_default_claude_client_with's tested Default arm, which this mirrors) and has no in-crate caller; testing it would mean mutating real process env for shared credential vars
`src/cli.rs`	`ignore`	202	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
`src/cli.rs`	`ignore`	206	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
`src/cli.rs`	`ignore`	210	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
`src/cli.rs`	`ignore`	218	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
`src/cli.rs`	`ignore`	219	both	process-bound: the command opens a real network or daemon connection, or reads the real stdin and credentials, so a test cannot dispatch it; each command is covered through its own run_* seams
`src/cli/ai/jev/route.rs`	`ignore`	176-251	both	RouteCommand::execute is the process-bound wiring shell; fetch_docs, run_route_with_reference_fetch_failures, render_output_with_style and terminal_style_with provide its deterministic seams
`src/cli/ai/jev/route.rs`	`ignore`	325-330	both	the SystemEnv/stdout probe is process-bound; terminal_style_with is exhaustively covered through its injected environment and TTY seam
`src/cli/ai/jev/route.rs`	`ignore`	882	both	guards this test's assumption; the parse above always fails on --ignore-closed with --allow-closed
`src/cli/ai/jev/route.rs`	`ignore`	914	both	guards this test's assumption; the parse above always fails on a malformed --ladder-definition
`src/cli/ai/jev/verify_decision.rs`	`ignore`	89-142	both	VerifyDecisionCommand::execute is the process-bound wiring shell; fetch_input and run_verify provide its deterministic seams
`src/cli/claude_wrap.rs`	`ignore`	160-170	both	process-bound wiring shell: it joins this process's own stdin/stdout and reads the real OMNI_DEV_CLAUDE_WRAP_LOG, which a test must not take over (see the note on run/wrap in the tests module); wrap_io_diagnostics beneath it is covered directly
`src/cli/claude_wrap.rs`	`ignore`	716-720	both	resolve_socket fails only when the platform has no data directory to put the default socket in (no resolvable home), which a test cannot reproduce on macOS or Linux; the fail-open return is what keeps the wrapper forwarding
`src/cli/claude_wrap.rs`	`ignore`	773-777	both	to_value on an ObserveRequest fails only for a non-UTF-8 cwd, and the tracker takes cwd from a JSON string, so it is always UTF-8; the arm exists so a future non-string field cannot silently drop the report
`src/cli/claude_wrap/diagnostics.rs`	`ignore`	60	both	Builder::spawn fails only when the OS refuses a new thread (resource exhaustion), which a test cannot provoke; the fail-open return is what keeps the wrapper forwarding
`src/cli/sessions.rs`	`ignore`	273-276	both	resolve_socket fails only when the platform has no data directory to put the default socket in (no resolvable home), which a test cannot reproduce on macOS or Linux; the sink is fail-open by design, so this is the same silent return as every other skipped hook
`src/cli/sessions.rs`	`ignore`	283	both	wire returns None only through the serialization failure ignored in wire() itself (a non-UTF-8 cwd, which a hook payload cannot carry), so this arm is unreachable for the same reason
`src/cli/sessions.rs`	`ignore`	403-410	both	to_value on an ObserveRequest fails only for a non-UTF-8 cwd, and the hook payload's cwd is deserialized from a JSON string, so it is always UTF-8; the arm exists so a future non-string field cannot silently drop the report
`src/cli/sessions.rs`	`ignore`	3529	both	the arm above always matches: parse() above always parses an install-hooks argv into SessionsSubcommands::InstallHooks
`src/cli/sessions.rs`	`ignore`	3533	both	the arm above always matches: parse() above always parses an uninstall-hooks argv into SessionsSubcommands::UninstallHooks
`src/cli/worktrees/ui/terminal/pty.rs`	`ignore`	314-321	both	the closure runs only in the forked child between fork and exec, and exec discards that process's coverage counters before they can be flushed, so llvm-cov reports 0 hits on these lines however often the tests run it (CI measured the whole body uncovered on PR #2169); the reset is checked by behaviour instead, in the_well_behaved_test_passes_when_the_test_process_ignores_sighup
`src/daemon.rs`	`ignore`	175	both	path resolution fails only without a data dir, which the daemon cannot start without; same arm as the PR cache above
`src/daemon/services/worktrees/closed.rs`	`ignore`	119	both	spawn_blocking only fails if the closure panics, which nothing in it can do
`src/daemon/services/worktrees/closed.rs`	`ignore`	366	both	needs 99 live worktrees sharing one directory name; the suffix loop is covered by a_name_held_by_a_live_worktree_gets_a_suffix
`src/daemon/services/worktrees/divergence.rs`	`ignore`	348	both	only runs if a started computation never sets its flag within 2s, which fails the calling test; a passing run never takes it
`src/github_issues.rs`	`ignore`	579	both	validated by the citation parser; every ItemRef reaching here already has a project of the form owner/repo
`src/github_metrics/incremental.rs`	`ignore`	1207	both	guards this test's assumption; the last attempt treats a raced search as a file not found, so it always plans
`src/jev/citations.rs`	`ignore`	127	both	unreachable: both call sites (find_citations, first_citation) already filtered out the only alternative with no numbered group (other_url) via number_end before calling this
`src/jev/exists.rs`	`ignore`	190	both	Child::kill returns Ok for a child that has exited but not been reaped, and wait() only runs after this call, so only an OS-level failure such as EPERM reaches this arm; it exists so that failure is logged rather than silently dropped
`src/jev/route.rs`	`ignore`	310	both	defensive: the embedded questions YAML always has all three stage keys, pinned by stage_questions_are_the_tested_wording
`src/jev/route.rs`	`ignore`	320	both	defensive: every embedded stage question is a choice question, pinned by stage_questions_are_the_tested_wording
`src/jev/route.rs`	`ignore`	328	both	defensive: no embedded or custom tier is ever named `none`, the one fixed criterion (stage_design's no-design-work option)
`src/jev/route.rs`	`ignore`	1804	both	unreachable: https is a special scheme per the WHATWG URL spec, so a URL that already passed the scheme check above can never be cannot-be-a-base and path_segments() is always Some
`src/jev/route.rs`	`ignore`	1970	both	assert_eq!'s message args are only evaluated on failure, and this test always passes
`src/jev/route.rs`	`ignore`	1980	both	assert_eq!'s message args are only evaluated on failure, and this test always passes
`src/jev/route.rs`	`ignore`	1981	both	assert_eq!'s message args are only evaluated on failure, and this test always passes
`src/jev/route.rs`	`ignore`	3369	both	guards this test helper against misuse; every call site below passes an already-routed outcome
`src/jev/route.rs`	`ignore`	3575	both	guards this test's assumption; the mocked response above always answers with a routed outcome
`src/jev/route.rs`	`ignore`	3639	both	guards this test's assumption; the mocked response above always leaves gemini's answers missing
`src/mcp/browser_tools.rs`	`ignore`	150-152	head	process-bound: reached only after BridgeClient::send gets a reply from a live bridge on a local port, which the unit tests do not run; the serializer call is a plain to_string over the already-parsed envelope
`src/mcp/transcript_tools.rs`	`ignore`	153-155	head	network-bound: reached only after Youtube::info fetches a real video page, which a unit test must not do; the serializer call is a plain to_string
`src/mcp/transcript_tools.rs`	`ignore`	162-164	head	network-bound: reached only after Youtube::list_languages fetches a real video page, which a unit test must not do; the serializer call is a plain to_string
`src/request_log.rs`	`ignore`	725	both	a blocking flock only fails on EINTR/ENOLCK, which a test cannot provoke; the fallback writes unlocked, as the best-effort contract requires
`src/sessions/watcher.rs`	`ignore`	148-151	both	read_dir yields an Err entry only on an I/O fault (EIO, a vanished directory mid-iteration), which a test cannot provoke; the scan counts it and moves on, the same handling as the unreadable project directory below
`src/sessions/watcher.rs`	`ignore`	159-162	both	read_dir yields an Err entry only on an I/O fault (EIO, a vanished directory mid-iteration), which a test cannot provoke; the scan counts it and moves on, the same handling as the unreadable project directory above
`src/sessions/watcher.rs`	`ignore`	174-177	both	DirEntry::metadata does not follow symlinks, so it fails only when the entry vanished between read_dir and the stat, a race a test cannot provoke; the scan counts it and moves on
`src/sessions/watcher.rs`	`ignore`	183-186	both	Metadata::modified fails only on a platform with no mtime, and every supported one (Linux, macOS) has it
`src/sessions/watcher.rs`	`ignore`	250-254	both	spawn_blocking's JoinError needs the scan closure to panic or the runtime to shut down mid-scan; scan has no panicking path, and the runtime outlives the watcher, whose token is cancelled first
`src/utils/secret_env.rs`	`ignore`	927-935	both	the loop above runs this 4 times and every mode fails the same way; verified locally that llvm-cov still reports 0 hits on the matches!( line — a region-attribution artifact on the nested assert!/matches! macro call, not an untested path
`src/utils/secret_env.rs`	`ignore`	1357	both	exercised by strip_test_modules_ignores_braces_in_literals_and_comments's '{' char literal; verified locally that llvm-cov still reports 0 hits — a region-attribution artifact on this closing brace, not an untested path
`src/utils/secret_env.rs`	`ignore`	1412	both	only runs if an unregistered secret-shaped literal exists; the assert below that unknown is empty is this test's whole point, so a passing run never takes this branch
`src/utils/secret_env.rs`	`ignore`	1470-1472	both	only runs if a registered secret is read through a plain accessor outside this module; offenders.is_empty() below is this test's whole point
`src/utils/secret_env.rs`	`ignore`	1516	both	only runs if a _FILE companion collides with an existing variable; collisions.is_empty() below is this test's whole point
`src/utils/secret_env.rs`	`ignore`	1545	both	only runs if a stray file names the companion; strays.is_empty() below is this test's whole point
`src/utils/secret_env/command.rs`	`ignore`	281-290	both	try_wait on a live, owned child fails only if waitpid itself errors (ECHILD/EINTR from outside the process); no in-process test can provoke it, and the arm only reaps and reports
`src/utils/settings.rs`	`ignore`	888-890	both	process-bound: binds the real process env and the settings file on disk; get_env_vars_with is the tested core

Touched files absent from every coverage report (11)

ARCHITECTURE.md
CLAUDE.md
Cargo.lock
Cargo.toml
changelog.d/2242.changed.md
docs/STYLE_GUIDE.md
docs/adrs/adr-0001.md
examples/jev_route_eval.rs
src/jev/route/effort_tests.rs
tests/commit_guidelines_scopes_test.rs
tests/mcp_integration_test.rs

These files may contain no executable code or may have been omitted from the coverage run.

Patch coverage

Patch: 99.25% (395/398 new lines covered)

File	Patch	Uncovered new lines
`src/atlassian/auth.rs`	100% (2/2)	—
`src/atlassian/create.rs`	100% (4/4)	—
`src/atlassian/custom_fields.rs`	100% (96/96)	—
`src/atlassian/document.rs`	100% (23/23)	—
`src/atlassian/transition_fields.rs`	100% (3/3)	—
`src/claude/context/discovery.rs`	94.59% (35/37)	1148, 1152
`src/claude/model_config.rs`	100% (21/21)	—
`src/cli/ai/claude/history.rs`	100% (4/4)	—
`src/cli/ai/claude/history/markdown.rs`	100% (2/2)	—
`src/cli/ai/claude/history/sync.rs`	100% (1/1)	—
`src/cli/ai/claude/skills.rs`	100% (3/3)	—
`src/cli/ai/claude/skills/clean.rs`	100% (2/2)	—
`src/cli/ai/claude/skills/status.rs`	100% (2/2)	—
`src/cli/ai/claude/skills/sync.rs`	100% (2/2)	—
`src/cli/ai/jev/ask.rs`	100% (1/1)	—
`src/cli/ai/jev/common.rs`	100% (2/2)	—
`src/cli/atlassian/confluence/move_page.rs`	100% (1/1)	—
`src/cli/atlassian/confluence/restriction.rs`	100% (1/1)	—
`src/cli/atlassian/helpers.rs`	100% (3/3)	—
`src/cli/atlassian/jira/comment.rs`	100% (1/1)	—
`src/cli/atlassian/jira/create.rs`	100% (3/3)	—
`src/cli/config.rs`	100% (1/1)	—
`src/cli/format.rs`	100% (9/9)	—
`src/cli/git/create_pr.rs`	94.12% (16/17)	279
`src/cli/snowflake.rs`	100% (1/1)	—
`src/cli/transcript/youtube/sync.rs`	100% (1/1)	—
`src/cli/worktrees/ui/row_colors.rs`	100% (2/2)	—
`src/cli/worktrees/ui/session_layout.rs`	100% (5/5)	—
`src/data/amendments.rs`	100% (1/1)	—
`src/data/check.rs`	100% (2/2)	—
`src/data/yaml.rs`	100% (54/54)	—
`src/datadog/auth.rs`	100% (1/1)	—
`src/git/commit.rs`	100% (3/3)	—
`src/jev/exists.rs`	100% (1/1)	—
`src/jev/route.rs`	100% (8/8)	—
`src/jev/verify.rs`	100% (1/1)	—
`src/mcp/config_tools.rs`	100% (1/1)	—
`src/mcp/confluence_tools.rs`	100% (2/2)	—
`src/mcp/datadog_tools.rs`	100% (14/14)	—
`src/mcp/dry_run.rs`	100% (1/1)	—
`src/mcp/jev_tools.rs`	100% (1/1)	—
`src/mcp/jira_core_tools.rs`	100% (8/8)	—
`src/mcp/jira_tools.rs`	100% (44/44)	—
`src/mcp/output_file.rs`	100% (1/1)	—
`src/mcp/snowflake_tools.rs`	100% (1/1)	—
`src/transcript/sources/youtube/metadata.rs`	100% (4/4)	—

Uncovered new lines (3)

src/claude/context/discovery.rs:1148
src/claude/context/discovery.rs:1152
src/cli/git/create_pr.rs:279

Indirect coverage changes

🔴 0 lines lost coverage, 🟢 32 lines gained coverage on unchanged code.

Indirect changes

src/claude/context/discovery.rs:655 🟢 uncovered → covered
src/claude/context/discovery.rs:657 🟢 uncovered → covered
src/claude/context/discovery.rs:658 🟢 uncovered → covered
src/claude/context/discovery.rs:659 🟢 uncovered → covered
src/claude/context/discovery.rs:660 🟢 uncovered → covered
src/claude/context/discovery.rs:661 🟢 uncovered → covered
src/claude/context/discovery.rs:675 🟢 uncovered → covered
src/claude/context/discovery.rs:737 🟢 uncovered → covered
src/claude/context/discovery.rs:738 🟢 uncovered → covered
src/claude/context/discovery.rs:739 🟢 uncovered → covered
src/claude/context/discovery.rs:740 🟢 uncovered → covered
src/claude/context/discovery.rs:741 🟢 uncovered → covered
src/claude/context/discovery.rs:742 🟢 uncovered → covered
src/claude/context/discovery.rs:743 🟢 uncovered → covered
src/claude/context/discovery.rs:752 🟢 uncovered → covered
src/claude/context/discovery.rs:753 🟢 uncovered → covered
src/claude/context/discovery.rs:754 🟢 uncovered → covered
src/claude/context/discovery.rs:755 🟢 uncovered → covered
src/claude/context/discovery.rs:757 🟢 uncovered → covered
src/claude/context/discovery.rs:758 🟢 uncovered → covered
src/claude/context/discovery.rs:759 🟢 uncovered → covered
src/claude/context/discovery.rs:760 🟢 uncovered → covered
src/claude/context/discovery.rs:761 🟢 uncovered → covered
src/claude/context/discovery.rs:762 🟢 uncovered → covered
src/claude/context/discovery.rs:763 🟢 uncovered → covered
src/claude/context/discovery.rs:764 🟢 uncovered → covered
src/claude/context/discovery.rs:765 🟢 uncovered → covered
src/claude/context/discovery.rs:766 🟢 uncovered → covered
src/claude/context/discovery.rs:767 🟢 uncovered → covered
src/claude/context/discovery.rs:776 🟢 uncovered → covered
src/claude/context/discovery.rs:777 🟢 uncovered → covered
src/data/yaml.rs:83 🟢 uncovered → covered

_{📦 Full per-file coverage summary · run summary}

Swap serde_yaml for the API-compatible serde_norway fork and yaml-rust-davvid for yaml-rust2, clearing RUSTSEC-2024-0449 (unsafe-libyaml) and RUSTSEC-2021-0153 (encoding). The 52-file migration is a mechanical rename; parsing is unchanged. yaml-rust2's literal-block emitter writes |- for multiline strings without a trailing newline and quotes ones that cannot be a literal block. It is never worse than the emitter it replaces on a probe of 13 multiline shapes; tests pin the three shapes it changes.

Add tests for tagged-value serialization, ProjectDiscovery scope and feature-context loading (valid and malformed), and extract the PR details parse into parse_pr_details so it can be tested. Replace the short-circuiting round-trip assertions in data::yaml with a single exact comparison, and mark the three serializer calls that only run after a live bridge or YouTube response as process-bound.

newhoggy added this pull request to the merge queue Nov 10, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Nov 10, 2026

newhoggy force-pushed the issue-2242-replace-yaml-crates branch 2 times, most recently from 6c9253f to bdf7477 Compare November 10, 2026 11:47

newhoggy added 2 commits November 10, 2026 23:16

newhoggy force-pushed the issue-2242-replace-yaml-crates branch from bdf7477 to 13636c7 Compare November 10, 2026 12:16

newhoggy added this pull request to the merge queue Nov 10, 2026

Merged via the queue into main with commit 71ebf6e Nov 10, 2026
19 checks passed

newhoggy deleted the issue-2242-replace-yaml-crates branch November 10, 2026 12:38

Navigation Menu

Repository navigation

chore(cargo): replace unmaintained serde_yaml and yaml-rust-davvid - #2244

chore(cargo): replace unmaintained serde_yaml and yaml-rust-davvid#2244
newhoggy merged 2 commits into
mainfrom
issue-2242-replace-yaml-crates

newhoggy commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

newhoggy commented Nov 10, 2026

Description

Type of Change

Related Issue

Changes Made

Testing

Review Focus Areas

Checklist

Security Considerations

Additional Notes

Uh oh!

github-actions Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage

Patch coverage

Indirect coverage changes

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Nov 10, 2026 •

edited

Loading