From 88aa4b13104f1e8a3e2d07874a0bf290de2ffc38 Mon Sep 17 00:00:00 2001
From: iven <iven_h@qq.com>
Date: Mon, 30 Mar 2026 18:23:13 +0800
Subject: [PATCH] =?UTF-8?q?refactor:=20=E4=BE=9D=E8=B5=96=E5=81=A5?=
 =?UTF-8?q?=E5=BA=B7=E5=BA=A6=E6=94=B9=E8=BF=9B=20=E2=80=94=20serde=5Fyaml?=
 =?UTF-8?q?=20=E8=BF=81=E7=A7=BB=20+=20workspace=20=E7=BB=9F=E4=B8=80?=
 =?UTF-8?q?=E5=A3=B0=E6=98=8E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- zclaw-pipeline: serde_yaml 0.9 → serde_yaml_bw 2.x (drop-in fork, panic-free)
  使用 package rename 保持代码中 use serde_yaml 不变
- zclaw-saas: regex/aes-gcm/bytes 改为 workspace 统一声明
  urlencoding/data-encoding 保留为 crate-local (仅此 crate 使用)
---
 Cargo.lock                       | 42 +++++++++++++++++++++++++++++++-
 crates/zclaw-pipeline/Cargo.toml |  2 +-
 crates/zclaw-saas/Cargo.toml     |  6 ++---
 3 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 9cea298..2caf4be 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -137,6 +137,12 @@ dependencies = [
  "password-hash",
 ]
 
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
 [[package]]
 name = "async-broadcast"
 version = "0.7.2"
@@ -4677,6 +4683,17 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "saphyr-parser-bw"
+version = "0.0.610"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d643f5e972f17219245b82f038c22cd3c74320bb17c6e8f7e8537de268b1bc6"
+dependencies = [
+ "arraydeque",
+ "smallvec",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -4984,6 +5001,23 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
+[[package]]
+name = "serde_yaml_bw"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b4d05b26468431333c4d16963433fe0e04ef24e4a7b568c9da81e91d25c0dbb"
+dependencies = [
+ "base64 0.22.1",
+ "indexmap 2.13.0",
+ "itoa",
+ "num-traits",
+ "regex",
+ "saphyr-parser-bw",
+ "serde",
+ "unsafe-libyaml-norway",
+ "zmij",
+]
+
 [[package]]
 name = "serialize-to-javascript"
 version = "0.1.2"
@@ -6541,6 +6575,12 @@ version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
+[[package]]
+name = "unsafe-libyaml-norway"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39abd59bf32521c7f2301b52d05a6a2c975b6003521cbd0c6dc1582f0a22104"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -8256,7 +8296,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_yaml_bw",
  "thiserror 2.0.18",
  "tokio",
  "tokio-test",
diff --git a/crates/zclaw-pipeline/Cargo.toml b/crates/zclaw-pipeline/Cargo.toml
index f1f5c6f..ee1ab25 100644
--- a/crates/zclaw-pipeline/Cargo.toml
+++ b/crates/zclaw-pipeline/Cargo.toml
@@ -12,7 +12,7 @@ tokio = { workspace = true }
 futures = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-serde_yaml = "0.9"
+serde_yaml = { package = "serde_yaml_bw", version = "2" }
 thiserror = { workspace = true }
 anyhow = { workspace = true }
 tracing = { workspace = true }
diff --git a/crates/zclaw-saas/Cargo.toml b/crates/zclaw-saas/Cargo.toml
index a97446a..eb30f27 100644
--- a/crates/zclaw-saas/Cargo.toml
+++ b/crates/zclaw-saas/Cargo.toml
@@ -43,9 +43,9 @@ argon2 = { workspace = true }
 totp-rs = { workspace = true }
 urlencoding = "2"
 data-encoding = "2"
-regex = "1"
-aes-gcm = "0.10"
-bytes = "1"
+regex = { workspace = true }
+aes-gcm = { workspace = true }
+bytes = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }