9e2372b039ffecc969785ba32f8823c4bcebd9bf
serde_yml (RUSTSEC-2025-0068) and its libyml backend (RUSTSEC-2025-0067) are archived, unsound, and unmaintained with no patched version. Swap to serde_norway, the maintained serde_yaml fork on unsafe-libyaml-norway — a drop-in for our from_str / to_string / Value usage across persistence, undo, and the catalog parser. Clears both advisories (cargo audit / osv-scanner / grype all clean; serde_yml + libyml gone from the tree). No behaviour change; full suite 2151/0/1.
Description
No description provided