RUSTSEC-2024-0320: yaml-rust is unmaintained.

[github-actions]

yaml-rust is unmaintained.

Details
Status	unmaintained
Package	yaml-rust
Version	0.4.5
URL	rustsec/advisory-db#1921
Date	2024-03-20

The maintainer seems unreachable.

Many issues and pull requests have been submitted over the years
without any response.

Alternatives

Consider switching to the actively maintained yaml-rust2 fork of the original project:

• yaml-rust2
• yaml-rust2 @ crates.io)

See advisory page for additional details.

[kate-goldenring]

Updating serde_yaml should resolve this

[CeerDecy]

I want to contribute to this issue. Can I try it? @kate-goldenring

[kate-goldenring]

@CeerDecy that would be great! Thank you.

[CeerDecy]

@kate-goldenring I will upgrade the serde_yaml v0.8 to v0.9, and the package kube v0.80.0 also depends on the old version of serde_yaml. Should the dependencies kube v0.80.0 be upgraded to kube v0.87.2?

kube v0.80.0 dependencies are as follows:
kube v0.80.0 -> kube-client v0.80.0 -> serde_yaml v0.8.26 -> yaml-rust v0.4.5

[kate-goldenring]

@CeerDecy updating kube is quite involved as the API watcher and reconciliation has greatly changed. I am working on that right now for the controller, so we can also track that here, as well. For now, lets get in your serde_yaml update

[CeerDecy]

@kate-goldenring okay. I got it.
other serde_yaml has been updated and tested, please check this pr #701