chore(deps-rs): bump the minor group across 1 directory with 4 updates

[dependabot]

Bumps the minor group with 4 updates in the / directory: serde_with, ordered-float, pest and pest_derive.

Updates serde_with from 3.21.0 to 3.22.0

Release notes

Sourced from serde_with's releases.

serde_with v3.22.0

Added

• Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

• Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

Commits

• 88f576a Bump version to 3.22.0 (#991)
• 931e664 Bump version to 3.22.0
• e26930e Bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group (...
• 92cd5a0 Bump github/codeql-action in the github-actions group
• 32be66f Guard with_capacity_and_hasher against untrusted size_hint (DoS) (#971)
• 33871cd Merge branch 'master' into fix/duplicate-key-impls-capacity-overflow
• bb1e064 Change function position within impl (#968)
• 202d3dd Improve the time unit macros to remove unnecessary repetition and make the co...
• b347efb Move the use_duration_signed_ser/*_de macros utils
• 6590545 chrono_0_4: Implement the same time unit macro cleanup as jiff_0_2
• Additional commits viewable in compare view

Updates ordered-float from 5.3.0 to 5.5.0

Release notes

Sourced from ordered-float's releases.

v5.5.0

• Minimum supported Rust version increased from 1.63 to 1.90.
• feat: derive Facet if facet feature is active by @​Erik1000 in #179

Full Changelog: reem/rust-ordered-float@v5.4.0...v5.5.0

v5.4.0

What's Changed

• Add From<OrderedFloat<f32>> for OrderedFloat<f64> by @​gechelberger in reem/rust-ordered-float#183
• impl_proptest: use core instead of std by @​tsionyx in reem/rust-ordered-float#180
• bump schemars to 1.2 by @​mdepta42 in reem/rust-ordered-float#174

New Contributors

• @​tsionyx made their first contribution in reem/rust-ordered-float#180
• @​mdepta42 made their first contribution in reem/rust-ordered-float#174

Full Changelog: reem/rust-ordered-float@v5.3.0...v5.4.0

Commits

• 2d56f3e v5.5.0
• 4496ef7 feat: derive Facet if facet feature is active
• 2409c9f v5.4.0
• 2730f18 cargo update
• 015fc41 add schemars 1.2 support
• 4b03969 refactor schemars related tests
• 424f9ac rustfmt
• 51764f1 impl_proptest: use core instead of std (#180)
• ccf51f5 Add From<OrderedFloat> for OrderedFloat<f64> (#183)
• See full diff in compare view

Updates pest from 2.8.8 to 2.9.0

Release notes

Sourced from pest's releases.

v2.9.0

What's Changed

• fix: restore stack state after a failed sequence by @​Baltsat in pest-parser/pest#1184
• fix: silence compiler and clippy warnings in tests and generator by @​NiltonVolpato in pest-parser/pest#1186
• fix(debugger): upgrade rustyline to 13 for loongarch64 support by @​tangaac in pest-parser/pest#1187
• fix(fuzz): set edition 2021 and add sql fuzz target by @​estr3llas in pest-parser/pest#1189
• Add support for a fully-functional const PrattParser with optional macro for increased ergonomics by @​NiltonVolpato in pest-parser/pest#1185
• Add fuzzing dictionaries and document them in FUZZING.md by @​estr3llas in pest-parser/pest#1191
• Reject unescaped control characters in the JSON grammar by @​hdimer in pest-parser/pest#1190

New Contributors

• @​Baltsat made their first contribution in pest-parser/pest#1184
• @​NiltonVolpato made their first contribution in pest-parser/pest#1186
• @​tangaac made their first contribution in pest-parser/pest#1187
• @​estr3llas made their first contribution in pest-parser/pest#1189
• @​hdimer made their first contribution in pest-parser/pest#1190

Full Changelog: pest-parser/pest@v2.8.8...v2.9.0

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

Commits

• d9b29b6 bump version to 2.9.0 (#1192)
• f0998ee Reject unescaped control characters in the JSON grammar (#1190)
• fa9e187 Add fuzzing dictionaries and document them in FUZZING.md (#1191)
• c3a6956 Add support for a fully-functional const PrattParser with optional macro for ...
• 6f29d56 fix(fuzz): set edition 2021 and add sql fuzz target (#1189)
• 4614db3 fix(debugger): upgrade rustyline to 13 for loongarch64 support (#1187)
• f95efcd fix: silence compiler and clippy warnings in tests and generator (#1186)
• 0f501a1 fix: restore stack state after a failed sequence (#1184)
• See full diff in compare view

Updates pest_derive from 2.8.8 to 2.9.0

Release notes

Sourced from pest_derive's releases.

v2.9.0

What's Changed

• fix: restore stack state after a failed sequence by @​Baltsat in pest-parser/pest#1184
• fix: silence compiler and clippy warnings in tests and generator by @​NiltonVolpato in pest-parser/pest#1186
• fix(debugger): upgrade rustyline to 13 for loongarch64 support by @​tangaac in pest-parser/pest#1187
• fix(fuzz): set edition 2021 and add sql fuzz target by @​estr3llas in pest-parser/pest#1189
• Add support for a fully-functional const PrattParser with optional macro for increased ergonomics by @​NiltonVolpato in pest-parser/pest#1185
• Add fuzzing dictionaries and document them in FUZZING.md by @​estr3llas in pest-parser/pest#1191
• Reject unescaped control characters in the JSON grammar by @​hdimer in pest-parser/pest#1190

New Contributors

• @​Baltsat made their first contribution in pest-parser/pest#1184
• @​NiltonVolpato made their first contribution in pest-parser/pest#1186
• @​tangaac made their first contribution in pest-parser/pest#1187
• @​estr3llas made their first contribution in pest-parser/pest#1189
• @​hdimer made their first contribution in pest-parser/pest#1190

Full Changelog: pest-parser/pest@v2.8.8...v2.9.0

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

Commits

• d9b29b6 bump version to 2.9.0 (#1192)
• f0998ee Reject unescaped control characters in the JSON grammar (#1190)
• fa9e187 Add fuzzing dictionaries and document them in FUZZING.md (#1191)
• c3a6956 Add support for a fully-functional const PrattParser with optional macro for ...
• 6f29d56 fix(fuzz): set edition 2021 and add sql fuzz target (#1189)
• 4614db3 fix(debugger): upgrade rustyline to 13 for loongarch64 support (#1187)
• f95efcd fix: silence compiler and clippy warnings in tests and generator (#1186)
• 0f501a1 fix: restore stack state after a failed sequence (#1184)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.61%. Comparing base (b15dfdb) to head (b83ae7b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3212   +/-   ##
=======================================
  Coverage   81.61%   81.61%           
=======================================
  Files         242      242           
  Lines       47649    47649           
  Branches    41246    41246           
=======================================
  Hits        38888    38888           
  Misses       6737     6737           
  Partials     2024     2024           

Flag	Coverage Δ
python	89.39% <ø> (ø)
rust	80.40% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[codspeed-hq]

Merging this PR will degrade performance by 21.73%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 8 regressed benchmarks
✅ 35 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	serialization/big_hugr/1048576/sexpr/without_extensions/decode	256.7 ms	361.5 ms	-28.99%
❌	serialization/big_hugr/1048576/sexpr/with_extensions/decode	256.8 ms	361.6 ms	-28.98%
❌	serialization/t_factory/sexpr/without_extensions/decode	1.4 s	1.9 s	-22.98%
❌	serialization/t_factory/sexpr/with_extensions/decode	1.5 s	1.9 s	-22.7%
❌	serialization/big_hugr/1024/sexpr/without_extensions/decode	738.3 µs	921 µs	-19.84%
❌	serialization/big_hugr/1024/sexpr/with_extensions/decode	844.6 µs	1,022.9 µs	-17.43%
❌	serialization/simple_cfg/sexpr/without_extensions/decode	2.9 ms	3.5 ms	-17.18%
❌	serialization/simple_cfg/sexpr/with_extensions/decode	3.5 ms	4.1 ms	-14.39%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/cargo/minor-6e71564ea2 (b83ae7b) with main (b15dfdb)}

[aborgna-q]

@codspeedbot explain this regression

[codspeed-hq]

@codspeedbot explain this regression

Root cause: the pest 2.8.8 → 2.9.0 bump

The regression is real (not runner noise), and it comes entirely from pest. The other three bumps (serde_with, ordered-float, pest_derive's codegen) are not involved.

Evidence

1. The whole slowdown is inside the pest parse phase. Comparing the flamegraphs of serialization/big_hugr/1024/sexpr/without_extensions/decode between main (b15dfdb) and this branch:

	base (pest 2.8.8)	head (pest 2.9.0)
Benchmark total	738.3 µs	921.0 µs
pest::parser_state::state::<…> (the parse)	519.3 µs (70.3%)	701.4 µs (76.2%)

The parse phase grows by +182 µs, and the benchmark grows by +182.7 µs. The subsequent hugr_model AST conversion and hugr_core import are unchanged — this is a pure parser regression.

Two pest internals show up as new hot spots on head that were not significant on base:

• pest::stack::Stack::clear_snapshot — 77.5 µs total (8.4%), with Vec::drain + drop-glue as children
• pest::stack::Stack::restore — 37 µs total (4.0%)

2. Reverting only pest fixes it. I built this branch locally and re-ran the affected benchmarks with everything from this PR kept, downgrading only pest 2.9.0 → 2.8.8 in the lockfile:

Benchmark	pest 2.9.0	pest 2.8.8	Local Δ	CodSpeed Δ
simple_cfg/sexpr/without_extensions/decode	293.5 µs	244.9 µs	−16.9%	+17.18%
big_hugr/1024/sexpr/without_extensions/decode	60.5 µs	48.2 µs	−20.0%	+19.84%

Same machine, same binary otherwise — the local deltas match the CodSpeed report almost exactly, which also confirms the runner-hardware difference flagged in the report is not what you are seeing here.

Why pest 2.9.0 is slower

It is the fix from pest#1184 ("restore stack state after a failed sequence"), which lands in two places:

1. ParserState::sequence now wraps every sequence in a stack checkpoint:

   let result = f(self.checkpoint());   // was: f(self)
   match result {
       Ok(new_state)  => Ok(new_state.checkpoint_ok()),
       Err(new_state) => Err(new_state.restore()),
   }

   So each sequence now does a Stack::snapshot plus a clear_snapshot/restore, where before it did nothing.

2. Stack::clear_snapshot itself became more expensive. It used to be a Vec::pop plus a truncate; it now has to merge the snapshot into its parent frame and does a Vec::drain (memmove + drop glue) to do so.

Why it hits HUGR s-expression decoding so hard

hugr.pest matches strings and identifiers character by character, e.g.

literal_string_raw = @{ (!("\\" | "\"") ~ ANY)+ }

Each repetition of that rule is a sequence, so the new checkpoint/clear-snapshot pair now runs once per character of every string literal. That rule alone went from 194.6 µs (26.4%) to 284.9 µs (30.9%) of the benchmark; the rest of the cost is spread over the other sequence-heavy rules (term, node, skip). The capnp decode paths do not use pest, which is exactly why only the sexpr/*/decode benchmarks moved.

Suggested handling

This is an upstream correctness fix, so there is nothing to fix in this repo — I have not changed anything on the branch. Your options:

• Accept it and acknowledge the regressions on CodSpeed. Note that HUGR's grammar does use PUSH/POP/PEEK (in raw_symbol_name), so the correctness fix is not purely theoretical for you.
• Pin pest to 2.8.8 if the ~15–29% s-expression decode cost matters more right now, and revisit once upstream optimises the new stack bookkeeping. Worth raising with pest — the per-sequence snapshot is paid by every grammar, even ones that barely touch the stack.
• Grammar-side mitigation, if you want the win back regardless of pest version: reducing the number of per-character sequences in the string/identifier rules would cut the dominant half of the cost. Happy to prototype that if useful.

Summary

• Warming up the performance wizard...
• Investigate the sexpr decode regression — Flamegraph diff shows 100% of the slowdown is inside pest's parser state machine.
• Isolate which dependency causes it — Reverting only pest 2.9.0 -> 2.8.8 locally restores performance (-16.9% / -20.0%), matching the reported regressions.
• Explain root cause — Root cause is the pest 2.9.0 stack-restore fix (ci(deps): bump dawidd6/action-download-artifact from 4 to 5 #1184); no repository changes needed.
• Handling comment — Comment handling finished successfully

_{Was this response helpful? React with 👍 or 👎 to help us improve CodSpeedBot.}

[aborgna-q]

@dependabot ignore pest minor version
@dependabot ignore pest_derive minor version

[dependabot]

OK, I won't notify you about version 2.9.x of pest again, unless you unignore it.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.