Replace serde_yaml with serde-saphyr to drop unsafe-libyaml

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
       cargo:
         patterns:
           - "*"
+        # serde-saphyr patches only its latest release, and its releases can change how YAML parses,
+        # so its bumps get their own pull request instead of waiting on unrelated breakage.
+        exclude-patterns:
+          - "serde-saphyr"
     cooldown:
       default-days: 7
   - package-ecosystem: "github-actions"

Cargo.toml

@@ -38,7 +38,9 @@ rayon = "1.10.0"
 regex = "1.11.1"
 serde = { version = "1.0.219", features = ["derive"] }
 serde_json = "1.0.143"
-serde_yaml = "0.9.34"
+# Deserialize only: `default-features = false` leaves out the serializer and YAML comment
+# capture, which we do not use.
+serde-saphyr = { version = "2.0.0", default-features = false, features = ["deserialize"] }
 similar = "3.2.0"
 tempfile = "3.21.0"
 tracing = "0.1.41"

README.md

@@ -214,6 +214,7 @@ codeowners gv --no-cache
 - `cache_directory` (default: `'tmp/cache/codeowners'`)
 - `ignore_dirs` (default includes: `.git`, `node_modules`, `tmp`, etc.)
 - `executable_name` (default: `'codeowners'`): Customize the command name shown in validation error messages. Useful when using `codeowners-rs` via wrappers like the [code_ownership](https://github.com/rubyatscale/code_ownership) Ruby gem.
+- `yaml_max_nodes` (default: `50000`): The most YAML nodes (mappings, sequences and scalars) allowed in one team file or `package.yml`. A file over the limit fails with `budget breached: Nodes`. Raise it if a large team file hits the limit; real files have at most a few thousand nodes. It does not apply to `config/code_ownership.yml` itself.
 
 Example configuration with custom executable name:
 

src/common_test.rs

@@ -1,10 +1,6 @@
 #[cfg(test)]
 pub mod tests {
-    use std::{
-        error::Error,
-        fs::{self, File},
-        path::PathBuf,
-    };
+    use std::{error::Error, fs, path::PathBuf};
 
     use indoc::indoc;
 
@@ -111,8 +107,7 @@ pub mod tests {
             fs::write(test_config.temp_dir_path.join(&project_file.relative_path), &project_file.content)?;
         }
 
-        let config_file = File::open(test_config.temp_dir_path.join(test_config.relative_code_ownership_config_yml_path))?;
-        let config: Config = serde_yaml::from_reader(config_file)?;
+        let config = Config::load_from_path(&test_config.temp_dir_path.join(test_config.relative_code_ownership_config_yml_path))?;
 
         let codeowners_file_path = &test_config.temp_dir_path.join(".github/CODEOWNERS");
         let cache: Cache = NoopCache::default().into();