The current all-features dependency graph still contains multiple externally-driven versions of reqwest/http/base64 and deprecated serde_yaml:\n\n- reqwest 0.11 via model-context-protocol\n- reqwest 0.12 via opentelemetry-otlp reqwest blocking client\n- reqwest 0.13 via workspace/genai\n- http 0.2 and 1.x through those stacks\n- serde_yaml 0.9 in runtime-contract and skills\n\nThis cannot be fully fixed inside this repo without either upstream dependency upgrades or a deliberate YAML parser migration. Track the work here so the codebase does not carry an untracked dependency-risk item.
The current all-features dependency graph still contains multiple externally-driven versions of reqwest/http/base64 and deprecated serde_yaml:\n\n- reqwest 0.11 via model-context-protocol\n- reqwest 0.12 via opentelemetry-otlp reqwest blocking client\n- reqwest 0.13 via workspace/genai\n- http 0.2 and 1.x through those stacks\n- serde_yaml 0.9 in runtime-contract and skills\n\nThis cannot be fully fixed inside this repo without either upstream dependency upgrades or a deliberate YAML parser migration. Track the work here so the codebase does not carry an untracked dependency-risk item.