chore(deps): bump serde_json from 1.0.149 to 1.0.150

[dependabot]

Bumps serde_json from 1.0.149 to 1.0.150.

Release notes

Sourced from serde_json's releases.

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• dc8003a Raise required compiler for preserve_order feature to 1.85
• a42fa98 Unpin CI miri toolchain
• 684a60e Pin CI miri to nightly-2026-02-11
• 7c7da33 Raise required compiler to Rust 1.71
• acf4850 Simplify Number::is_f64
• 6b8ceab Resolve unnecessary_map_or clippy lint
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	63.0s (2 bridge agents)
Total	63.0s

💰 Value — sound

Routine patch-level dependabot bump of serde_json (149→150) touching only Cargo.lock; ship as-is.

• What it does: Re-pins serde_json in Cargo.lock from 1.0.149 to 1.0.150 and lets an incidental transitive syn version for data-encoding-macro-internal re-resolve; no source changes.
• Goals it achieves: Keep the dependency graph on the latest serde_json patch, picking up the v1.0.150 fix that rejects non-string enum object keys during deserialization.
• Assessment: Coherent and zero-touch. The workspace already declares serde_json = { version = "1.0" } (Cargo.toml:289), so a Cargo.lock pin bump is the correct and minimal expression of this update. The behavior delta (rejecting malformed non-string enum keys) is a strictness improvement with no realistic risk to this codebase.
• Better / existing approach: none — this is the right approach
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content

🎯 Usefulness — sound

Routine patch bump of a core workspace dependency (serde_json 1.0.149→1.0.150) consumed by 30+ crates; semver-compatible, correctness-improving release, lockfile-only change.

• Integration: serde_json is a direct workspace dependency (Cargo.toml:289, version = "1.0") consumed by ~30 crates via serde_json.workspace = true (cli, core, manager, auth, keystore, clients/*, qos, x402, tee, webhooks, etc.) and appears 133 times in Cargo.lock. Fully reachable and exercised on essentially every build path.
• Fit with existing patterns: Fits the established pattern exactly: all crates consume serde_json through the single workspace dependency declaration, and this bump lands within the existing '1.0' version spec with no Cargo.toml edits required. No competing JSON library is in use.
• Real-world viability: serde_json is battle-tested infrastructure. The 1.0.150 release tightens enum-key validation (rejects non-string enum object keys), which is a correctness improvement on realistic/malformed input rather than a happy-path-only change. Patch-level bumps carry no API surface risk for the existing call sites.
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260713T121325Z}

[tangletools]

✅ No Blockers — 3ff150af

Review health 100/100 · Reviewer score 95/100 · Confidence 65/100 · 0 findings (none)

glm: Correctness 95 · Security 95 · Testing 95 · Architecture 95

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 1/1 planned shots over 1 changed files. Global verifier still owns final merge decision.

No findings.

---

_{tangletools · 2026-07-13T12:13:53Z · trace}

[tangletools]

✅ Clean — 3ff150af

Full multi-shot audit completed 1/1 planned shots over 1 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-07-13T12:13:53Z · immutable trace}