noyalib v0.0.56

By Sebastien Rousseau, maintainer of noyalib and its five companion crates. Last reviewed 8 October 2026.

What changed

v0.0.55 fixed every finding of the audit. A few hardening items were left open because the obvious fix would have broken the public API. This release closes them without that break.

Fixed

• No value too deep to drop. Dropping, cloning, printing or serializing a value recurses once per level. Nesting is now capped at 256 levels on every path, even when max_depth is raised, and a value read from another serde format stops there too, so none of those operations can overflow a small thread stack.
• max_events holds before buffering. A key inside a flow mapping may be any length, so the scanner used to tokenise a long one whole before the event budget could refuse it. It now stops as soon as the backlog proves the document is over budget.
• The serde_yaml shim matches upstream on repeated struct fields. It now refuses duplicate field `k` as serde_yaml 0.9 does.
• The MCP server is on npm. npx @sebastienrousseau/noyalib-mcp downloads the binary for your platform and runs it only if its checksum matches the one published with the package.

Security advisories

The fourteen advisories published for noyalib, noyalib-mcp, noyalib-wasm and noya-cli have CVE requests filed with GitHub. Each advisory page shows its CVE once it is assigned.

Upgrading

Bump every noyalib crate you use to 0.0.56. Input nested deeper than 256 levels is now refused whatever max_depth says, and the serde_yaml shim refuses documents that repeat a struct field. The VS Code extension needs VS Code 1.91 or later.