Rust serde

A #[derive(Deserialize)] is a parser and a published schema at the same time. Most serde incidents are silent: a field stays at its default, a number loses digits, or an older build can no longer read a payload.

Behavior below was measured with serde 1.0.229, serde_json 1.0.151, postcard 1.1.3, and bincode 2.0.1 on Rust 1.98.1.

Find the contracts

Run these when you audit a crate or change a type that already shipped:

# Types whose encoding is a contract with something outside this process.
rg -n '#\[derive\([^)]*Deserialize' --type rust

# Every serde attribute. Each one is a wire-format decision.
rg -n '#\[serde\(' --type rust