serde 1.0.229: Flattening an Option<T> field with serde silently instantiates Some(T) with all None fields when input keys are completely missing instead of evaluating to None

/target

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "cargo-serde-version"
version = "0.1.0"
dependencies = [
 "serde",
 "serde_json",
]

[[package]]
name = "itoa"
version = "1.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

[[package]]
name = "memchr"
version = "2.8.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

[[package]]
name = "proc-macro2"
version = "1.0.107"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
dependencies = [
 "unicode-ident",
]

[[package]]
name = "quote"
version = "1.0.47"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
dependencies = [
 "proc-macro2",
]

[[package]]
name = "serde"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
dependencies = [
 "serde_core",
 "serde_derive",
]

[[package]]
name = "serde_core"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
dependencies = [
 "serde_derive",
]

[[package]]
name = "serde_derive"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
dependencies = [
 "proc-macro2",
 "quote",
 "syn",
]

[[package]]
name = "serde_json"
version = "1.0.151"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
dependencies = [
 "itoa",
 "memchr",
 "serde",
 "serde_core",
 "zmij",
]

[[package]]
name = "syn"
version = "3.0.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
dependencies = [
 "proc-macro2",
 "quote",
 "unicode-ident",
]

[[package]]
name = "unicode-ident"
version = "1.0.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

[[package]]
name = "zmij"
version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

[package]
name = "cargo-serde-version"
version = "0.1.0"
edition = "2021"

[dependencies]
serde = { version = "1.0.229", features = ["derive"] }
serde_json = "1.0.151"

# Notes

### What search_known_solution answered
`search_known_solution` returned existing published samples `sha256:09e96f8c79cbf50ce6b866bd22ff765f17ef8c35bc22f9e6dc03f4b9e59507db` (borrowed `&'a str` vs `Cow<'a, str>` zero-copy JSON escape sequence failures), `sha256:e583be8e3c3e9cb793e93e1be28e4fe841fe73406f39ed227bf494cc911856f0` (serde derive feature unification masking missing crate features), and `sha256:cb27e7063ed8a2f410b07c5317677ee8a2f3d5b351bafda6c3862fab5a213a3e` (untagged enum deserialization error swallowing).

### What a model would have written instead
A model would have written `assert_eq!(parsed.endpoint, None)` and structured downstream initialization around `if let Some(endpoint) = &config.endpoint { ... }` expecting it to only execute when endpoint keys were present in the payload.

### How the wrong version fails
Silently with a green build: deserialization succeeds without error and populates `Some(OptionalEndpointConfig { host: None, port: None })`, causing downstream feature gates and connection setup blocks to activate unexpectedly despite zero configuration keys being provided in the input payload.

{"case":{"caseId":"case:sha256:46d7f4fc7a680639097741a393039c2300b7090b0da679db08126f19f0e5b53c","contract":["Deserializing into Option\u003cT\u003e via #[serde(flatten)] where T has all Option fields returns Some(T) with None fields even when no relevant keys are present in JSON","Deserializing into Option\u003cT\u003e via #[serde(flatten)] where T has required fields without defaults fails inner parsing and returns None when keys are missing","Branching logic relying on if let Some(...) on flattened Option structs silently executes unexpectedly when inner fields are optional"],"goal":"Flattening an Option\u003cT\u003e field with serde silently instantiates Some(T) with all None fields when input keys are completely missing instead of evaluating to None","kind":"HOW","packages":["pkg:cargo/serde@1.0.229"],"schemaVersion":1,"symbols":["serde::Deserialize"]},"contractCommand":["cargo","test","--offline"],"environment":{"arch":"x64","ecosystem":"cargo","executionContext":"rust","language":"rust","os":"linux","packageManager":"cargo","runtime":"rust","schemaVersion":1},"license":"MIT-0","packages":["pkg:cargo/serde@1.0.229"],"schemaVersion":1,"symbols":["serde::Deserialize"],"verifierAdapter":"cargo@1"}

use serde::Deserialize;

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct OptionalEndpointConfig {
    pub host: Option<String>,
    pub port: Option<u16>,
}

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct RequiredEndpointConfig {
    pub host: String,
    pub port: Option<u16>,
}

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct ServiceConfigOptional {
    pub service_name: String,
    #[serde(flatten)]
    pub endpoint: Option<OptionalEndpointConfig>,
}

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct ServiceConfigRequired {
    pub service_name: String,
    #[serde(flatten)]
    pub endpoint: Option<RequiredEndpointConfig>,
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_serde_flatten_option_silent_instantiation() {
        // Payload contains NO endpoint-related keys
        let payload = r#"{"service_name": "worker"}"#;

        // Case 1: When the flattened struct has at least one required field without default,
        // deserializing the inner struct against empty remainder fails,
        // so serde's flatten catches the failure and falls back to `None`.
        let req: ServiceConfigRequired = serde_json::from_str(payload).unwrap();
        assert_eq!(req.endpoint, None);

        // Case 2: When the flattened struct has all optional fields (or defaults),
        // deserializing the inner struct against empty remainder SUCCEEDS.
        // Serde therefore assigns `Some(OptionalEndpointConfig { host: None, port: None })`
        // rather than `None`.
        let opt: ServiceConfigOptional = serde_json::from_str(payload).unwrap();

        // A naive model confidently expects `opt.endpoint == None` because no endpoint keys exist.
        // This assertion proves it is NOT None:
        assert_ne!(opt.endpoint, None);
        assert_eq!(
            opt.endpoint,
            Some(OptionalEndpointConfig {
                host: None,
                port: None,
            })
        );
    }
}