serde_yaml is a long-term risk, since it's unmaintained.

It also doesn't have great support for things like anchors and aliases -- this isn't currently an issue, but if the people over at actions/runner#1182 have their way (which I hope they don't) it will eventually become one.

The up-and-coming alternative appears to be saphyr, which claims YAML 1.2 conformance and apparently has anchor/alias modeling on its roadmap. They also appear to have a much richer IR than serde_yaml does, which would potentially come in handy in a refactor of the patching layer.