chore(deps): bump transitive serde_with and time out of vulnerable ranges

.github/workflows/enforce-pr-target.yml

@@ -81,7 +81,21 @@ jobs:
                   github.rest.repos.listPullRequestsAssociatedWithCommit,
                   { owner, repo, commit_sha: statusSha, per_page: 100 }
                 );
-                candidates = associatedPrs.filter(
+                // The index spans the whole fork network: a commit that heads
+                // a PR in another repository comes back with that PR's number,
+                // which `pulls.get` cannot resolve in THIS repository (404).
+                // Only a candidate based on this repository is usable identity.
+                const inRepoPrs = associatedPrs.filter(
+                  candidate =>
+                    candidate.base?.repo?.owner?.login === owner &&
+                    candidate.base?.repo?.name === repo
+                );
+                if (inRepoPrs.length !== associatedPrs.length) {
+                  core.info(
+                    `Ignored ${associatedPrs.length - inRepoPrs.length} associated PR(s) based on other repositories in the fork network.`
+                  );
+                }
+                candidates = inRepoPrs.filter(
                   candidate =>
                     candidate.state === "open" &&
                     candidate.head?.sha === statusSha