Repository navigation
Replace unmaintained "bincode" serialization/deserialization dependency with "wincode" #2207
Description
The bincode library used for serializing and deserializing has been marked as unmaintained (RUSTSEC-2025-0141).
The maintainer makes several replacement recommendations as do RUSTSEC:
-
wincode - this is quite recent
-
postcard - maintainer has many Rust libraries they maintain, lots of activity, appears stable, drop-in replacement, 60+ contributors, used by 7,000+ other repos
-
bitcode - seems fine, but lower activity and not many maintainers
-
rkyv - looks good, but would require many more changes across the codebase to implement
I've done up a PR to replace bincode with postcard, enjoy! 😁
Activity
ocean commentedon Jan 8, 2026
postcardserialization output is not the same asbincode, so this has broken compatibility with thego-libsqllibrary and possibly other bindings.wincodeis apparently compatible directly withbincodeso investigating that now.ocean commentedon Jan 14, 2026
I fixed this by replacing
bincodewithwincode, which provides binary compatible serializations, so the PR now passes all the tests and is ready for someone too look at 👀[-]Replace unmaintained "bincode" serialization/deserialization dependency with "postcard"[/-][+]Replace unmaintained "bincode" serialization/deserialization dependency with "wincode"[/+]theodore-s-beers commentedon Jan 31, 2026
Sadly, it's worse than unmaintained. The erstwhile maintainer published a version 3.0.0 to crates.io, whose entire source code is as follows:
Definitely a good idea to migrate. I moved my projects to postcard, at the cost of re-serializing.
(found this thread while googling to try to figure out what on earth happened to bincode)
ocean commentedon Apr 1, 2026
@penberg Are you able to have a look at this please?