Skip to content

[CHORE] Replace bincode (unmaintained) with a maintained serialization crate #187

@ElioNeto

Description

@ElioNeto

Description

cargo audit reports bincode v1.3.3 as unmaintained (RUSTSEC-2025-0141). The crate is used extensively throughout ApexStore for serializing WAL records, SSTable metadata, and more.

Impact

  • No security fixes for future vulnerabilities in bincode
  • No performance improvements
  • Risk of relying on unmaintained serialization in a storage engine

Recommendation

Evaluate replacements:

  • bincode v2.x (if stable)
  • postcard (no_std, binary, fast)
  • msgpack via rmp-serde
  • Custom compact encoding for WAL/SSTable formats

Severity

Medium — no known vulnerability in current bincode version, but unmaintained status is a risk.

Labels

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions