Triggered transitively as: bincode 1.3.3 <- syntect 5.3.0 <- koda-cli This is an *unmaintained* advisory, not a vulnerability. There is no CVE. The crate works correctly; the maintainers just stopped 1.x publishing after the 2.x rewrite. Why we cannot trivially fix: - syntect 5.3.0 (latest, released 2025-09-27) still depends on bincode 1.3 on master. No migration in flight: trishume/syntect#623 and trishume/syntect#606 (both still open, zero PRs). - Disabling syntect's `default-syntaxes` / `default-themes` features to drop bincode would force us to ship and parse raw .sublime-syntax / .tmTheme files at startup, a meaningful cold-start regression. Why we are not exposed: - All bincode deserialization happens at koda-cli startup against syntect's static, build-time-embedded payloads. We never feed user-controlled bytes through bincode. The advisory has been triggering the security audit job since it was filed; pre-existing, not a regression introduced by any koda commit. Matches the existing pattern for RUSTSEC-2026-0097 in this file. Track resolution by watching trishume/syntect#623 for upstream bincode-2 work. Closes #935.

bincode is unmaintained #623

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

`bincode` is unmaintained #623