replace unmaintained bincode with postcard

CHANGELOG.md

@@ -19,6 +19,7 @@
 ## Other
 
 - Bump MSRV to 1.88, update `time` crate to 0.3.47 to fix RUSTSEC-2026-0009, see #3581 (@NORMAL-EX)
+- Replace unmaintained `bincode` dependency with `postcard` to address RUSTSEC-2025-0141, see #3595 (@IMaloney)
 
 ## Syntaxes
 

Cargo.toml

@@ -44,7 +44,7 @@ regex-fancy = ["syntect/regex-fancy"] # Use the rust-only "fancy-regex" engine
 [dependencies]
 nu-ansi-term = "0.50.3"
 ansi_colours = "^1.2"
-bincode = "1.0"
+postcard = { version = "1.0", features = ["alloc"] }
 console = "0.16.2"
 flate2 = "1.1"
 once_cell = "1.20"

src/assets.rs

@@ -342,12 +342,19 @@ fn asset_from_contents<T: serde::de::DeserializeOwned>(
     description: &str,
     compressed: bool,
 ) -> Result<T> {
-    if compressed {
-        bincode::deserialize_from(flate2::read::ZlibDecoder::new(contents))
+    let data = if compressed {
+        use std::io::Read;
+        let mut decoder = flate2::read::ZlibDecoder::new(contents);
+        let mut decompressed = Vec::new();
+        decoder
+            .read_to_end(&mut decompressed)
+            .map_err(|_| format!("Could not decompress {description}"))?;
+        decompressed
     } else {
-        bincode::deserialize_from(contents)
-    }
-    .map_err(|_| format!("Could not parse {description}").into())
+        contents.to_vec()
+    };
+
+    postcard::from_bytes(&data).map_err(|_| format!("Could not parse {description}").into())
 }
 
 fn asset_from_cache<T: serde::de::DeserializeOwned>(

src/assets/build_assets.rs

@@ -142,17 +142,24 @@ pub(crate) fn asset_to_contents<T: serde::Serialize>(
     description: &str,
     compressed: bool,
 ) -> Result<Vec<u8>> {
-    let mut contents = vec![];
+    let serialized =
+        postcard::to_allocvec(asset).map_err(|_| format!("Could not serialize {description}"))?;
+
     if compressed {
-        bincode::serialize_into(
-            flate2::write::ZlibEncoder::new(&mut contents, flate2::Compression::best()),
-            asset,
-        )
+        let mut contents = vec![];
+        use std::io::Write;
+        let mut encoder =
+            flate2::write::ZlibEncoder::new(&mut contents, flate2::Compression::best());
+        encoder
+            .write_all(&serialized)
+            .map_err(|_| format!("Could not compress {description}"))?;
+        encoder
+            .finish()
+            .map_err(|_| format!("Could not finish compression for {description}"))?;
+        Ok(contents)
     } else {
-        bincode::serialize_into(&mut contents, asset)
+        Ok(serialized)
     }
-    .map_err(|_| format!("Could not serialize {description}"))?;
-    Ok(contents)
 }
 
 fn asset_to_cache<T: serde::Serialize>(

src/assets/serialized_syntax_set.rs

@@ -4,7 +4,7 @@ use syntect::parsing::SyntaxSet;
 
 use super::*;
 
-/// A SyntaxSet in serialized form, i.e. bincoded and flate2 compressed.
+/// A SyntaxSet in serialized form, i.e. postcard serialized and flate2 compressed.
 /// We keep it in this format since we want to load it lazily.
 #[derive(Debug)]
 pub enum SerializedSyntaxSet {