File bincode as unmaintained

[EthanPlant]

Resolves #2514

As per the issue comments, the maintainer has agreed with filing an advisory.

[nmccarty]

Hi, previous emergency keyholder for the bincode-org organization here (to clarify my role in the org, it was basically just to revoke the owners access in the event of compromise, which to restate, is not what happened here)

The 'updates will only happen in the event of a CVE' part should be dropped. Given the impact on trust from this situation, the owner has made the decision to permanently archive the bincode crate. The other crates.io owners have been removed from the crates.io entry, and she has deleted her github account to ensure that no further releases can be made, and to force trust to be boostrapped fresh when and if someone decides to pick maintenance back up.

[VictorKoenders]

Hi, previous developer for bincode here. To protect the supply chain that people seem to be more worried about than fellow humans, I have also decided to close virtue and unty, the two dependencies that bincode 2.0 depends on.

The remaining dependencies are:

• Bincode 1.3.3
  • serde
  • serde_bytes (dev)
  • serde_derive (dev)
• bincode 2.0
  • serde (optional)
  • ouroboros (dev)
  • serde_derive (dev)
  • serde_json (dev)
  • tempfile (dev)
  • criterion (dev)
  • rand (dev)
  • uuid (dev)
  • chrono (dev)
  • glam (dev)
  • bumpalo (dev)

[djc]

@VictorKoenders want to send a PR for those?

[VictorKoenders]

@VictorKoenders want to send a PR for those?

Considering my previous interaction with this repo in #1254 (comment) , no I do not want to send in a PR

[djc]

Suggested change

	```
	# Bincode is unmaintained
	Development on bincode has ceased permanently, and updates will only be made in the event of a CVE. Projects are encouraged to migrate to alternatives such as `postcard` if possible. If compatibilty with the bincode format is required, consider using `wincode`.
	## Alternatives
	- [wincode](https://crates.io/crates/wincode) - Bincode-compatible alternative
	- [postcard](https://crates.io/crates/postcard)
	- [rkyv](https://crates.io/crates/rkyv)
	- [bitcode](https://crates.io/crates/bitcode)

Bincode is unmaintained

Due to a doxxing and harassment incident, the bincode team has taken the decision to cease
development permanently.

The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.

Alternatives to consider

• wincode
• postcard
• bitcode
• rkyv

[nmccarty]

@djc Sorry to be a bother, but is there anyway we could go ahead and get some movement on merging this? Getting a bit tired of still having the cargo-deny nuclear bomb still hanging over our heads.

[djc]

@djc Sorry to be a bother, but is there anyway we could go ahead and get some movement on merging this? Getting a bit tired of still having the cargo-deny nuclear bomb still hanging over our heads.

No bother at all, I agree. Want to take what's here and copy it into a new PR, with suggestions addressed?

[nmccarty]

@djc Sorry to be a bother, but is there anyway we could go ahead and get some movement on merging this? Getting a bit tired of still having the cargo-deny nuclear bomb still hanging over our heads.

No bother at all, I agree. Want to take what's here and copy it into a new PR, with suggestions addressed?

Sure, I've gone ahead and opened up #2574