serde_cbor is no longer maintained

[eeeebbbbrrrr]

We use the serde_cbor crate for binary representation of #[derive(PostgresType)] data.

Apparently that crate is no longer maintained and we need to find a replacement. The old author suggests two different alternatives on at the top of the readme.

[workingjubilee]

They are
https://crates.io/crates/ciborium
https://crates.io/crates/minicbor

At a glance:

ciborium quirks

• always uses the tiniest lossless encoding
• doesn't do "packed" encoding
• aims for maximal decoding ability, strict encoding
• #![no_std] compat

minicbor quirks

• focuses on usability in #![no_std] environs.
• minimal allocations
• fine-grained feature flags for core vs. alloc vs. std
• a #[derive] usable if alloc is enabled

[thomcc]

I know the author of minicbor and have used it before (no idea about cborium although it also looks fine). I'll take this to get my feet wet in that area (as a bonus, it seems to bother one of our users).

[thomcc]

Oh, we tell people they just need serde-compatibility for this. Well, cborium it is then in that case (minicbor uses its own traits which can be adapted but it's painful).

Note to self that we need to ensure that values serialized by cborium can be deserialized by serde_cbor (since cborium implies that some implementations may not be able to the CBOR it emits, including serde_cbor in some cases). I think I know how to make this work, though.

[thomcc]

Do we need cross-version compatibility here? E.g. Do we need to serialize and deserialize types that are compatible with serde_cbor?

If so there's not a lot we can do here, because the existing implementations do not offer that. There is the serde_cbor_2 crate, which seems to be created by someone who has the same needs as us. This would be easy to switch to, but I don't know anything about it nor how actively they'd maintain it.

If we only need deserialization and not serialization e.g. we're fine with prior versions of pgx not being able to deserialize CBOR data coming from newer versions of pgx, then cborium is a valid option. I don't know if that's considered acceptable, though.

[workingjubilee]

Do we need cross-version compatibility here? E.g. Do we need to serialize and deserialize types that are compatible with serde_cbor?

...

If we only need deserialization and not serialization e.g. we're fine with prior versions of pgx not being able to deserialize CBOR data coming from newer versions of pgx, then cborium is a valid option. I don't know if that's considered acceptable, though.

Compatible-deserialization-only is acceptable, we should be fine with upgrading being one-way.