RUSTSEC-2021-0127: serde_cbor is unmaintained

[github-actions]

serde_cbor is unmaintained

Details
Status	unmaintained
Package	serde_cbor
Version	0.11.2
URL	https://github.com/pyfisch/cbor
Date	2021-08-15

The serde_cbor crate is unmaintained. The author has archived the github repository.

Alternatives proposed by the author:

*ciborium
*minicbor

See advisory page for additional details.

[syphar]

Both proposed alternatives are no easy switch:

• ciborium does work with serde, but does not expose it's Deserializer class, which breaks our streaming deserializer. See also Exposing Serializer in the public API enarx/ciborium#18.
• minicbor provides its own Encode/Decode traits which mimic serde, but these don't support named fields in maps, only numbers, which would break reading existing indexes. This seems a design choice, so here the only way would be dropping down to ad-hoc encoding/deding.

[jyn514]

@syphar do we have to use CBOR specifically? could we use a more common format, like bincode or something?

[syphar]

We can choose any format, we only still have to support and/or recreate the already existing indexes.

But after the performance issues and now this I was thinking about switching too.

Best is probably using a format where we don't have to load the whole index into memory to get a single file location.