RUSTSEC-2026-0449

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0449

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0449.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0449

Published

2026-11-05T12:00:00Z

Modified

2026-11-06T14:45:02Z

Summary

`ocipkg` is unmaintained

Details

The author of ocipkg has archived the repository and declared the crate no longer maintained. Version 0.4.1 is stated to be the final release. "No further updates, including security fixes, are planned."

Alternatives

For interacting with OCI registries, the maintainer suggests the ORAS project's oci-client.
For ocipkg-specific functionality (local package management, or build-time library fetching and linking), the maintainer suggests forking the repository from 0.4.1 and maintaining it for your use case, as oci-client is not a drop-in replacement for those features.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / ocipkg

Package

Name: ocipkg; View open source insights on deps.dev
Purl: pkg:cargo/ocipkg

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}