{"id":"RUSTSEC-2026-0449","summary":"`ocipkg` is unmaintained","details":"The author of `ocipkg` has archived the repository and declared the crate no longer maintained.\n[Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release.\n\"No further updates, including security fixes, are planned.\"\n\n## Alternatives\n\n- For interacting with OCI registries, the maintainer suggests the ORAS project's\n  [`oci-client`](https://github.com/oras-project/rust-oci-client).\n- For ocipkg-specific functionality (local package management, or build-time library fetching and\n  linking), the maintainer suggests forking the repository from\n  [0.4.1](https://github.com/termoshtt/ocipkg/tree/0.4.1) and maintaining it for your use case, as\n  `oci-client` is not a drop-in replacement for those features.","modified":"2026-11-06T14:45:02.851309747Z","published":"2026-11-05T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/ocipkg"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0449.html"},{"type":"WEB","url":"https://github.com/termoshtt/ocipkg#maintenance-status"}],"affected":[{"package":{"name":"ocipkg","ecosystem":"crates.io","purl":"pkg:cargo/ocipkg"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"informational":"unmaintained","categories":[],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0449.json","cvss":null}}],"schema_version":"1.9.2"}