RUSTSEC-2026-0449
ocipkg is unmaintained
- Reported
-
- Issued
-
- Package
-
ocipkg
(crates.io)
- Type
-
INFO
Unmaintained
- References
-
- Patched
-
no patched versions
Description
The author of ocipkg has archived the repository and declared the crate no longer maintained.
Version 0.4.1 is stated to be the final release.
"No further updates, including security fixes, are planned."
Alternatives
- For interacting with OCI registries, the maintainer suggests the ORAS project's
oci-client.
- For ocipkg-specific functionality (local package management, or build-time library fetching and
linking), the maintainer suggests forking the repository from
0.4.1 and maintaining it for your use case, as
oci-client is not a drop-in replacement for those features.
Advisory available under CC0-1.0
license.