RUSTSEC-2026-0449 json
`ocipkg` is unmaintained
published 2026-11-05 3 d ago modified 2026-11-06 2 d ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The author of `ocipkg` has archived the repository and declared the crate no longer maintained. [Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release. "No further updates, including security fixes, are planned."
## Alternatives
- For interacting with OCI registries, the maintainer suggests the ORAS project's [`oci-client`](https://github.com/oras-project/rust-oci-client). - For ocipkg-specific functionality (local package management, or build-time library fetching and linking), the maintainer suggests forking the repository from [0.4.1](https://github.com/termoshtt/ocipkg/tree/0.4.1) and maintaining it for your use case, as `oci-client` is not a drop-in replacement for those features.
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | ocipkg | >=0.0.0-0 |
no fix listed |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.