{"id":"RUSTSEC-2026-0449","aliases":[],"status":"published","title":"`ocipkg` is unmaintained","description":"The author of `ocipkg` has archived the repository and declared the crate no longer maintained.\n[Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release.\n\"No further updates, including security fixes, are planned.\"\n\n## Alternatives\n\n- For interacting with OCI registries, the maintainer suggests the ORAS project's\n  [`oci-client`](https://github.com/oras-project/rust-oci-client).\n- For ocipkg-specific functionality (local package management, or build-time library fetching and\n  linking), the maintainer suggests forking the repository from\n  [0.4.1](https://github.com/termoshtt/ocipkg/tree/0.4.1) and maintaining it for your use case, as\n  `oci-client` is not a drop-in replacement for those features.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-11-05T12:00:00Z","modified":"2026-11-06T14:45:02Z","affected":[{"source":"osv","ecosystem":"crates.io","package":"ocipkg","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://crates.io/crates/ocipkg","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0449.html","tags":["advisory"]},{"url":"https://github.com/termoshtt/ocipkg#maintenance-status","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0449","title":"`ocipkg` is unmaintained","description":"The author of `ocipkg` has archived the repository and declared the crate no longer maintained.\n[Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release.\n\"No further updates, including security fixes, are planned.\"\n\n## Alternatives\n\n- For interacting with OCI registries, the maintainer suggests the ORAS project's\n  [`oci-client`](https://github.com/oras-project/rust-oci-client).\n- For ocipkg-specific functionality (local package management, or build-time library fetching and\n  linking), the maintainer suggests forking the repository from\n  [0.4.1](https://github.com/termoshtt/ocipkg/tree/0.4.1) and maintaining it for your use case, as\n  `oci-client` is not a drop-in replacement for those features.","status":"published","published":"2026-11-05T12:00:00Z","modified":"2026-11-06T14:45:02.851309747Z","updated_at":"2026-11-06T14:57:06.730583Z"}]}}