RUSTSEC-2026-0440: `astral-tokio-tar` is unmaintained
Published Nov 3, 2026
·Updated
Astral ended maintenance of astral-tokio-tar on November 3, 2026. All versions of the crate are deprecated and unmaintained.
For strict tar encoding and decoding, Astral recommends [tar-codec] as a possible replacement.
[0.7.1 release]: https://github.com/astral-sh/tokio-tar/releases/tag/v0.7.1 [tar-codec]: https://crates.io/crates/tar-codec
Affected Software
1 affected component
rust/astral-tokio-tar>=0.0.0-0
Event History
Nov 3, 2026
Advisory Published
via OSV·12:00 PM
Data Sourced
via OSV·12:00 PM
DescriptionAffected Software
Frequently Asked Questions
1
Are any releases still supported?
No. The advisory states that all versions of astral-tokio-tar are deprecated and unmaintained.
2
What replacement is identified for projects that need strict tar handling?
Astral identifies tar-codec as a possible replacement for strict tar encoding and decoding.