RUSTSEC-2026-0449: `ocipkg` is unmaintained
The author of ocipkg has archived the repository and declared the crate no longer maintained. Version 0.4.1 is stated to be the final release. "No further updates, including security fixes, are planned."
Alternatives
- For interacting with OCI registries, the maintainer suggests the ORAS project's oci-client. - For ocipkg-specific functionality (local package management, or build-time library fetching and linking), the maintainer suggests forking the repository from 0.4.1 and maintaining it for your use case, as oci-client is not a drop-in replacement for those features.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For interacting with OCI registries, migrate to the ORAS project's oci-client, which is suggested as an alternative to ocipkg.
- Compensating control
For ocipkg-specific functionality, fork the repository from version 0.4.1 and maintain the fork for your use case.