Skip to content
OpenAdvisories
Unscored RUSTSEC-2024-0449

unsafe-libyaml is unmaintained

Published Mar 25, 2024 · Updated Oct 12, 2026 · Assigned by RUSTSEC

Description

The [repository](https://github.com/dtolnay/unsafe-libyaml) was archived by
its owner on 2024-03-25 and is read-only. The last release is 0.2.11
(March 2024).

`unsafe-libyaml` is a machine translation of libyaml's C code into unsafe
Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by
`serde_yaml` (itself deprecated) and by forks such as `serde_yaml_ng`.

## Alternatives

Consider a YAML parser written in safe Rust, for example:

- [saphyr](https://crates.io/crates/saphyr) ([serde-saphyr](https://crates.io/crates/serde-saphyr) for serde users)
- [noyalib](https://crates.io/crates/noyalib)

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io unsafe-libyaml >= 0.0.0-0 — RUSTSEC-2024-0449

References