`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency

A new version of the `append-only-vec` crate was published with a direct dependency
on `proc-macro1`, which would execute a malicious build script.

The compromised version of this crate was published on 2026-08-20, and was
removed approximately 107 minutes later.

The compromised crate version was used as part of a malware campaign targeted
at users of `arrayref`, which was downloaded 2,285 times before being removed;
see [the `arrayref` advisory][arrayref-advisory] for more detail.

[arrayref-advisory]: https://rustsec.org/advisories/RUSTSEC-2026-0260.html