Description
The author of `ocipkg` has archived the repository and declared the crate no longer maintained.
[Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release.
"No further updates, including security fixes, are planned."
## Alternatives
- For interacting with OCI registries, the maintainer suggests the ORAS project's
[`oci-client`](https://github.com/oras-project/rust-oci-client).
- For ocipkg-specific functionality (local package management, or build-time library fetching and
linking), the maintainer suggests forking the repository from
[0.4.1](https://github.com/termoshtt/ocipkg/tree/0.4.1) and maintaining it for your use case, as
`oci-client` is not a drop-in replacement for those features.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | ocipkg | >= 0.0.0-0 | — | RUSTSEC-2026-0449 |