Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0449

`ocipkg` is unmaintained

Published Nov 5, 2026 · Updated Nov 6, 2026 · Assigned by RUSTSEC

Description

The author of `ocipkg` has archived the repository and declared the crate no longer maintained.
[Version 0.4.1](https://crates.io/crates/ocipkg/0.4.1) is stated to be the final release.
"No further updates, including security fixes, are planned."

## Alternatives

- For interacting with OCI registries, the maintainer suggests the ORAS project's
[`oci-client`](https://github.com/oras-project/rust-oci-client).
- For ocipkg-specific functionality (local package management, or build-time library fetching and
linking), the maintainer suggests forking the repository from
[0.4.1](https://github.com/termoshtt/ocipkg/tree/0.4.1) and maintaining it for your use case, as
`oci-client` is not a drop-in replacement for those features.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io ocipkg >= 0.0.0-0 — RUSTSEC-2026-0449

References