diff --git a/crates/serde_yaml/RUSTSEC-0000-0000.md b/crates/serde_yaml/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..ba890cffd --- /dev/null +++ b/crates/serde_yaml/RUSTSEC-0000-0000.md @@ -0,0 +1,26 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "serde_yaml" +date = "2025-11-16" +url = "https://github.com/dtolnay/serde-yaml/blob/master/README.md" +informational = "unmaintained" + +[versions] +patched = [] +``` + +# serde_yaml crate is unmaintained + +The `serde_yaml` crate is no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. + +While there are maintained forks of `serde_yaml`, none of them can be recommended as they either use the +unmaintained `unsafe-libyaml`, or they use a fork of `unsafe-libyaml` which do not resolve the underlying security problems +of `libyaml`. + +## Recommended alternatives + +- [`yaml-spanned`](https://crates.io/crates/yaml-spanned) - Deserializer only. +- [`serde_yaml2`](https://crates.io/crates/serde_yaml2) - Incomplete implementation of serde framework. +- [`serde-saphyr`](https://crates.io/crates/serde-saphyr) - Not complete implementation of YAML 1.2 or serde framework. +- [`yaml-peg`](https://crates.io/crates/yaml-peg) - Not complete implementation of YAML 1.2 or serde framework. \ No newline at end of file diff --git a/crates/unsafe-libyaml/RUSTSEC-0000-0000.md b/crates/unsafe-libyaml/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..a553bf3d9 --- /dev/null +++ b/crates/unsafe-libyaml/RUSTSEC-0000-0000.md @@ -0,0 +1,27 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "unsafe-libyaml" +date = "2025-11-16" +url = "https://github.com/rustsec/advisory-db/issues/2132" +informational = "unmaintained" + +[versions] +patched = [] +``` + +# unsafe-libyaml crate is unmaintained + +The `unsafe-libyaml` crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. + +## Recommended alternatives + +- [`libyaml-safer`](https://crates.io/crates/libyaml-safer) +- [`saphyr-parser`](https://crates.io/crates/saphyr-parser) - Parser only. +- [`yaml-rust2`](https://crates.io/crates/yaml-rust2) - [Maintenance mode only](https://github.com/Ethiraric/yaml-rust2/issues/26) +- [`yaml_parser`](https://crates.io/crates/yaml_parser) & [`pretty_yaml`](https://crates.io/crates/pretty_yaml) +- [`yaml-spanned`](https://crates.io/crates/yaml-spanned) - Parser only. +- [`yaml-peg`](https://crates.io/crates/yaml-peg) - Not complete implementation of YAML 1.2 +- [`rust-yaml`](https://crates.io/crates/rust-yaml) +- [`yaml_lib`](https://crates.io/crates/yaml_lib) +- [`oak-yaml`](https://crates.io/crates/oak-yaml) \ No newline at end of file