Abundance-backed proof of space and wgpu GPU plotter - #3
Security advisories found
11 unmaintained, 3 unsound, 1 other
Details
Warnings
RUSTSEC-2025-0012
backoffis unmaintained.
| Details | |
|---|---|
| Status | unmaintained |
| Package | backoff |
| Version | 0.4.0 |
| URL | ihrwein/backoff#66 |
| Date | 2025-03-04 |
The backoff crate is no longer actively maintained. For exponential backoffs/retrying, you can use the backon crate.
RUSTSEC-2025-0141
Bincode is unmaintained
| Details | |
|---|---|
| Status | unmaintained |
| Package | bincode |
| Version | 2.0.1 |
| URL | https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md |
| Date | 2025-12-16 |
Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.
The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.
Alternatives to consider
RUSTSEC-2026-0105
core2 is unmaintained, all versions yanked
| Details | |
|---|---|
| Status | unmaintained |
| Package | core2 |
| Version | 0.4.0 |
| URL | https://hachyderm.io/@piecritic/116404790999620656 |
| Date | 2026-04-14 |
The maintainer decided stop maintaining crate and yanked all published versions.
Potential alternatives:
embedded-iosolves the same general problemno-std-io2is a maintained fork
RUSTSEC-2024-0388
derivativeis unmaintained; consider using an alternative
| Details | |
|---|---|
| Status | unmaintained |
| Package | derivative |
| Version | 2.2.0 |
| URL | mcarton/rust-derivative#117 |
| Date | 2024-06-26 |
The derivative crate is no longer maintained.
Consider using any alternative, for instance:
RUSTSEC-2025-0057
fxhash - no longer maintained
| Details | |
|---|---|
| Status | unmaintained |
| Package | fxhash |
| Version | 0.2.1 |
| URL | cbreeden/fxhash#20 |
| Date | 2025-09-05 |
The fxhash crate is no longer maintained.
The repository is stale and owner is no longer active on GitHub.
Please take a look at rustc-hash instead.
### [RUSTSEC-2024-0384](https://rustsec.org/advisories/RUSTSEC-2024-0384.html)
> `instant` is unmaintained
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `instant` |
| Version | `0.1.13` |
| Date | 2024-09-01 |
This crate is no longer maintained, and the author recommends using the maintained [`web-time`] crate instead.
[`web-time`]: https://crates.io/crates/web-time
### [RUSTSEC-2025-0161](https://rustsec.org/advisories/RUSTSEC-2025-0161.html)
> libsecp256k1 is unmaintained
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `libsecp256k1` |
| Version | `0.7.2` |
| URL | [https://github.com/paritytech/libsecp256k1/pull/159](https://github.com/paritytech/libsecp256k1/pull/159) |
| Date | 2025-01-14 |
The maintainers recommend using [k256](https://crates.io/crates/k256) instead.
### [RUSTSEC-2022-0061](https://rustsec.org/advisories/RUSTSEC-2022-0061.html)
> Crate `parity-wasm` deprecated by the author
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `parity-wasm` |
| Version | `0.45.0` |
| URL | [https://github.com/paritytech/parity-wasm/pull/334](https://github.com/paritytech/parity-wasm/pull/334) |
| Date | 2022-10-01 |
[This PR](https://github.com/paritytech/parity-wasm/pull/334) explicitly deprecates `parity-wasm`.
The author recommends switching to [wasm-tools](https://github.com/bytecodealliance/wasm-tools).
### [RUSTSEC-2024-0436](https://rustsec.org/advisories/RUSTSEC-2024-0436.html)
> paste - no longer maintained
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `paste` |
| Version | `1.0.15` |
| URL | [https://github.com/dtolnay/paste](https://github.com/dtolnay/paste) |
| Date | 2024-10-07 |
The creator of the crate `paste` has stated in the [`README.md`](https://github.com/dtolnay/paste/blob/master/README.md)
that this project is not longer maintained as well as archived the repository
## Possible Alternative(s)
- [`pastey`]: a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate
- [`with_builtin_macros`]: crate providing a [superset of `paste`'s functionality including general `macro_rules!` eager expansions](https://docs.rs/with_builtin_macros/0.1.0/with_builtin_macros/macro.with_eager_expansions.html) and `concat!`/`concat_idents!` macros
[`pastey`]: https://crates.io/crates/pastey
[`with_builtin_macros`]: https://crates.io/crates/with_builtin_macros
### [RUSTSEC-2024-0370](https://rustsec.org/advisories/RUSTSEC-2024-0370.html)
> proc-macro-error is unmaintained
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `proc-macro-error` |
| Version | `1.0.4` |
| URL | [https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20](https://gitlab.com/CreepySkeleton/proc-macro-error/-/issues/20) |
| Date | 2024-09-01 |
proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email.
proc-macro-error also depends on `syn 1.x`, which may be bringing duplicate dependencies into dependant build trees.
## Possible Alternative(s)
- [manyhow](https://crates.io/crates/manyhow)
- [proc-macro2-diagnostics](https://github.com/SergioBenitez/proc-macro2-diagnostics)
### [RUSTSEC-2026-0173](https://rustsec.org/advisories/RUSTSEC-2026-0173.html)
> proc-macro-error2 is unmaintained
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `proc-macro-error2` |
| Version | `2.0.1` |
| URL | [https://github.com/GnomedDev/proc-macro-error-2/issues/17](https://github.com/GnomedDev/proc-macro-error-2/issues/17) |
| Date | 2026-06-07 |
The author of `proc-macro-error2` has [confirmed](https://github.com/GnomedDev/proc-macro-error-2/issues/17#issuecomment-4643215473) that the crate is no longer maintained and recommends that users migrate away from it.
`proc-macro-error2` was originally created as a maintained fork of [`proc-macro-error`](https://crates.io/crates/proc-macro-error) (see [RUSTSEC-2024-0370](https://rustsec.org/advisories/RUSTSEC-2024-0370)). Both the original crate and this fork are now unmaintained.
## Possible Alternative(s)
- [manyhow](https://crates.io/crates/manyhow)
- [proc-macro2-diagnostics](https://github.com/SergioBenitez/proc-macro2-diagnostics)
### [RUSTSEC-2026-0002](https://rustsec.org/advisories/RUSTSEC-2026-0002.html)
> `IterMut` violates Stacked Borrows by invalidating internal pointer
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unsound |
| Package | `lru` |
| Version | `0.12.5` |
| URL | [https://github.com/jeromefroe/lru-rs/pull/224](https://github.com/jeromefroe/lru-rs/pull/224) |
| Date | 2026-01-07 |
Affected versions of this crate contain a soundness issue in the `IterMut`
iterator implementation. The `IterMut::next` and `IterMut::next_back`
methods temporarily create an exclusive reference to the key when
dereferencing the internal node pointer.
This invalidates the shared pointer held by the internal `HashMap`,
violating Stacked Borrows rules.
### [RUSTSEC-2026-0186](https://rustsec.org/advisories/RUSTSEC-2026-0186.html)
> Unchecked pointer offset in crate `memmap2`
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unsound |
| Package | `memmap2` |
| Version | `0.5.10` |
| URL | [https://github.com/RazrFalcon/memmap2-rs/issues/169](https://github.com/RazrFalcon/memmap2-rs/issues/169) |
| Date | 2026-06-20 |
Affected versionf of `memmap2` did not perform enough validation on the `offset` and `len` parameters of
`Mmap::[unchecked_]advise_range()`,
`MmapMut::[unchecked_]advise_ranage()`
and `MmapMut::flush[_async]_range()`.
This can cause undefined behavior due to invalid values being passed to [`pointer::offset()`] and [`pointer::add()`]
when passing an out-of-bounds range to any of the affected functions.
The flaw was corrected in commit [`cee7cf0`] and released in version `0.9.11`.
The invalid pointer is not dereferenced,
but it is passed to the `madvise` and `msync` syscalls and their Windows equivalents.
[`pointer::offset()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.offset-1
[`pointer::add()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.add-1
[`cee7cf0`] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c
### [RUSTSEC-2026-0186](https://rustsec.org/advisories/RUSTSEC-2026-0186.html)
> Unchecked pointer offset in crate `memmap2`
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unsound |
| Package | `memmap2` |
| Version | `0.9.10` |
| URL | [https://github.com/RazrFalcon/memmap2-rs/issues/169](https://github.com/RazrFalcon/memmap2-rs/issues/169) |
| Date | 2026-06-20 |
Affected versionf of `memmap2` did not perform enough validation on the `offset` and `len` parameters of
`Mmap::[unchecked_]advise_range()`,
`MmapMut::[unchecked_]advise_ranage()`
and `MmapMut::flush[_async]_range()`.
This can cause undefined behavior due to invalid values being passed to [`pointer::offset()`] and [`pointer::add()`]
when passing an out-of-bounds range to any of the affected functions.
The flaw was corrected in commit [`cee7cf0`] and released in version `0.9.11`.
The invalid pointer is not dereferenced,
but it is passed to the `madvise` and `msync` syscalls and their Windows equivalents.
[`pointer::offset()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.offset-1
[`pointer::add()`]: https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.add-1
[`cee7cf0`] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c
### Crate `core2` is yanked
No extra details provided.