`ocipkg` is unmaintained
Affects ocipkgSource GCVE Database
Rated Medium by Threat Radar's AI analysis
Data as of 6 Nov 2026, 15:40 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioocipkgpkg:cargo/ocipkgOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid using 'ocipkg' for new projects. For OCI registry interactions, switch to the actively maintained 'oci-client' crate from the ORAS project. For functionality unique to 'ocipkg', such as local package management or build-time library fetching, users should fork the 'ocipkg' repository at version 0.4.1 and maintain it themselves. No official patches or fixes are available for 'ocipkg'.
Description
The Rust crate 'ocipkg' has been declared unmaintained by its author, with version 0.4.1 as the final release. No further updates, including security fixes, will be provided. Users requiring similar functionality are advised to use the 'oci-client' from the ORAS project for OCI registry interactions or to fork and maintain 'ocipkg' themselves for specific features not covered by 'oci-client'.