RUSTSEC-2024-0320: yaml-rust is unmaintained.

[github-actions[bot]]

yaml-rust is unmaintained.

Details
Status	unmaintained
Package	yaml-rust
Version	0.4.5
URL	https://github.com/rustsec/advisory-db/issues/1921
Date	2024-03-20

The maintainer seems unreachable.

Many issues and pull requests have been submitted over the years without any response.

Alternatives

Consider switching to the actively maintained yaml-rust2 fork of the original project:

• yaml-rust2
• yaml-rust2 @ crates.io)

See advisory page for additional details.

[orhun]

Looks like we need a new release of config dependency for resolving this.

[tessus]

This will be interesting, especially since config-rs is unmaintained as well.

[orhun]

everything is falling apart 🥲

[tessus]

The config crate is used extensively in the rust ecosystem, thus I believe a new maintainer will be found sooner or later.

But yes, I never liked these dependencies. In C you had a few include files and sometimes 3rd party libs, but that was it. Every single rust project has at least 10 dependencies. This was always somethig that made me slightly nervous.