RUSTSEC-2024-0320: yaml-rust is unmaintained.

[github-actions]

yaml-rust is unmaintained.

Details
Status	unmaintained
Package	yaml-rust
Version	0.4.5
URL	rustsec/advisory-db#1921
Date	2024-03-20

The maintainer seems unreachable.

Many issues and pull requests have been submitted over the years
without any response.

Alternatives

Consider switching to the actively maintained yaml-rust2 fork of the original project:

• yaml-rust2
• yaml-rust2 @ crates.io)

See advisory page for additional details.

[orhun]

Looks like we need a new release of config dependency for resolving this.

[tessus]

This will be interesting, especially since config-rs is unmaintained as well.

[orhun]

everything is falling apart 🥲

[tessus]

The config crate is used extensively in the rust ecosystem, thus I believe a new maintainer will be found sooner or later.

But yes, I never liked these dependencies. In C you had a few include files and sometimes 3rd party libs, but that was it. Every single rust project has at least 10 dependencies. This was always somethig that made me slightly nervous.

[tessus]

config 0.4.1 was released, which switches to yaml-rust2