Deprecation of `bare-metal`

[kwalker-plxs]

A run of cargo audit today picked up on RUSTSC-2026-0110 for the deprecation of bare-metal. This was detected because cortex-m has a dependency on bare-metal. It does not look like that dependency is actually in use. Should it be removed?

[jonathanpallant]

I believe that removing that dependency or changing its major version is a breaking change, and breaking changes are very difficult to manage for the cortex-m crate due to its relationship with the PACs.

[jannic]

I think the RUSTSEC advisory is wrong. While bare-metal is deprecated, it is not actually unmaintained. I'm sure that any security issue reported against bare-metal would still be handled.