Summary
rsmpeg depends on paste = "1.0", which is flagged by RustSec as unmaintained:
- Advisory:
RUSTSEC-2024-0436
- Severity: informational
- Not a known security vulnerability
This causes downstream projects using cargo audit, cargo deny, Dependabot, or similar tools to report security warnings.
Proposed change
Replace the current dependency:
with the maintained drop-in replacement:
paste = { package = "pastey", version = "0.2" }Since the dependency is still named paste, existing usages like paste::paste! should continue to work if pastey is compatible with the current macro usage.
Validation
After the change, please check:
cargo check --all-features
cargo test --all-features
cargo audit
cargo tree -i paste
Expected result:
cargo audit no longer reports RUSTSEC-2024-0436cargo tree -i paste no longer resolves to paste v1.0.15- Existing macro-generated APIs still compile
This is mainly to reduce downstream supply-chain maintenance risk and avoid security scanner noise.
Summary
rsmpegdepends onpaste = "1.0", which is flagged by RustSec as unmaintained:RUSTSEC-2024-0436This causes downstream projects using
cargo audit,cargo deny, Dependabot, or similar tools to report security warnings.Proposed change
Replace the current dependency:
with the maintained drop-in replacement:
Since the dependency is still named
paste, existing usages likepaste::paste!should continue to work ifpasteyis compatible with the current macro usage.Validation
After the change, please check:
cargo check --all-features cargo test --all-features cargo audit cargo tree -i pasteExpected result:
cargo auditno longer reportsRUSTSEC-2024-0436cargo tree -i pasteno longer resolves topaste v1.0.15This is mainly to reduce downstream supply-chain maintenance risk and avoid security scanner noise.