{"id":"RUSTSEC-2026-0372","title":"`zvariant_derive` is unmaintained","summary":"`zvariant_derive` is unmaintained","severity":"none","vendor":"zvariant_derive","product":"zvariant_derive","ecosystem":"rust","affected":["zvariant_derive >= 0.0.0-0"],"published":"2026-10-16","updated":"2026-10-17","sourceUpdated":"2026-10-17T15:30:02.394812511Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0372","references":[{"url":"https://crates.io/crates/zvariant_derive"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0372.html"},{"url":"https://github.com/z-galaxy/zbus/issues/2043"}],"tags":["osv","rust"],"ingestedAt":"2026-10-18T11:51:09.859Z","slug":"RUSTSEC-2026-0372","body":"## Overview\n\nThe `zvariant_derive` crate is no longer maintained as a standalone crate.\n\nIts derive macros are provided by [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`.\n\nUsers should migrate to [`zbus`](https://crates.io/crates/zbus), with its default features disabled if they only need the D-Bus wire format.\n\n## Affected packages\n\n- `zvariant_derive >= 0.0.0-0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}