---
id: RUSTSEC-2026-0372
title: '`zvariant_derive` is unmaintained'
summary: '`zvariant_derive` is unmaintained'
severity: none
vendor: zvariant_derive
product: zvariant_derive
ecosystem: rust
affected:
  - zvariant_derive >= 0.0.0-0
published: '2026-10-16'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T15:30:02.394812511Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0372'
references:
  - url: 'https://crates.io/crates/zvariant_derive'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0372.html'
  - url: 'https://github.com/z-galaxy/zbus/issues/2043'
tags:
  - osv
  - rust
ingestedAt: '2026-10-18T11:51:09.859Z'
---

## Overview

The `zvariant_derive` crate is no longer maintained as a standalone crate.

Its derive macros are provided by [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`.

Users should migrate to [`zbus`](https://crates.io/crates/zbus), with its default features disabled if they only need the D-Bus wire format.

## Affected packages

- `zvariant_derive >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.