The Rust community creates RUSTSEC advisories when a package is considered unmaintained. These are indicated by adding ”informational”: “unmaintained” to the database_specific field in the OSV schema. For example: RUSTSEC-2025-0141. While deps.dev will indicate the presence of this advisory, it does not flag the package as deprecated.
I propose that deps.dev use the presence of this entry on an advisory to set "isDeprecated": true on all versions of the package. This more clearly indicates the intent of these advisories: that the package has a potential security risk, not that it contains a current vulnerability.
The Rust community creates RUSTSEC advisories when a package is considered unmaintained. These are indicated by adding
”informational”: “unmaintained”to thedatabase_specificfield in the OSV schema. For example: RUSTSEC-2025-0141. While deps.dev will indicate the presence of this advisory, it does not flag the package as deprecated.I propose that deps.dev use the presence of this entry on an advisory to set
"isDeprecated": trueon all versions of the package. This more clearly indicates the intent of these advisories: that the package has a potential security risk, not that it contains a current vulnerability.