```toml
[advisory]
id = "RUSTSEC-2024-0449"
package = "unsafe-libyaml"
date = "2024-03-25"
informational = "unmaintained"
url = "https://github.com/dtolnay/unsafe-libyaml"

[versions]
patched = []
unaffected = []
```

# unsafe-libyaml is unmaintained

The [repository](https://github.com/dtolnay/unsafe-libyaml) was archived by
its owner on 2024-03-25 and is read-only. The last release is 0.2.11
(March 2024).

`unsafe-libyaml` is a machine translation of libyaml's C code into unsafe
Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by
`serde_yaml` (itself deprecated) and by forks such as `serde_yaml_ng`.

## Alternatives

Consider a YAML parser written in safe Rust, for example:

- [saphyr](https://crates.io/crates/saphyr) ([serde-saphyr](https://crates.io/crates/serde-saphyr) for serde users)
- [noyalib](https://crates.io/crates/noyalib)