RUSTSEC-2025-0134: rustls-pemfile is unmaintained
- Dominant language
- Rust
- Stars
- 56.8k
- Forks
- 2.9k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 5
Description
> rustls-pemfile is unmaintained
| Details | |
| ------------------- | ---------------------------------------------- |
| Status | unmaintained |
| Package | `rustls-pemfile` |
| Version | `1.0.4` |
| URL | [https://github.com/rustls/pemfile/issues/61](https://github.com/rustls/pemfile/issues/61) |
| Date | 2025-11-28 |
The rustls-pemfile crate is no longer maintained. The repository has been archived since August
2025, and users are encouraged to depend directly on the underlying PEM parsing code included
in rustls-pki-types since 1.9.0. The latest version of rustls-pemfile is in fact a thin wrapper
around the same code used in rustls-pki-types, so migrating should be straightforward.
The new API is represented by the [`PemObject`][PemObject] trait, which provides methods for
reading a single or multiple PEM objects from a file or byte slice.
[PemObject]: https://docs.rs/rustls-pki-types/latest/rustls_pki_types/pem/trait.PemObject.html
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2025-0134.html) for additional details.
Contributor guide
Research direction
No source file or test is named. Start by locating uses of the rustls-pemfile 1.0.4 dependency and reviewing the rustls-pki-types PemObject API; done means the unmaintained dependency is no longer required and the existing test suite passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100