Cargo audit found a few unmaintained dependencies in lightyear

[mitchty]

Looks like there are at least 2 unmaintained dependencies in lightyear currently:

• paste https://rustsec.org/advisories/RUSTSEC-2024-0436 Has a maintained option that is drop in
• rustls-pemfile https://rustsec.org/advisories/RUSTSEC-2025-0134 Notes that this is largely just a wrapper around https://github.com/rustls/pki-types and the latter is preferred for direct use.

Looks like both are fairly simple to fix, if it's cool I could abuse this issue to try fixing it meself?

Cargo audit with lightyear in use:

Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
├── steamworks 0.12.2
│   └── aeronet_steam 0.17.2
│       └── lightyear_steam 0.25.5
│           └── lightyear 0.25.5
│               └── yeet 0.0.2
├── simba 0.9.1
│   ├── parry3d 0.25.3
│   │   └── avian3d 0.4.1
│   │       ├── lightyear_replication 0.25.5
│   │       │   ├── lightyear_prediction 0.25.5
│   │       │   │   ├── lightyear_inputs 0.25.5
│   │       │   │   │   ├── lightyear_inputs_native 0.25.5
│   │       │   │   │   │   └── lightyear 0.25.5
│   │       │   │   │   ├── lightyear_inputs_leafwing 0.25.5
│   │       │   │   │   │   └── lightyear 0.25.5
│   │       │   │   │   ├── lightyear_inputs_bei 0.25.5
│   │       │   │   │   │   └── lightyear 0.25.5
│   │       │   │   │   └── lightyear 0.25.5
│   │       │   │   ├── lightyear_avian3d 0.25.5
│   │       │   │   │   └── lightyear 0.25.5
│   │       │   │   ├── lightyear_avian2d 0.25.5
│   │       │   │   │   └── lightyear 0.25.5
│   │       │   │   └── lightyear 0.25.5
│   │       │   ├── lightyear_interpolation 0.25.5
│   │       │   │   ├── lightyear_prediction 0.25.5
│   │       │   │   ├── lightyear_frame_interpolation 0.25.5
│   │       │   │   │   ├── lightyear_prediction 0.25.5
│   │       │   │   │   ├── lightyear_avian3d 0.25.5
│   │       │   │   │   ├── lightyear_avian2d 0.25.5
│   │       │   │   │   └── lightyear 0.25.5
│   │       │   │   ├── lightyear_avian3d 0.25.5
│   │       │   │   ├── lightyear_avian2d 0.25.5
│   │       │   │   └── lightyear 0.25.5
│   │       │   ├── lightyear_inputs_bei 0.25.5
│   │       │   ├── lightyear_inputs 0.25.5
│   │       │   ├── lightyear_frame_interpolation 0.25.5
│   │       │   ├── lightyear_avian3d 0.25.5
│   │       │   ├── lightyear_avian2d 0.25.5
│   │       │   └── lightyear 0.25.5
│   │       └── lightyear_avian3d 0.25.5
│   ├── parry2d 0.25.3
│   │   └── avian2d 0.4.1
│   │       ├── lightyear_replication 0.25.5
│   │       └── lightyear_avian2d 0.25.5
│   └── nalgebra 0.34.1
│       ├── parry3d 0.25.3
│       ├── parry2d 0.25.3
│       ├── avian3d 0.4.1
│       └── avian2d 0.4.1
├── metal 0.32.0
│   └── wgpu-hal 26.0.6
│       ├── wgpu-core-deps-windows-linux-android 26.0.0
│       │   └── wgpu-core 26.0.1
│       │       └── wgpu 26.0.1
│       │           └── bevy_render 0.17.3
│       │               └── bevy_internal 0.17.3
│       │                   └── bevy 0.17.3
│       │                       ├── yeet 0.0.2
│       │                       ├── leafwing-input-manager 0.19.0
│       │                       │   └── lightyear_inputs_leafwing 0.25.5
│       │                       ├── bevy_transform_interpolation 0.3.0
│       │                       │   ├── avian3d 0.4.1
│       │                       │   └── avian2d 0.4.1
│       │                       ├── bevy_enhanced_input 0.20.0
│       │                       │   └── lightyear_inputs_bei 0.25.5
│       │                       ├── avian3d 0.4.1
│       │                       └── avian2d 0.4.1
│       ├── wgpu-core-deps-apple 26.0.0
│       │   └── wgpu-core 26.0.1
│       ├── wgpu-core 26.0.1
│       └── wgpu 26.0.1
└── lightyear_utils 0.25.5
    ├── lightyear_transport 0.25.5
    │   ├── lightyear_sync 0.25.5
    │   │   ├── lightyear_replication 0.25.5
    │   │   ├── lightyear_prediction 0.25.5
    │   │   ├── lightyear_interpolation 0.25.5
    │   │   ├── lightyear_inputs 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_replication 0.25.5
    │   ├── lightyear_raw_connection 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_netcode 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_messages 0.25.5
    │   │   ├── lightyear_sync 0.25.5
    │   │   ├── lightyear_replication 0.25.5
    │   │   ├── lightyear_prediction 0.25.5
    │   │   ├── lightyear_interpolation 0.25.5
    │   │   ├── lightyear_inputs_bei 0.25.5
    │   │   ├── lightyear_inputs 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_inputs 0.25.5
    │   └── lightyear 0.25.5
    ├── lightyear_sync 0.25.5
    ├── lightyear_replication 0.25.5
    ├── lightyear_prediction 0.25.5
    ├── lightyear_netcode 0.25.5
    ├── lightyear_messages 0.25.5
    ├── lightyear_link 0.25.5
    │   ├── lightyear_webtransport 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_websocket 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_udp 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_transport 0.25.5
    │   ├── lightyear_sync 0.25.5
    │   ├── lightyear_steam 0.25.5
    │   ├── lightyear_replication 0.25.5
    │   ├── lightyear_raw_connection 0.25.5
    │   ├── lightyear_netcode 0.25.5
    │   ├── lightyear_messages 0.25.5
    │   ├── lightyear_inputs_bei 0.25.5
    │   ├── lightyear_inputs 0.25.5
    │   ├── lightyear_crossbeam 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_connection 0.25.5
    │   │   ├── lightyear_transport 0.25.5
    │   │   ├── lightyear_sync 0.25.5
    │   │   ├── lightyear_steam 0.25.5
    │   │   ├── lightyear_replication 0.25.5
    │   │   ├── lightyear_raw_connection 0.25.5
    │   │   ├── lightyear_prediction 0.25.5
    │   │   ├── lightyear_netcode 0.25.5
    │   │   ├── lightyear_messages 0.25.5
    │   │   ├── lightyear_interpolation 0.25.5
    │   │   ├── lightyear_inputs_bei 0.25.5
    │   │   ├── lightyear_inputs 0.25.5
    │   │   ├── lightyear_frame_interpolation 0.25.5
    │   │   └── lightyear 0.25.5
    │   ├── lightyear_avian3d 0.25.5
    │   ├── lightyear_avian2d 0.25.5
    │   ├── lightyear_aeronet 0.25.5
    │   │   ├── lightyear_webtransport 0.25.5
    │   │   ├── lightyear_websocket 0.25.5
    │   │   ├── lightyear_steam 0.25.5
    │   │   └── lightyear 0.25.5
    │   └── lightyear 0.25.5
    ├── lightyear_interpolation 0.25.5
    ├── lightyear_core 0.25.5
    │   ├── lightyear_udp 0.25.5
    │   ├── lightyear_transport 0.25.5
    │   ├── lightyear_sync 0.25.5
    │   ├── lightyear_steam 0.25.5
    │   ├── lightyear_replication 0.25.5
    │   ├── lightyear_raw_connection 0.25.5
    │   ├── lightyear_prediction 0.25.5
    │   ├── lightyear_netcode 0.25.5
    │   ├── lightyear_messages 0.25.5
    │   ├── lightyear_link 0.25.5
    │   ├── lightyear_interpolation 0.25.5
    │   ├── lightyear_inputs_native 0.25.5
    │   ├── lightyear_inputs_leafwing 0.25.5
    │   ├── lightyear_inputs_bei 0.25.5
    │   ├── lightyear_inputs 0.25.5
    │   ├── lightyear_frame_interpolation 0.25.5
    │   ├── lightyear_crossbeam 0.25.5
    │   ├── lightyear_connection 0.25.5
    │   ├── lightyear_avian3d 0.25.5
    │   ├── lightyear_avian2d 0.25.5
    │   ├── lightyear_aeronet 0.25.5
    │   └── lightyear 0.25.5
    └── lightyear 0.25.5

Crate:     rustls-pemfile
Version:   2.2.0
Warning:   unmaintained
Title:     rustls-pemfile is unmaintained
Date:      2025-11-28
ID:        RUSTSEC-2025-0134
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0134
Dependency tree:
rustls-pemfile 2.2.0
└── wtransport 0.6.1
    ├── xwt-wtransport 0.13.2
    │   └── aeronet_webtransport 0.17.2
    │       └── lightyear_webtransport 0.25.5
    │           └── lightyear 0.25.5
    │               └── yeet 0.0.2
    └── aeronet_webtransport 0.17.2

warning: 2 allowed warnings found

[cBournhonesque]

Thanks for bringing this up; I would appreciate a fix!

[DrewRidley]

I think bincode is also entirely deprecated now, would be worth looking at postcard or something similar.

[cBournhonesque]

I traced the remaining warnings on current main. Lightyear’s direct paste usage has already moved to pastey; the two remaining paths are transitive through Aeronet:

• rustls-pemfile -> wtransport -> aeronet_webtransport
• paste -> steamworks -> aeronet_steam

I opened the durable upstream fixes:

• Remove rustls-pemfile from WebTransport dependencies aecsocket/aeronet#96 updates to wtransport 0.7 / current XWT, which uses rustls-pki-types::PemObject and removes rustls-pemfile
• Replace unmaintained paste dependency with pastey Noxime/steamworks-rs#339 replaces paste with pastey

Both PRs are mergeable and their build checks are passing. Once fixed releases are available, Lightyear can bump Aeronet/Steamworks and close this issue. A workspace-level Cargo patch here would not propagate to downstream consumers, so I avoided a checkout-only workaround.