fontdue (used by streamkit-nodes for text rasterization) pulls in ttf-parser 0.21.1, which is now flagged unmaintained by RUSTSEC-2026-0192 (author archived the crate; no safe upgrade available). It is currently ignored in deny.toml alongside the other unmaintained transitive advisories.
The advisory suggests skrifa (Google Fonts "oxidize"/fontations) as an actively-maintained alternative. Track replacing fontdue (or its ttf-parser usage) so the ignore entry can be removed.
Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0192
fontdue(used bystreamkit-nodesfor text rasterization) pulls inttf-parser 0.21.1, which is now flagged unmaintained by RUSTSEC-2026-0192 (author archived the crate; no safe upgrade available). It is currently ignored indeny.tomlalongside the other unmaintained transitive advisories.The advisory suggests
skrifa(Google Fonts "oxidize"/fontations) as an actively-maintained alternative. Track replacing fontdue (or its ttf-parser usage) so the ignore entry can be removed.Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0192