---
id: RUSTSEC-2026-0440
title: '`astral-tokio-tar` is unmaintained'
summary: '`astral-tokio-tar` is unmaintained'
severity: none
vendor: astral-tokio-tar
product: astral-tokio-tar
ecosystem: rust
affected:
  - astral-tokio-tar >= 0.0.0-0
published: '2026-11-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T09:00:02.629409099Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0440'
references:
  - url: 'https://crates.io/crates/astral-tokio-tar'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0440.html'
  - url: 'https://github.com/astral-sh/tokio-tar/pull/130'
tags:
  - osv
  - rust
ingestedAt: '2026-11-05T15:13:27.897Z'
---

## Overview

Astral ended maintenance of `astral-tokio-tar` on November 3, 2026.
All versions of the crate are deprecated and unmaintained.

For strict tar encoding and decoding, Astral recommends [`tar-codec`]
as a possible replacement.

[0.7.1 release]: https://github.com/astral-sh/tokio-tar/releases/tag/v0.7.1
[`tar-codec`]: https://crates.io/crates/tar-codec

## Affected packages

- `astral-tokio-tar >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.