[uecker]

That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically link to the right libraries instead of vendoring the code. Then the library can be updated once. IMHO this is the only reasonable approach.

[simonask]

It's trivial to see on crates.io whether a crate is unmaintained.

[uecker]

Maybe if it is completely unmaintained, but this is not enough to solve the problem and maybe also not really the point.

[shwouchk]

is it trivial to see if a third level dependency is unmaintained?