Problem
When a package becomes unmaintained, it's important to notify downstream users so they can migrate, since future vulnerabilities won't be patched.
Some ecosystems are already publishing these notices via OSV (e.g., RUSTSEC-2026-0173). However, there is no machine-readable field to distinguish an "unmaintained" notice from a standard vulnerability. Tools currently have to resort to brittle string parsing of the details or summary text.
Programmatic distinction is necessary because an unmaintained package requires a completely different remediation workflow (e.g., finding an alternative or forking) compared to a typical version bump for a standard vulnerability (also is not as urgent as an immediately exploitable vulnerability).
Proposal
Introduce a standardized, machine-readable way to flag an advisory as an unmaintained notice.
One approach would be adding a new severity type, as that field allows multiple different types:
https://ossf.github.io/osv-schema/#severitytype-field
"severity": [
{
"type": "MAINTENANCE",
"score": "UNMAINTAINED"
}
]
Open to other options as well!
@SecurityCRob and @kborchers I believe this had been an discussion point in some other openssf meetings, let me know if I covered the problem here or if I missed something, and if you guys have any other suggestions!
Problem
When a package becomes unmaintained, it's important to notify downstream users so they can migrate, since future vulnerabilities won't be patched.
Some ecosystems are already publishing these notices via OSV (e.g., RUSTSEC-2026-0173). However, there is no machine-readable field to distinguish an "unmaintained" notice from a standard vulnerability. Tools currently have to resort to brittle string parsing of the details or summary text.
Programmatic distinction is necessary because an unmaintained package requires a completely different remediation workflow (e.g., finding an alternative or forking) compared to a typical version bump for a standard vulnerability (also is not as urgent as an immediately exploitable vulnerability).
Proposal
Introduce a standardized, machine-readable way to flag an advisory as an unmaintained notice.
One approach would be adding a new severity type, as that field allows multiple different types:
https://ossf.github.io/osv-schema/#severitytype-field
Open to other options as well!
@SecurityCRob and @kborchers I believe this had been an discussion point in some other openssf meetings, let me know if I covered the problem here or if I missed something, and if you guys have any other suggestions!