# An ofrenda for the Rust crates that went quiet

> Source: <https://dev.to/lymah/an-ofrenda-for-the-rust-crates-that-went-quiet-597l>
> Published: 2026-10-31 15:13:28+00:00

*This is a submission for the [Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine](https://dev.to/challenges/hacktoberfest-week4-2026-10-26)*

Quiet is not a verdict. Every crate in this post was somebody's free work. But when a dependency stops moving, someone should notice, and say thank you, and check whether it is gone or just finished.

```
// unsafe-libyaml 0.2.11
It sorted the wild blooms, seeking order in chaos.
unsafe-libyaml 0.2.11: libyaml transpiled to rust by c2rust. First released 2022-07-03, last released 2024-03-17 (2.6 years before this scan), after 17 releases. Its repository has been archived. The last commit on its main branch was on 2024-03-21. RustSec advisory RUSTSEC-2024-0449 (2024-03-25) marks it unmaintained: unsafe-libyaml is unmaintained.
```

**Ofrenda** reads the `Cargo.lock` files you give it and finds the crates that went quiet. For each one it builds a small card for an ofrenda page: the facts about the crate, and one line of remembrance.

The division of labour is the whole idea:

If the model fails three times, the card simply shows the facts. A card with no poem is better than a card with a lie.

I read the theme as "honour the past, accurately".

An offering for the Rust crates in your `Cargo.lock` that went quiet.

Rust does everything that has to be true. It reads your lockfiles, fetches each crate's release history (crates.io), its repository state (GitHub) and any RustSec "unmaintained" advisory, and writes a facts line for each flagged crate. A small local model (Gemma 3 4B through Ollama) adds one short epitaph per crate That epitaph is the only thing the model writes, and Rust rejects it if it contains a digit, a number or time word, a valuation ("useful"), a status word ("archived"), a name that is not in the crate's own name or description, or a technical term the description does not use. A rejected epitaph is asked for again with the reason (up to three tries, with a list of words other epitaphs already used); after that the entry shows only the facts.

The epitaphs are poetry…

`regex` and `serde_json`; it calls `curl` for crates.io, GitHub and Ollama.`statix`, `ripgrep` and `bat`): 342 crates.io packages. RustSec's advisory database is the ground truth for "unmaintained".
I compared two rules against RustSec's unmaintained advisory list, using data collected on 2026-10-30.

| Rule | Flagged | RustSec matches | Not marked unmaintained | Precision | Recall | 
|---|---|---|---|---|---|
| No release for 2+ years | 52 | 6 | 46 | 0.12 | 0.86 | 
| Quiet + dead repository | 38 | 6 | 32 | 0.16 | 0.86 | 

*The one RustSec-flagged crate the date rule missed is `bincode`. Its story is below.*

RustSec marks 7 of the 342 as unmaintained. The date rule finds 6 of them and is wrong about most of what it flags. Release dates can't tell asleep from dead.

The repository check showed it. 14 of the quiet crates have had a commit in the last two years: `utf8parse` was committed to on 2026-10-25, `num-traits` on 2026-07-07, `core-foundation-sys` on 2026-09-14. Those are asleep, or finished. Two more, `bisync_macros` and `countme`, have archived repositories and no advisory. A few, like `difflib` and `content_inspector`, haven't had a commit since 2018. Nobody filed an advisory for them, so they count as false positives, which means the 0.16 is a floor. ***RustSec is a good ground truth, not a complete one***.

`unsafe-libyaml` was "unmaintained as of March 17, 2024". That's the last-release date. The advisory is dated 2024-03-25. My checker only compared tokens, and "March" and "17" both existed somewhere in the facts. It also wrote "useful", "valuable" and "archived" for crates whose facts said none of that, and turned 5.8 and 8.8 years into "five" and "eight". So I moved every fact into code.`atty` it wrote "It checks the path". The crate checks whether a stream is a terminal, and its description is circular, so the model made something up. For `paste`, a token-pasting macro, it wrote "a steady hand for parsing". The fix was a rule: a technical word is allowed only if the crate's description uses it. Of my last 10 first attempts, 8 were rejected, 6 of them for invented technical terms (`command`, `structure`, `data`, `code`).
The final run: 7 epitaphs accepted (5 after a retry), 3 cards with facts only.

The card that stopped me was `bincode`. My date rule said it was still releasing: the last release was 2025-12-16, under a year ago. RustSec’s advisory (RUSTSEC-2025-0141), dated the same day, says something else. The team ended development for good after a doxxing and harassment incident, and considers version 1.3.3 complete.

That isn’t neglect, and it isn’t abandonment. It’s a decision, made after what the advisory calls a doxxing and harassment incident. My code could count releases and read dates. It could not have told me that.

The poem on `bincode`’s card was written by a model that never saw any of this. That is the point of the checks, and also their limit: they stop the model from inventing facts, but they can’t give it understanding.

Thank you, `bincode` team, for the years of work and for 1.3.3.

*To the people behind these crates: thank you for the work, and for what it gave the rest of us.*

**Best Use of Gemma**. Gemma 3 runs locally as the epitaph writer, and the checking layer exists because of how a 4B Gemma fails