# stack-graphs library unmaintained and archived

Source: https://junglewise.ai/threats/rustsec-2026-0303-stack-graphs-is-archived-and-unmaintained-22300fa4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-09-22

The stack-graphs Rust library, used for source code graph analysis, is archived and no longer maintained by its creator. The project repository has been frozen with issues and pull requests disabled, meaning security issues or bugs cannot be reported or fixed through official channels. Organizations relying on this library face ongoing security risks without access to updates or vendor support.

Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [GitHub](https://junglewise.ai/threats/vendors/github).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 22 September 2026.

**Which products and versions are affected?** stack-graphs (crates.io) SEMVER:introduced=0.0.0-0; GitHub Stack-Graphs 0.14.1 and earlier.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is in a software library.

**Am I affected?** Check whether you run stack-graphs (crates.io) or GitHub Stack-Graphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The stack-graphs Rust library repository (github/stack-graphs) has been archived with all issue and pull request functionality disabled. The last crates.io release was version 0.14.1 published on 2024-12-13, with the repository's final commit on 2025-09-09. No active successor project has been identified, leaving consumers with no upgrade path for security or maintenance fixes.

## Affected products

- GitHub stack-graphs 0.14.1 and earlier

## Timeline

- 2026-09-22: disclosed: Advisory published noting project is archived and unmaintained

## References

- [https://crates.io/crates/stack-graphs](https://crates.io/crates/stack-graphs)
- [https://rustsec.org/advisories/RUSTSEC-2026-0303.html](https://rustsec.org/advisories/RUSTSEC-2026-0303.html)

## Related threats

- [stack-graphs C API memory safety violation in extern functions](https://junglewise.ai/threats/rustsec-2026-0302-stack-graphs-c-api-exports-are-safe-extern-c-3d7bbffa)