c.f. https://rustsec.org/advisories/RUSTSEC-2021-0153.html The last release of the "encoding" crate was on 2016-08-28, and the last commit in the git repository of the project on GitHub was on 2017-07-11. The "encoding_rs" crate is listed as a possible replacement. The following Rust packages in Fedora depend on the "encoding" crate: - librsvg2 - bat - compress-tools - lopdf - tendril - url (v1) I plan to mark the "rust-encoding-devel" package with "Provides: deprecated()" to ensure no new packages in Fedora start depending on it, and will file additional bugs for all dependent packages.
librsvg2 seems to have switched from the "encoding" to the "encoding_rs" crate since I filed this bug.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 39 development cycle. Changing version to 39.