RUSTSEC-2026-0173: proc-macro-error2 is unmaintained

[github-actions]

proc-macro-error2 is unmaintained

Details
Status	unmaintained
Package	proc-macro-error2
Version	2.0.1
URL	GnomedDev/proc-macro-error-2#17
Date	2026-06-07

The author of proc-macro-error2 has confirmed that the crate is no longer maintained and recommends that users migrate away from it.

proc-macro-error2 was originally created as a maintained fork of proc-macro-error (see RUSTSEC-2024-0370). Both the original crate and this fork are now unmaintained.

Possible Alternative(s)

• manyhow
• proc-macro2-diagnostics

See advisory page for additional details.

[PierreLeGuen]

Triage (2026-06-08): Labeled blocked-upstream and added to the cargo-audit ignore list in #733 (with justification), mirroring how paste (#653) and derivative (#654) are handled.

Dependency path (build-time / proc-macro only):

proc-macro-error2 2.0.1
└── alloy-sol-macro 1.5.2 (proc-macro)
    └── alloy-sol-types 1.5.2
        └── ... alloy 1.2.1
            └── dstack-sdk 0.1.3
                └── cloud-api crates

Status: No fix available. proc-macro-error2 was the maintained fork of proc-macro-error (RUSTSEC-2024-0370); the author has now confirmed it too is unmaintained. There is no patched version to upgrade to, and the recommended alternatives (manyhow, proc-macro2-diagnostics) require a migration in alloy-sol-macro upstream.

Risk for this repo: informational only. Unmaintained-crate notice, not a vulnerability, and the dependency is build-time only (proc-macro expansion) — it ships no runtime code.

Tracking: waiting for alloy-sol-macro to drop proc-macro-error2. Keeping this issue open as the blocked-upstream tracker.