Old versions in crates.io are all yanked about bitvec HOT 3 CLOSED

Yes; #55 described an error when communicating with the allocator that has been present since 0.11 and allows a use-after or double- free. I have not yet merged into trunk the patch that fixes it and explains the yank, but you can read about it here if you want. The important paragraph is

If you feel strongly that you cannot upgrade from a prior minor version, please file an issue and I will backport this fix and publish a patch on your minor series. I will also work with you on an upgrade path.

What release series are you using? I will publish a patch version with the fix to it.

Can I help you upgrade to 0.17?

from bitvec.

Thanks for your fixes for the memory safety problem, we can self upgrade to 0.17, it is not a big problem, but really a surprise.

from bitvec.

I'd really prefer it if Cargo would still resolve yanked crates in Cargo.toml and emit warnings that the crate has been yanked, rather than just failing to resolve. The Rust position that lockfiles should only be committed for application projects and not for library projects really makes yanking painful for library crates, and reduces its efficacy as a tool for cleanly removing versions that should no longer be used.

0.17 renames everything in the cursor module and, I learned after the fact, uses the wrong behavior to provide aliases. I don't remember offhand what other breaking changes there are in recent history.

from bitvec.