Yeah, I'd put the blame for that on the tools / systems which consume and report this kind of vulnerability data. They (at least as far as I've seen) don't real

Yeah, I'd put the blame for that on the tools / systems which consume and report this kind of vulnerability data. They (at least as far as I've seen) don't really differentiate between severities of vulnerabilities. On the one hand, a strong preference toward "just patch" for vulnerabilities can make a lot of sense (the more that mechanism is flexed, the better it moves when you really need it, and rapid integration of fixes reduces time for exploitation by attackers), but here it's applied to a maintenance notice that ought to be treated a little differently. Nonetheless, I think RustSec's feed is working as intended, and I'd put the expectation on the consuming tools (including `cargo-audit`, which I believe is largely maintained by the same people that maintain the RustSec vulnerability database) to change.