But it is a pain for a distro to upgrade a vulnerable crate dependency