# Avoiding cryptonite-verse packages in your dependency closure

**URL:** <https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526>\
**Category:** Uncategorized\
**Created:** [August 6, 2026, 1:41pm UTC](https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526 "2026-08-06T13:41:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pranaysashank](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/pranaysashank/32/1682_2.png) [@pranaysashank](https://discourse.haskell.org/u/pranaysashank)\
**Post date:** [August 6, 2026, 1:41pm UTC](https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526/1 "2026-08-06T13:41:37Z")

</div>

At work, I was upgrading the `crypton-x509*` packages to avoid the vulnerabilities published in the HSEC advisory. The new versions of these packages released with the fixes now depend on `ram` instead of `memory` which was kind of an issue because many packages still use `memory` over `ram`.

While I have upgraded / forked all the packages that bring in the `cryptonite`-verse, it’s still possible that a new cabal plan can still bring them into the closure, so here’s how I am currently outlawing dependencies bringing in `cryptonite`, `memory`, `asn1-*`.

```haskell
-- file: cabal.project.local
constraints:
  cryptonite < 0,
  memory < 0,
  crypto-pubkey-types < 0,
  asn1-types < 0,
  asn1-encoding < 0,
  asn1-parse < 0,
  hourglass < 0,
  pem < 0

```

you can also directly import this gist that has the same constraints

```haskell
-- file: cabal.project.local
import: https://gist.githubusercontent.com/pranaysashank/11fb5bc36b0c71ba7f69e8e2d980340f/raw/no-cryptonite-memory-asn1-universe.project

```

---

<div class="post-metadata">

**Author:** ![Ambrose](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/ambrose/32/5672_2.png) [@Ambrose](https://discourse.haskell.org/u/Ambrose)\
**Post date:** [August 6, 2026, 2:58pm UTC](https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526/2 "2026-08-06T14:58:37Z")

</div>

So cryptonite and deps are just sitting on Hackage with vulnerabilities?

Is there a way for Hackage to mark them as bad so cabal won’t plan for them unless the user explicitly overrides it? I know it says it’s deprecated but that doesn’t feel like enough.

Feels like a pretty important feature! Given the maintainer refuses to do any maintenance but also refuses to allow people to contribute in order to fix vulnerabilities.

---

<div class="post-metadata">

**Author:** ![jaror](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/jaror/32/3271_2.png) [@jaror](https://discourse.haskell.org/u/jaror)\
**Post date:** [August 6, 2026, 3:14pm UTC](https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526/3 "2026-08-06T15:14:31Z")

</div>

We have the advisory database and the cabal-audit tool that uses it: [GitHub - MangoIV/cabal-audit: audit your cabal projects for haskell-specific security-advisories · GitHub](https://github.com/MangoIV/cabal-audit/)

I got that info from this blog post: [Overview of Haskell security tooling | The Haskell Programming Language's blog](https://blog.haskell.org/overview-of-haskell-security-tooling/)

---

<div class="post-metadata">

**Author:** ![pranaysashank](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/pranaysashank/32/1682_2.png) [@pranaysashank](https://discourse.haskell.org/u/pranaysashank)\
**Post date:** [August 6, 2026, 3:22pm UTC](https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526/4 "2026-08-06T15:22:59Z")

</div>

I think there are plans to mark a package as vulnerable like how it is done for deprecated packages.

Though this post is not about the vulnerable packages, it’s about avoiding all the packages abandoned in the cryptonite universe

---

<div class="post-metadata">

**Author:** ![Ambrose](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/ambrose/32/5672_2.png) [@Ambrose](https://discourse.haskell.org/u/Ambrose)\
**Post date:** [August 6, 2026, 6:06pm UTC](https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526/5 "2026-08-06T18:06:40Z")

</div>

cabal audit is useful but top-down and opt-in.

i think hackage should be able to flag packages as vulnerable in a bottom-up, opt-out way. for our own safety.

like those constraints @pranaysashank put in that gist should be the default unless the user says “i know what i’m doing”

---

<div class="post-metadata">

**Author:** ![ApothecaLabs](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/apothecalabs/32/3215_2.png) [@ApothecaLabs](https://discourse.haskell.org/u/ApothecaLabs)\
**Post date:** [August 10, 2026, 2:22pm UTC](https://discourse.haskell.org/t/avoiding-cryptonite-verse-packages-in-your-dependency-closure/14526/6 "2026-08-10T14:22:26Z")

</div>

This lights a fire under me to finish the `memalloc` library - it is intended to replace `memory` to help bring end to the cryptonite-verse.