UGH. https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

Looks like Gram is not affected, but arrayref IS a transitive dependency. One reason why releasing new versions at most once per month makes sense ._.