As a separate issue, I would suggest NOT coupling security advisories to yanks. Yanks are extremely disruptive and not all vulnerabilities are created equal. Some vulnerabilities can be mitigated in ways other than upgrading a crate, like making local configuration changes. Some vulnerabilities may affect optional functionality not everyone is using or functionality that can be compiled out by e.g. disabling certain cargo feature settings for that crate. Some may be relatively innocuous and/or hard-to-exploit and therefore not warrant an immediate upgrade.
Advisories are just that: they should give advice on how to deal with an issue, without breaking your program and forcing an upgrade. I would argue that coupling this sort of functionality to yanks would severely diminish its utility to a point of near-uselessness.
I would suggest a well-considered second step after any sort of cargo vuln / cargo advisory feature ships could be to include something like a vulnerability class, severity, CVSS score, etc that people could potentially gate hard failures on (e.g. in CI). But I don’t think forcing a yank for any sort of security vulnerability you plan on issuing an advisory for makes sense.
