Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

Recipe

Check a crate before adding it

Use when: you're about to add a dependency you haven't used before

Goal: a crate you've looked at on purpose, added with a sensible requirement, with its cost in the graph known

Taught in Auditing your dependencies · a later section extends this recipe with more cases

Quick recipe

  1. Read its details
  2. Check for advisories
  3. Add it and look at what came with it
  4. Trim features
  5. Commit the manifest and the lock together
  1. 1

    Run cargo info <crate> and open its crates.io page and repository.

    Example

    cargo info heck@0.5.0 shows license: MIT OR Apache-2.0 and rust-version: 1.56. A project on Rust 1.95 is well past 1.56, and both licenses are common and permissive. The repository: line gives the link to open next.

    Why: the license, rust-version, last release date and download count tell you whether it's usable and maintained.

  2. 2

    Search the RustSec database for the crate, or add it on a branch and run cargo audit.

    Example

    Search the RustSec database for heck. Say the search finds no advisory for 0.5.0. Then nothing stops you here. If it listed one, you'd read which versions fix it and ask for one of those.

    Why: a known advisory on the version you'd get is a reason to pick another version or crate.

  3. 3

    Run cargo add <crate>, then cargo tree -e normal and cargo tree -d.

    Example

    After cargo add heck, cargo tree -e normal shows heck v0.5.0 under your package with nothing below it: heck brings no crates of its own. cargo tree -d lists no new duplicates. Adding it grows the graph by just one crate.

    Why: a crate that brings many more crates or duplicate versions costs build time and widens what you trust.

  4. 4

    If it pulls in parts you don't use, try default-features = false with only the features you need.

    Example

    heck has no optional parts, so there is nothing to trim. A crate that has them is section 4's textkit: textkit = { version = "0.1", default-features = false, features = ["graphemes"] } keeps only the graphemes part and leaves the default title off.

    Why: every feature left off is code you don't compile or trust.

  5. 5

    Commit Cargo.toml and Cargo.lock in one change.

    Example

    One commit holds both files. In Cargo.toml the new line is heck = "0.5.0". In Cargo.lock the new entry is heck at 0.5.0, with its checksum. A reviewer sees the rule and the exact result side by side.

    Why: reviewers see the requirement and exactly what it resolved to, including every new transitive crate.