Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

Recipe

Update one dependency on purpose

Use when: a crate you use has a newer compatible release (a bug fix, a security fix) and you want it without moving anything else

Goal: a lock file that differs only in that crate (and anything it drags along), tested and committed

Taught in Cargo.lock and builds you can repeat

Quick recipe

  1. See where it's used
  2. Update just that crate
  3. Read what Cargo printed
  4. Build and test
  5. Commit the lock file on its own
  1. 1

    Run cargo tree -i <crate> (inverted: who depends on it).

    Example

    slugline is locked to heck 0.4.0, and heck 0.4.1 is out. cargo tree -i heck prints heck with slugline directly under it. So slugline asks for heck itself, and its own heck = "0.4" decides which versions are allowed.

    Why: you learn whether it's your direct dependency or comes through another crate, which decides who controls the requirement.

  2. 2

    Run cargo update -p <crate>, or add --precise <version> for an exact one.

    Example

    Run cargo update -p heck. Cargo prints Updating heck v0.4.0 -> v0.4.1 (available: v0.5.0).

    Why: -p keeps every other entry of the lock file as it was, so the change is small and easy to review.

  3. 3

    Check the Updating a -> b lines, and any (available: ...) note.

    Example

    There is one Updating line, so only heck moved. The note (available: v0.5.0) says a newer heck exists outside "0.4". Taking it would mean changing Cargo.toml to heck = "0.5", and maybe the code too. That is a separate change, not this one.

    Why: an available version outside your requirement needs a Cargo.toml edit, which update never makes.

  4. 4

    Run cargo test (and cargo build --release if you ship binaries).

    Example

    Run cargo test. If a test that passed before now fails, cargo update -p heck --precise 0.4.0 puts the old version back while you look into it.

    Why: semver is a promise, not a guarantee; the tests are how you find out it held.

  5. 5

    Commit the changed Cargo.lock with a message naming the update.

    Example

    git commit Cargo.lock -m "Update heck to 0.4.1". The diff changes two lines in heck's entry, its version and its checksum, and nothing else.

    Why: a lone lock-file commit is easy to revert if the new version misbehaves later.