cargo
Last updated October 25, 2026View source (v0.30.0)
This page explains how Bomly builds a dependency graph for cargo projects: the detector chain it runs, what that chain needs, and what it can report.
| Property | Value |
|---|---|
| Package manager | cargo |
| Ecosystem | rust |
| Detector chain | cargo-detector, syft-detector |
| Evidence patterns | Cargo.lock, Cargo.toml |
| Ignored directories | target |
| Multi-module resolution | Yes |
| Install-first support | Yes |
| Remediation hints | direct-bump1, lockfile-refresh2 |
| Commands the chain may run | cargo. The Syft fallback is built in; the lite build runs an external syft from PATH instead. |
How cargo resolves
cargo-detector is lockfile-first with a build-tool fallback. It parses Cargo.lock directly when present, and runs cargo metadata when the lockfile is missing.
| Path | Strategy | Command |
|---|---|---|
Cargo.lock present | Lockfile parser | None |
| Lockfile missing | Build tool | cargo metadata --format-version 1 --locked |
Both paths stay offline. The lockfile parser reads a committed file. The --locked flag forbids Cargo from updating the lockfile, so cargo metadata uses cached registry data and does not fetch. On a fresh machine with no registry cache and no committed lockfile, the command fails rather than downloading. See Network and privacy for the shared rule.
Prerequisites
- A committed
Cargo.lock(strongly recommended), orcargoonPATHwith a warm registry cache. - A
Cargo.toml, which is the evidence that triggers the detector.
Examples
Fix a direct vulnerability
Raise the version in Cargo.toml:
[dependencies]
serde = "1.0.210"
Re-lock with cargo update -p serde and re-scan.
Pin a transitive vulnerability
Cargo supports [patch.crates-io] for transitive overrides:
[patch.crates-io]
openssl = { git = "https://github.com/sfackler/rust-openssl", tag = "openssl-v0.10.66" }
Re-lock with cargo update and re-scan.
Workspaces
When the root Cargo.toml declares [workspace], every member crate is scanned. Fields inherited with workspace = true are resolved from the root manifest.
--install-first
With --install-first, Bomly runs cargo fetch --locked before resolving the graph. That downloads crates from crates.io, or from the sources Cargo.toml declares, into the registry cache. The --locked flag forbids any lockfile change.
bomly scan --install-first
To append flags to that command, repeat --install-arg. This requires --detectors cargo-detector:
# Restrict to a specific target triple
bomly scan --install-first --detectors cargo-detector \
--install-arg --target --install-arg x86_64-unknown-linux-gnu
Source details
Bomly reads registry, Git, path, and workspace sources from Cargo metadata or Cargo.lock. That lets bomly diff review a package that moves to Git.
Reachability
Bomly has no Rust reachability analyzer. --analyze reports not_applicable for crates.
Limitations
- Feature flags are recorded as metadata. An advisory that affects one feature still matches the whole crate.
- Target-specific dependencies (
[target.'cfg(unix)'.dependencies]) are all included. Per-target reachability is not computed. build.rsscripts are not run.