- Home
- Software Composition Analysis Software
- cargo-audit
On the recordRead 11 Oct 202613 facts
cargo-audit
Plans and prices
cargo-audit
Free
Open-source Cargo subcommand · Requires Rust 1.74 or later
Read 11 Oct 2026 · github.com
On the record
- Advisory data exchange
- RustSec exports advisory data to OSV in real time, and its data is imported by the GitHub Advisory Database.rustsec.org · read 11 Oct 2026
- Advisory handling
- Advisories can be ignored with the `--ignore` option or configured in audit.toml.github.com · read 11 Oct 2026
- Binary scanning
- The `cargo audit bin` subcommand scans compiled binaries; results are fully accurate when binaries include dependency data from cargo-auditable.github.com · read 11 Oct 2026
- Binary scanning limit
- For binaries not built with cargo-auditable, dependency recovery from panic messages misses embedded C code and roughly half of Rust dependencies.github.com · read 11 Oct 2026
- CI integration
- The README recommends the audit-check GitHub Action for using cargo-audit on GitHub Actions.github.com · read 11 Oct 2026
- Fix command
- An experimental `cargo audit fix` feature can update vulnerable dependency requirements in Cargo.toml and supports a dry run.github.com · read 11 Oct 2026
- Installation
- Install it as a Cargo subcommand with `cargo install cargo-audit`.github.com · read 11 Oct 2026
- License
- The cargo-audit crates are licensed under either Apache License 2.0 or MIT, at the user's option.github.com · read 11 Oct 2026
- Maintainer
- The RustSec Advisory Database is maintained by the Rust Secure Code Working Group.rustsec.org · read 11 Oct 2026
- Purpose
- Audits Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database.rustsec.org · read 11 Oct 2026
- Requirements
- cargo-audit requires Rust 1.74 or later.github.com · read 11 Oct 2026
- Security scope
- The RustSec Advisory Database contains security advisories filed against Rust crates published via crates.io.rustsec.org · read 11 Oct 2026
- Usage caution
- The README advises running cargo-audit only on trusted projects because generating a missing Cargo.lock runs cargo update --workspace and Cargo may execute project code.github.com · read 11 Oct 2026
