Reports / Crate Census / Issue 2
Crate Census · issue 2 · crates.io data Oct 24, 2026
The top Rust crates that have gone quiet
Short answer182 of the 1000 most-downloaded Rust crates have not shipped a release in over 2 years (109 in over 3), yet together they still get about 146,767,724 real downloads a day. The most depended-on is hex (14,719 dependents, last release 5.6 years ago). Most are finished, not abandoned, but a quiet crate is also one where a security fix may not come fast.
182no release in 2+ years
109no release in 3+ years
147Mreal downloads a day, together
1000crates checked
The 25 most depended-on
| Crate | Dependents | Real downloads a day | Last release | Maintained? |
|---|---|---|---|---|
| hex | 14,719 | 1,974,541 | 0.4.3, 5.6 years ago | verdict |
| serde_yaml | 7,766 | 1,238,004 | 0.9.34+deprecated, 2.6 years ago | verdict |
| num-traits | 7,561 | 2,894,023 | 0.2.19, 2.5 years ago | verdict |
| walkdir | 7,101 | 1,935,670 | 2.5.0, 2.6 years ago | verdict |
| pretty_assertions | 5,760 | 522,294 | 1.4.1, 2.1 years ago | verdict |
| byteorder | 4,780 | 2,056,746 | 1.5.0, 3.0 years ago | verdict |
| paste | 3,246 | 1,338,247 | 1.0.15, 2.5 years ago | verdict |
| structopt | 2,931 | 72,927 | 0.3.26, 4.8 years ago | verdict |
| urlencoding | 2,751 | 826,249 | 2.1.3, 3.3 years ago | verdict |
| dotenvy | 2,640 | 660,037 | 0.15.7, 3.6 years ago | verdict |
| async-stream | 2,627 | 884,583 | 0.3.6, 2.1 years ago | verdict |
| subtle | 2,362 | 2,159,165 | 2.6.1, 2.3 years ago | verdict |
| mime | 1,969 | 1,806,559 | 0.3.17, 3.6 years ago | verdict |
| heck | 1,865 | 3,901,922 | 0.5.0, 2.6 years ago | verdict |
| static_assertions | 1,688 | 1,442,265 | 1.1.0, 7.0 years ago | verdict |
| secrecy | 1,604 | 573,031 | 0.10.3, 2.0 years ago | verdict |
| winapi | 1,603 | 1,251,224 | 0.3.9, 6.3 years ago | verdict |
| mime_guess | 1,543 | 857,341 | 2.0.5, 2.3 years ago | verdict |
| bs58 | 1,477 | 756,797 | 0.5.1, 2.6 years ago | verdict |
| fs2 | 1,409 | 259,151 | 0.4.3, 8.8 years ago | verdict |
| rustls-pemfile | 1,378 | 945,078 | 2.2.0, 2.1 years ago | verdict |
| serde_urlencoded | 1,342 | 1,715,895 | 0.7.1, 4.8 years ago | verdict |
| derive_builder | 1,332 | 633,349 | 0.20.2, 2.0 years ago | verdict |
| web-time | 1,163 | 1,133,377 | 1.1.0, 2.6 years ago | verdict |
| serde-wasm-bindgen | 1,141 | 191,519 | 0.6.5, 2.7 years ago | verdict |
What to do if one is in your tree
- Run
cargo tree -i <crate>to see what pulls it in; often it is a transitive dependency you cannot drop directly. - Run
cargo audit: a quiet crate with a known advisory is the real risk, not the quiet itself. - Each crate's "is it still maintained?" page lists more active alternatives where we found them.
Method
Last non-yanked release per crate from crates.io, for the top 1000 crates by all-time downloads, fetched Oct 24, 2026. Dependents = crates.io reverse dependencies. Real downloads = quiet-day median. We do not check commits: a crate can be active on GitHub without publishing.
Up next
More in this seriesReportsRecurring Tensorust data reports: the monthly LLM API Price Index and App Store review times from real decisions, each with CSV and embeddable charts.Read it next →