Is anything in your Cargo.lock a problem?

What the $49 report gives you

• Needs attention, in order: security advisories on the exact versions you pin (with CVSS severity and the version that fixes each one, and whether cargo update gets you there), yanked versions, unmaintained and unsound crates, direct dependencies a major version behind or without a release in two years.
• Every dependency: pinned vs latest, semver-compatible or breaking, when your version and the latest came out, releases in the last 12 months, declared MSRV.
• The lockfile's MSRV: the highest rust-version any pinned package declares.
• Files: HTML (save it as PDF from the page), CSV of every row, and an email copy.

See a sample report (ripgrep 11.0.0's lockfile: 4 packages with security advisories, 1 yanked) · today's ripgrep · sample CSV

Tracking: $39/month

New advisories land on old versions all the time. Tracking re-runs the report every 7 days against your lockfile and emails you what changed: a new advisory on something you pin, a new release, a yank. Upload a new Cargo.lock from your report page whenever you change dependencies. Cancel anytime from the same page.

Sources

• Versions, yanked flags, MSRV: the crates.io sparse index (index.crates.io).
• Advisories: OSV, which carries the RustSec advisory database and GitHub advisories, matched to your exact versions. Browse them on our advisory pages.
• Release dates: deps.dev. Real downloads: our crate data (CC BY 4.0).

Checking one Cargo.toml quickly? The free Cargo.toml checker stays free, and so do single-crate alerts (the Watch button on any crate page).

Privacy

A Cargo.lock lists crate names and versions, no code. We store the one you check privately so the paid report can be generated from it, and delete it on request (support@tensorust.com). Git and path dependencies are listed but not looked up.