Sample report. Input: the public Cargo.lock of ripgrep 11.0.0, checked 2026-10-25. Generated by the same code that writes paid reports. Check your own Cargo.lock →

Tensorust Crate Portfolio

Sample: ripgrep 11.0.0's Cargo.lock (2019)

Generated 2026-10-25 15:40 UTC from your Cargo.lock: 72 crates.io packages (71 crates), 29 direct. Workspace members: globset, grep, grep-cli, grep-matcher, grep-pcre2, grep-printer, grep-regex, grep-searcher, ignore, ripgrep.

4packages with a security advisory on the version you pin
7flagged unmaintained, unsound or notice
1pinned versions that were yanked
68behind the latest release (39 a major version behind)
19with no release in 2+ years
n/aminimum Rust your lockfile declares (highest rust-version)

Needs attention, in order

  1. regex 1.1.5: RUSTSEC-2022-0013 (high 7.5)Regexes with large repetitions on empty sub-expressions take a very long time to parse. Fixed in 1.5.5: cargo update -p regex gets it.
  2. thread_local 0.3.6: RUSTSEC-2022-0006 (unrated)Data race in `Iter` and `IterMut`. Fixed in 1.1.4: needs a version bump in Cargo.toml.
  3. remove_dir_all 0.5.1: RUSTSEC-2023-0018 (unrated) (transitive)Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU). Fixed in 0.8.0: needs a version bump in Cargo.toml.
  4. smallvec 0.6.9: RUSTSEC-2019-0009 (critical 9.8) (transitive)Double-free and use-after-free in SmallVec::grow(). Fixed in 0.6.10: cargo update -p smallvec gets it.
  5. smallvec 0.6.9: RUSTSEC-2019-0012 (critical 9.8) (transitive)Memory corruption in SmallVec::grow(). Fixed in 0.6.10: cargo update -p smallvec gets it.
  6. smallvec 0.6.9: RUSTSEC-2021-0003 (critical 9.8) (transitive)Buffer overflow in SmallVec::insert_many. Fixed in 0.6.14: cargo update -p smallvec gets it.
  7. smallvec 0.6.9 is yanked (transitive)The author pulled this version from crates.io. cargo update -p smallvec moves you to 0.6.14; the newest release is 1.16.4.
  8. atty 0.2.11: unsound (RUSTSEC-2021-0145)Potential unaligned read.
  9. atty 0.2.11: unmaintained (RUSTSEC-2024-0375)`atty` is unmaintained.
  10. crossbeam-channel 0.3.8: unsound (RUSTSEC-2022-0019)Channel creates zero value of any type. Fixed in 0.4.4.
  11. memmap 0.7.0: unmaintained (RUSTSEC-2020-0077)memmap is unmaintained.
  12. crossbeam-utils 0.6.5: unsound (RUSTSEC-2022-0041) (transitive)Unsoundness of AtomicCell<*64> arithmetics on 32-bit targets that support Atomic*64. Fixed in 0.8.7.
  13. rand_core 0.4.0: unsound (RUSTSEC-2019-0035) (transitive)Unaligned memory access. Fixed in 0.4.2.
  14. rand_os 0.1.3: unmaintained (RUSTSEC-2025-0124) (transitive)rand_os crate is unmaintained.
  15. smallvec 0.6.9: unsound (RUSTSEC-2018-0018) (transitive)smallvec creates uninitialized value of any type. Fixed in 0.6.13.
  16. aho-corasick 0.7.3 is a major version behind (1.1.5)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  17. atty: no release in 6.8 yearsLast release 2020-01-05. Small finished crates can be fine; check the repository for open security issues and whether a maintained fork exists.
  18. base64 0.10.1 is a major version behind (0.23.1)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  19. bstr 0.1.2 is a major version behind (1.13.1)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  20. bytecount 0.5.1 is a major version behind (0.6.9)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  21. clap 2.33.0 is a major version behind (4.6.7)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  22. crossbeam-channel 0.3.8 is a major version behind (0.5.17)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  23. fnv: no release in 6.5 yearsLast release 2020-05-14. Small finished crates can be fine; check the repository for open security issues and whether a maintained fork exists.
  24. memmap: no release in 8.1 yearsLast release 2018-09-20. Small finished crates can be fine; check the repository for open security issues and whether a maintained fork exists.
  25. regex-syntax 0.6.6 is a major version behind (0.8.11)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  26. same-file: no release in 6.8 yearsLast release 2020-01-11. Small finished crates can be fine; check the repository for open security issues and whether a maintained fork exists.
  27. termcolor: no release in 2.8 yearsLast release 2024-01-10. Small finished crates can be fine; check the repository for open security issues and whether a maintained fork exists.
  28. thread_local 0.3.6 is a major version behind (1.1.10)A semver-breaking upgrade: needs a Cargo.toml change and code changes. Older major lines usually stop getting fixes first.
  29. utf8-ranges: no release in 4.6 yearsLast release 2022-04-04. Small finished crates can be fine; check the repository for open security issues and whether a maintained fork exists.
  30. walkdir: no release in 2.7 yearsLast release 2024-03-01. Small finished crates can be fine; check the repository for open security issues and whether a maintained fork exists.

Priority 1 (red): security advisories and yanked versions. 2 (amber): unmaintained or unsound. 3: direct dependencies a major version behind or without a release in two years. Transitive packages come in through your direct ones: cargo tree -i NAME shows which.

Every dependency

CratePinnedLatestUpdatePinned releasedLast releaseReleases 12moMSRVAdvisories
smallvec0.6.9 yanked 1.16.4major behind 2019-02-172026-10-23 2d ago11 RUSTSEC-2018-0018 unsound, fix 0.6.13
RUSTSEC-2019-0009 critical, fix 0.6.10
RUSTSEC-2019-0012 critical, fix 0.6.10
RUSTSEC-2021-0003 critical, fix 0.6.14
atty direct0.2.11 0.2.14cargo update 2018-07-222020-01-05 6.8y ago0 RUSTSEC-2021-0145 unsound, no fix
RUSTSEC-2024-0375 unmaintained, no fix
crossbeam-channel direct0.3.8 0.5.17major behind 2019-01-292026-09-05 50d ago2 RUSTSEC-2022-0019 unsound, fix 0.4.4
memmap direct0.7.0 0.7.0up to date 2018-09-202018-09-20 8.1y ago0 RUSTSEC-2020-0077 unmaintained, no fix
regex direct1.1.5 1.13.1cargo update 2019-04-012026-07-15 3mo ago4 RUSTSEC-2022-0013 high, fix 1.5.5
thread_local direct0.3.6 1.1.10major behind 2018-08-152026-07-10 4mo ago1 RUSTSEC-2022-0006 unrated, fix 1.1.4
crossbeam-utils0.6.5 0.8.23major behind 2019-01-292026-09-05 50d ago2 RUSTSEC-2022-0041 unsound, fix 0.8.7
rand_core0.4.0 0.10.1major behind 2019-01-252026-09-02 53d ago14 RUSTSEC-2019-0035 unsound, fix 0.4.2
rand_os0.1.3 0.2.2major behind 2019-03-052019-08-28 7.2y ago0 RUSTSEC-2025-0124 unmaintained, no fix
remove_dir_all0.5.1 1.0.0major behind 2018-04-192024-11-22 23mo ago0 RUSTSEC-2023-0018 unrated, fix 0.8.0
aho-corasick direct0.7.3 1.1.5major behind 2019-03-312026-08-03 3mo ago2
base64 direct0.10.1 0.23.1major behind 2019-01-252026-08-04 3mo ago2
bstr direct0.1.2 1.13.1major behind 2019-04-062026-08-10 3mo ago5
bytecount direct0.5.1 0.6.9major behind 2019-02-102025-06-03 17mo ago0
clap direct2.33.0 4.6.7major behind 2019-04-062026-09-14 41d ago19
encoding_rs direct0.8.17 0.8.42cargo update 2019-02-262026-09-24 31d ago3
encoding_rs_io direct0.1.6 0.1.8cargo update 2019-04-062026-08-04 3mo ago1
fnv direct1.0.6 1.0.7cargo update 2017-11-092020-05-14 6.5y ago0
glob direct0.3.0 0.3.4cargo update 2019-03-072026-07-21 3mo ago1
lazy_static direct1.3.0 1.5.1cargo update 2019-02-272026-10-01 24d ago1
log direct0.4.6 0.4.34cargo update 2018-10-272026-08-22 2mo ago6
memchr direct2.2.0 2.8.3cargo update 2019-02-122026-07-08 4mo ago4
num_cpus direct1.10.0 1.17.0cargo update 2019-02-112025-05-30 17mo ago0
pcre2 direct0.2.0 0.2.11cargo update 2019-04-142025-09-25 13mo ago0
regex-syntax direct0.6.6 0.8.11major behind 2019-03-302026-06-09 5mo ago3
same-file direct1.0.4 1.0.6cargo update 2018-10-292020-01-11 6.8y ago0
serde direct1.0.90 1.0.229cargo update 2019-04-032026-07-18 3mo ago1
serde_derive direct1.0.90 1.0.229cargo update 2019-04-032026-07-18 3mo ago1
serde_json direct1.0.39 1.0.154cargo update 2019-02-282026-10-11 14d ago9
tempfile direct3.0.7 3.27.0cargo update 2019-02-172026-03-11 8mo ago4
termcolor direct1.0.4 1.4.1cargo update 2018-09-142024-01-10 2.8y ago0
utf8-ranges direct1.0.2 1.0.5cargo update 2018-10-292022-04-04 4.6y ago0
walkdir direct2.2.7 2.5.0cargo update 2018-11-112024-03-01 2.7y ago0
winapi-util direct0.1.2 0.1.11cargo update 2019-01-272025-09-07 14mo ago0
autocfg0.1.2 1.5.1major behind 2019-01-172026-05-22 5mo ago1
bitflags1.0.4 2.13.2major behind 2018-08-212026-09-10 45d ago7
byteorder1.3.1 1.5.0cargo update 2019-01-222023-10-06 3.1y ago0
cc1.0.35 1.10.0cargo update 2019-04-082026-10-23 2d ago40
cfg-if0.1.7 1.0.5major behind 2019-03-042026-09-16 39d ago1
cloudabi0.0.3 0.1.0major behind 2018-01-102019-12-22 6.8y ago0
fuchsia-cprng0.1.1 0.1.1up to date 2019-02-052019-02-05 7.7y ago0
itoa0.4.3 1.0.18major behind 2018-09-082026-03-20 7mo ago3
libc0.2.51 0.2.191cargo update 2019-03-292026-10-16 9d ago18
packed_simd0.3.3 0.3.9cargo update 2019-02-052023-07-30 3.2y ago0
pcre2-sys0.2.0 0.2.10cargo update 2019-04-142025-09-21 13mo ago0
pkg-config0.3.14 0.3.34cargo update 2018-08-282026-08-14 2mo ago2
proc-macro20.4.27 1.0.107major behind 2019-01-312026-07-19 3mo ago4
quote0.6.12 1.0.47major behind 2019-04-092026-07-19 3mo ago6
rand0.6.5 0.10.3major behind 2019-01-282026-09-20 35d ago16
rand_chacha0.1.1 0.10.0major behind 2019-01-042026-02-02 9mo ago3
rand_core0.3.1 0.10.1major behind 2019-01-252026-09-02 53d ago14
rand_hc0.1.0 0.5.1major behind 2018-10-302026-06-15 4mo ago3
rand_isaac0.1.1 0.5.1major behind 2018-11-262026-05-20 5mo ago3
rand_jitter0.1.3 0.6.1major behind 2019-02-062026-05-16 5mo ago3
rand_pcg0.1.2 0.10.2major behind 2019-02-232026-04-11 6mo ago7
rand_xorshift0.1.1 0.5.0major behind 2019-01-042026-02-02 9mo ago2
rdrand0.4.0 0.9.0major behind 2018-12-182026-05-15 5mo ago1
redox_syscall0.1.54 0.9.5major behind 2019-04-082026-10-17 8d ago15
redox_termios0.1.1 0.1.4cargo update 2017-08-012026-09-09 46d ago1
regex-automata0.1.6 0.4.18major behind 2019-02-252026-08-04 3mo ago5
ryu0.2.7 1.0.23major behind 2018-11-102026-02-08 9mo ago3
strsim0.8.0 0.11.1major behind 2018-08-192024-04-02 2.6y ago0
syn0.15.31 3.0.9major behind 2019-04-142026-10-12 13d ago21
termion1.5.1 4.0.6major behind 2017-08-032025-11-21 11mo ago1
textwrap0.11.0 0.16.4major behind 2018-12-092026-09-13 42d ago2
ucd-util0.1.3 0.2.2major behind 2018-11-162024-09-29 2.1y ago0
unicode-width0.1.5 0.2.2major behind 2018-05-192025-10-06 13mo ago0
unicode-xid0.1.0 0.2.6major behind 2017-05-082024-09-19 2.1y ago0
winapi0.3.7 0.3.9cargo update 2019-04-032020-06-26 6.3y ago0
winapi-i686-pc-windows-gnu0.4.0 0.4.0up to date 2018-01-182018-01-18 8.8y ago0
winapi-x86_64-pc-windows-gnu0.4.0 0.4.0up to date 2018-01-182018-01-18 8.8y ago0
wincolor1.0.1 1.0.3cargo update 2018-08-252020-01-11 6.8y ago0

Method and sources

TENSORUSTKeep the receipts.Tensorust · Matthew Busel · 404 Read Ave, Tuckahoe, NY 10707 · (914) 312-5691 · support@tensorust.comAboutResearch teamMethodsCorrectionsEmbedsOpen sourceAPI + MCP for agentsFAQRefundsTermsPrivacyReview us on TrustpilotAccountmatt@tensorust.comLinkedInGitHubGitLabX @TensorustAIX @MattBuselSponsor© 2026 Tensorust · ads by Google may use cookies (privacy)