cargo-deny
The facts below are what the maker publishes about cargo-deny, checked and dated. Our editors have not written about it yet.
The facts
Each one read from cargo-deny's own pages, with the date it was checked.
What it does
- Advisories
- Its advisories check uses an advisory database to find known vulnerabilities, unmaintained crates, and crates yanked from their source registry.checked 4 Oct 2026
- Audience
- The project is intended for Rust projects whose dependencies are managed with Cargo.checked 11 Oct 2026
- CI integration
- The maker documents a GitHub Action for running cargo-deny in continuous integration.checked 4 Oct 2026
- Configuration
- The tool supports configurable checks, and `cargo deny check` runs all supported checks by default, using each check's default configuration when none is specified.checked 4 Oct 2026
- Dependency bans
- Its bans check can allow or deny specific crates and detect multiple versions of the same crate.checked 4 Oct 2026
- Dependency rules
- The bans check can allow or deny specific crates and detect multiple versions of a crate.checked 11 Oct 2026
- Disclaimer
- The repository says the makers take no responsibility for whether the tool functions correctly or meets a user's needs, and that it does not provide legal advice.checked 4 Oct 2026
- Installation
- The repository documents installation with Cargo and, for Arch Linux users, with pacman.checked 4 Oct 2026
- Install options
- The documentation describes installing from precompiled binaries, from crates.io, or from source; it says binaries are provided for major platforms on a best-effort basis.checked 11 Oct 2026
- Integrations
- The project documents a GitHub Action for running cargo-deny in continuous integration and a pre-commit hook.checked 11 Oct 2026
- Legal limitation
- The project says cargo-deny does not constitute legal advice and its maintainers do not take responsibility for users’ use of the tool.checked 11 Oct 2026
- Library API
- Although primarily intended as a Cargo plugin, most of cargo-deny’s functionality is in a library.checked 11 Oct 2026
- License
- The repository says cargo-deny is available under either the Apache License 2.0 or MIT license, at the user's option.checked 4 Oct 2026
- License check limit
- The tool does not exhaustively search all crate source code for every license that could apply, and it assumes crates correctly define their license requirements.checked 4 Oct 2026
- License checks
- Its licenses check evaluates crate license requirements against configuration using SPDX license expressions.checked 11 Oct 2026
- License limitation
- The tool says it does not exhaustively search every crate’s source code for all licenses that could apply.checked 11 Oct 2026
- Pre-commit integration
- The maker's repository documents using cargo-deny with pre-commit hooks.checked 4 Oct 2026
- Purpose
- cargo-deny is a Cargo plugin for linting a project’s dependency graph against configured expectations and requirements.checked 11 Oct 2026
- Security advisories
- Its advisories check looks up crates in an advisory database to detect known vulnerabilities and unmaintained crates.checked 11 Oct 2026
- Standalone use
- The repository says cargo-deny can be built with its `standalone` feature for use without Cargo installed, such as in Docker images.checked 4 Oct 2026
- Trusted sources
- The sources check can restrict crates to trusted sources, including registry, Git, or local file sources.checked 11 Oct 2026
Where it runs
- Linux example
- The CI usage page includes an x86_64 Linux musl binary download example.checked 11 Oct 2026
Alternatives to cargo-deny
- 1
DeepFilterNet
Free planOpen sourceAPILinuxmacOSSelf-hosted7.6Free plan - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 4
Scantist
Free planWebAPISelf-hosted7.3$200 one-time - 5
Snyk Open Source
Free planWebAPILinuxmacOS7.3From $25 a month - 6
Socket
Free planWebAPIExtensionLinux7.2From $25 a month