Rust DoctorCargo health · Security
Lockfile crate with a RustSec vulnerability advisory
rust_doctor::cargo::vulnerable_dependency
Update the crate to a patched version with cargo update -p <crate>, or replace it when no patched release exists; the finding is read from the local RustSec database cargo audit or cargo deny keeps, never fetched.
- Category
- Security
- Default level
- warn
- Tier
- P1
- Producer
- Cargo health
- Diff scope
- line
Not a defect when
The advisory's affected function or feature is unreachable from this workspace, such as an API the code never calls or a disabled feature, and no patched release is available yet.
What it reads
Cargo.toml, Cargo.lock and .cargo/config.toml.
Tier
Serious: worth interrupting other work for.
The tier bounds how severe a rule may be; its category bounds the tier.Diff scope
The changed line itself.
What--scope contextual looks at to decide whether a change caused the finding.Change it
Turn it off, or make it blocking, without touching the code it flags:
rust-doctor --rule rust_doctor::cargo::vulnerable_dependency=off .
rust-doctor --rule rust_doctor::cargo::vulnerable_dependency=error .