Freedom251 › Software Composition Analysis Software
cargo-deny
What cargo-deny is
cargo-deny is a free, open-source Cargo plugin for Rust projects that checks dependency graphs against configured rules. Its advisories check uses an advisory database to identify known vulnerabilities, unmaintained crates, and crates removed from their source registry. The licenses check compares declared crate requirements with licenses a project accepts. A bans check can allow or reject named crates and flag multiple versions of one crate. A sources check limits dependencies to trusted registries, Git repositories, or local paths. Checks are configurable, while `cargo deny check` runs all supported checks with defaults when no configuration is supplied. The project supports Linux, macOS, Windows, and API use. Installation options include precompiled binaries, Cargo, source builds, and pacman for Arch Linux. A standalone build can run without Cargo, including in Docker images. GitHub Actions and pre-commit hooks are documented. Licensing is available under Apache 2.0 or MIT.
Who it suits
It is intended for Rust projects whose dependencies are managed with Cargo, including teams that want dependency checks in CI or pre-commit workflows.
What it does well
- Checks vulnerabilities and unmaintained crates
- Compares declared license requirements
- Controls crates and duplicate versions
- Restricts dependency sources
- GitHub Action and pre-commit integrations
What to know first
- License checks rely on crate declarations
- Does not search all source code for licenses
- Provides no legal advice
- Binary availability is best effort
Verdict
cargo-deny gives Cargo projects configurable checks for advisories, licenses, dependency bans, and trusted sources. It fits teams that want these checks locally, in hooks, or in continuous integration.
Facts from cargo-deny's own pages
- Advisories
- Its advisories check uses an advisory database to find known vulnerabilities, unmaintained crates, and crates yanked from their source registry. · embarkstudios.github.io, 4 Oct 2026
- Audience
- The project is intended for Rust projects whose dependencies are managed with Cargo. · embarkstudios.github.io, 11 Oct 2026
- CI integration
- The maker documents a GitHub Action for running cargo-deny in continuous integration. · embarkstudios.github.io, 4 Oct 2026
- Configuration
- The tool supports configurable checks, and `cargo deny check` runs all supported checks by default, using each check's default configuration when none is specified. · embarkstudios.github.io, 4 Oct 2026
- Dependency bans
- Its bans check can allow or deny specific crates and detect multiple versions of the same crate. · embarkstudios.github.io, 4 Oct 2026
- Dependency rules
- The bans check can allow or deny specific crates and detect multiple versions of a crate. · embarkstudios.github.io, 11 Oct 2026
- Disclaimer
- The repository says the makers take no responsibility for whether the tool functions correctly or meets a user's needs, and that it does not provide legal advice. · github.com, 4 Oct 2026
- Installation
- The repository documents installation with Cargo and, for Arch Linux users, with pacman. · github.com, 4 Oct 2026
- Install options
- The documentation describes installing from precompiled binaries, from crates.io, or from source; it says binaries are provided for major platforms on a best-effort basis. · embarkstudios.github.io, 11 Oct 2026
- Integrations
- The project documents a GitHub Action for running cargo-deny in continuous integration and a pre-commit hook. · github.com, 11 Oct 2026
- Legal limitation
- The project says cargo-deny does not constitute legal advice and its maintainers do not take responsibility for users’ use of the tool. · github.com, 11 Oct 2026
- Library API
- Although primarily intended as a Cargo plugin, most of cargo-deny’s functionality is in a library. · embarkstudios.github.io, 11 Oct 2026
- License
- The repository says cargo-deny is available under either the Apache License 2.0 or MIT license, at the user's option. · github.com, 4 Oct 2026
- License check limit
- The tool does not exhaustively search all crate source code for every license that could apply, and it assumes crates correctly define their license requirements. · embarkstudios.github.io, 4 Oct 2026
- License checks
- Its licenses check evaluates crate license requirements against configuration using SPDX license expressions. · embarkstudios.github.io, 11 Oct 2026
- License limitation
- The tool says it does not exhaustively search every crate’s source code for all licenses that could apply. · embarkstudios.github.io, 11 Oct 2026
- Linux example
- The CI usage page includes an x86_64 Linux musl binary download example. · embarkstudios.github.io, 11 Oct 2026
- Pre-commit integration
- The maker's repository documents using cargo-deny with pre-commit hooks. · github.com, 4 Oct 2026
- Purpose
- cargo-deny is a Cargo plugin for linting a project’s dependency graph against configured expectations and requirements. · embarkstudios.github.io, 11 Oct 2026
- Security advisories
- Its advisories check looks up crates in an advisory database to detect known vulnerabilities and unmaintained crates. · embarkstudios.github.io, 11 Oct 2026
- Standalone use
- The repository says cargo-deny can be built with its `standalone` feature for use without Cargo installed, such as in Docker images. · github.com, 4 Oct 2026
- Trusted sources
- The sources check can restrict crates to trusted sources, including registry, Git, or local file sources. · embarkstudios.github.io, 11 Oct 2026