Side by side
bundler-audit vs cargo-audit
Both stand on software composition analysis software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMac
bundler-audit focuses on lockfile checks for Ruby and Bundler projects, with offline use, advisory controls and Rake tasks. Users should check the listed runtime requirements and platform coverage before adopting it.
Visit bundler-audit
Free plan LinuxMac
cargo-audit focuses on Rust crate advisories and provides configurable exceptions plus an experimental dependency-fix command. Its binary scan is less complete without cargo-auditable data, and its trusted-project warning matters when a lockfile must be generated.
Visit cargo-auditThe facts
| bundler-audit | cargo-audit | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Mac | Linux, Mac |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | github.com | rustsec.org |
| On software composition analysis software | #9 of 60 | #13 of 60 |
bundler-audit: what it does well
- Checks Gemfile.lock for vulnerable gem versions.
- Flags http:// and git:// gem sources.
- Can run without a network connection.
- Supports JSON output and per-project ignored-advisory settings.
- Free software under GPL version 3 or later.
What to know first
- Requires Ruby 2.0.0 or newer and listed dependencies.
- Listed platforms are Linux and macOS.
- The project does not state a support service.
cargo-audit: what it does well
- Free and open source
- Checks Cargo.lock against RustSec advisories
- Advisory exceptions via `--ignore` or audit.toml
- Experimental fixes support a dry run
What to know first
- Requires Rust 1.74 or later
- Binary recovery misses embedded C and roughly half of Rust dependencies
- Run only on trusted projects
Alternatives to bundler-audit Alternatives to cargo-audit The whole list