cargo-deny

Spec sheet

Purpose

cargo-deny is a Cargo plugin for linting a project’s dependency graph against configured expectations and requirements.Read 11 Oct 2026 · embarkstudios.github.io

Audience

The project is intended for Rust projects whose dependencies are managed with Cargo.Read 11 Oct 2026 · embarkstudios.github.io

Integrations

The project documents a GitHub Action for running cargo-deny in continuous integration and a pre-commit hook.Read 11 Oct 2026 · github.com

License

The repository says cargo-deny is available under either the Apache License 2.0 or MIT license, at the user's option.Read 4 Oct 2026 · github.com

Advisories

Its advisories check uses an advisory database to find known vulnerabilities, unmaintained crates, and crates yanked from their source registry.Read 4 Oct 2026 · embarkstudios.github.io

CI integration

The maker documents a GitHub Action for running cargo-deny in continuous integration.Read 4 Oct 2026 · embarkstudios.github.io

Configuration

The tool supports configurable checks, and `cargo deny check` runs all supported checks by default, using each check's default configuration when none is specified.Read 4 Oct 2026 · embarkstudios.github.io

Dependency bans

Its bans check can allow or deny specific crates and detect multiple versions of the same crate.Read 4 Oct 2026 · embarkstudios.github.io

Dependency rules

The bans check can allow or deny specific crates and detect multiple versions of a crate.Read 11 Oct 2026 · embarkstudios.github.io

Disclaimer

The repository says the makers take no responsibility for whether the tool functions correctly or meets a user's needs, and that it does not provide legal advice.Read 4 Oct 2026 · github.com

Install options

The documentation describes installing from precompiled binaries, from crates.io, or from source; it says binaries are provided for major platforms on a best-effort basis.Read 11 Oct 2026 · embarkstudios.github.io

Installation

The repository documents installation with Cargo and, for Arch Linux users, with pacman.Read 4 Oct 2026 · github.com

Legal limitation

The project says cargo-deny does not constitute legal advice and its maintainers do not take responsibility for users’ use of the tool.Read 11 Oct 2026 · github.com

Library API

Although primarily intended as a Cargo plugin, most of cargo-deny’s functionality is in a library.Read 11 Oct 2026 · embarkstudios.github.io

License check limit

The tool does not exhaustively search all crate source code for every license that could apply, and it assumes crates correctly define their license requirements.Read 4 Oct 2026 · embarkstudios.github.io

License checks

Its licenses check evaluates crate license requirements against configuration using SPDX license expressions.Read 11 Oct 2026 · embarkstudios.github.io

License limitation

The tool says it does not exhaustively search every crate’s source code for all licenses that could apply.Read 11 Oct 2026 · embarkstudios.github.io

Linux example

The CI usage page includes an x86_64 Linux musl binary download example.Read 11 Oct 2026 · embarkstudios.github.io

Pre-commit integration

The maker's repository documents using cargo-deny with pre-commit hooks.Read 4 Oct 2026 · github.com

Security advisories

Its advisories check looks up crates in an advisory database to detect known vulnerabilities and unmaintained crates.Read 11 Oct 2026 · embarkstudios.github.io

Standalone use

The repository says cargo-deny can be built with its `standalone` feature for use without Cargo installed, such as in Docker images.Read 4 Oct 2026 · github.com

Trusted sources

The sources check can restrict crates to trusted sources, including registry, Git, or local file sources.Read 11 Oct 2026 · embarkstudios.github.io

Where Specifiction places it

• Software Composition Analysis Software#31 of 657.8