Post #3275282

@thomask@social.octet-stream.net seconded, I closely watch this rfc too. For now it's a huge pain to do this manually, like with dependabot+cooldown (which doesn't update transitive depends anyway), or cargo update in a branch then merge it in a week. Still this feels like a band aid, while a real solution would be something like a distributed code audit system. IIRC cargo-vet does something like that, but I haven't tried it yet.