Post by @Ferk@lemmy.ml

2026-10-26 17:43 UTC

Ok, so that’s vendoring. So for example, Rust regex crate also tries to prevent duplicating efforts so it also its own dependencies (regex-syntax, regex-automata, memchr, some library for fast dictionary matching, etc)… Rust packages are very modular with the goal of keeping very simply reusable pieces, and this is what makes something like cargo necessary. If you want to vendor regex by including it into your code, you also need to include those tiny modules. You are right having big dependency trees has risks, but I think avoiding a dedicated package manager actually makes that nightmare much worse. Because Cargo is deeply integrated into Rust, it generates a Cargo.lock file that guarantees 100% reproducible builds across every machine. It also allows developers to run cargo audit, which instantly scans the dependencies against a live database of vulnerabilities. You don’t get any of that when you vendor, and you’ll have to manually actively monitor your dependencies for vulnerabilities anyway.

Replies (2)

@thingsiplay@lemmy.ml 2026-10-26 17:49

That’s true if you try to replicate the same program without Cargo. But that’s not what I am suggesting. If you don’t need regex and all the dependencies, then you don’t need Cargo. And this could encourage to write programs without all these dependencies. Also Cargo is deeply integrated into Rust, but Rust is not deeply integrated (speak no dependency) to Cargo. I know of all the features and why Cargo is fantastic, I love it myself. But one has nothing to do with the other. My suggestion is for tools and code that doesn’t need these dependencies. I am not suggesting to replicate the same work or features as when doing huge applications with Cargo and dependencies. We can write programs with stdlib only, hell even without stdlib (technically, I’m not suggesting this as the new normal).

Open ##5258511
@ISO@lemmy.zip 2026-10-26 19:11

You don’t get any of that when you vendor, and you’ll have to manually actively monitor your dependencies for vulnerabilities anyway. Incorrect. Vendoring done right (via replace-with, as done by cargo vendor) is not mutually exclusive with the rest of the tooling. You can have both.

Open ##5259504