Post by @thingsiplay@lemmy.ml

2026-10-26 17:26 UTC

“self-confined” I think my weak English showed up again. I mean projects that has all dependencies in the project itself. And don’t get me wrong, I’m not suggesting to write Regex Parser, GUI system and other huge tasks and put them in the project. If you need those, then its better to use the libraries that are available, with Cargo. Not every program needs all those dependencies and features. Also relying on those dependencies, that rely on other dependencies and so on can also be a security nightmare. My point is to have those projects that are much more simple, maybe even part of other projects like Python (just a random idea, don’t over analyze that).

Replies (1)

@Ferk@lemmy.ml 2026-10-26 17:43

Ok, so that’s vendoring. So for example, Rust regex crate also tries to prevent duplicating efforts so it also its own dependencies (regex-syntax, regex-automata, memchr, some library for fast dictionary matching, etc)… Rust packages are very modular with the goal of keeping very simply reusable pieces, and this is what makes something like cargo necessary. If you want to vendor regex by including it into your code, you also need to include those tiny modules. You are right having big dependency trees has risks, but I think avoiding a dedicated package manager actually makes that nightmare much worse. Because Cargo is deeply integrated into Rust, it generates a Cargo.lock file that guarantees 100% reproducible builds across every machine. It also allows developers to run cargo audit, which instantly scans the dependencies against a live database of vulnerabilities. You don’t get any of that when you vendor, and you’ll have to manually actively monitor your dependencies for vulnerabilities anyway.

Open ##5258288