Rust Dependency Management and Governance

Authority: Cargo — Specifying Dependencies, Cargo — Dependency Resolution, Cargo — Source Replacement, Cargo — Credentials, cargo-deny, cargo-audit, RustSec.

This skill owns the governance of dependencies: how to declare them safely, what they pull in, who is allowed in, and what to do when one goes wrong. It does not own the Cargo.toml field reference (rust-cargo-build), semver (rust-semver), or workspace topology (rust-workspace).

Capability Boundaries

✅ Strengths

1. Choosing the right version requirement ("1" vs "1.2" vs "=1.2.3")
2. Evaluating dependency sources (crates.io / git / path / private registry)
3. Setting up source replacement for vendored or mirrored registries
4. Configuring cargo-deny (4 tables: advisories, licenses, bans, sources)
5. Running cargo-audit and responding to RustSec advisories
6. Diagnosing dependency cycles and duplicate-version problems via cargo tree
7. Setting MSRV-aware resolver behavior
8. Automating dependency updates with Renovate / Dependabot
9. Establishing supply-chain policy for an organization