A git dependency is as safe as the commit you lock and review. Cargo records the commit in Cargo.lock when you add it and moves it only on cargo update. Use an explicit rev for clarity, restrict allowed git URLs, and treat each update as a code review.
The three selectors
| Key | Meaning | Moves when |
|---|---|---|
branch | Follow a named branch | You run an update and the branch has new commits |
tag | Use a named tag | An update runs and the tag has been moved by the owner |
rev | A commit hash or other reference | Only when you edit it |
With no selector, Cargo assumes the latest commit on the default branch. The reference says anything that is not a branch or a tag falls under rev, whether a commit hash or a reference such as a pull request ref.
What the lockfile does and does not protect
The Cargo reference states that git dependency commits are locked in Cargo.lock at the time of addition and checked for updates only when you run cargo update. That is good: a branch does not silently change under a locked build.
Two gaps remain. First, anyone running a full update will pull new commits from the branch without a version number to read. Second, tags can be moved by a repository owner, so a tag is a label, not proof of content. A full commit hash is the strongest identifier because it names the content.
A safer pattern
[dependencies]
example = { git = "https://example.com/org/example.git", rev = "0123456789abcdef0123456789abcdef01234567" }
The URL and hash above are placeholders. Use the real full hash of a commit you have read.
Steps for adopting a git dependency
- Ask why a released version will not do. If the fix is upstream but unreleased, plan to switch back when it ships.
- Review the commit you will pin, not just the repository homepage.
- Pin with
rev, and add the exact URL to your allowed git list in your policy tool. - Add a comment with the reason and a date to revisit.
- On each update, review the diff between the old and new commit.
Things that do not work
The reference notes that putting a commit after a hash sign in the URL is ignored with a warning, and combining a git key with a path key is invalid. A version key next to a git dependency does not choose the commit. Cargo fetches what the selector points to and then checks the version matches.
Registry crates versus git
A registry release is immutable once published, according to the Cargo publishing documentation. A git branch is not. That is the core reason to treat git dependencies as a higher risk source.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each component shows its source and version.
Quick check
Is pinning a tag as good as pinning a rev?
No. A tag can be moved by the repository owner. A full commit hash names the content.
Will a branch dependency change my locked build?
Not on its own. The lockfile holds the commit until someone runs an update.
Safeguard SBOM and dependency scanning lists where each dependency came from, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
