How do you preview what cargo update will change?

Run cargo update with its dry run option. The Cargo documentation says it displays what would be updated without writing the lockfile. Review that list, pick the crates you want, then update them one at a time or in a small group, and commit the Cargo.lock change in a reviewed pull request.

The commands

cargo update --dry-run
cargo update --dry-run --workspace
cargo update serde --dry-run

The first shows every change a full update would make. The --workspace option attempts to update only packages defined in the workspace, which the manual describes as useful after you have changed version numbers in Cargo.toml. Naming a package limits the preview to it.

Why preview first

A full cargo update can move dozens of transitive crates at once. If your tests then fail, you do not know which move caused it. If an advisory later names one of those crates, you do not know whether the move was deliberate.

A preview turns an unknown batch into a list you can read. Look for three things:

• New major or minor versions of crates you know are sensitive, such as parsers and TLS libraries.
• Crates that were added or removed from the graph.
• Anything unexpected, such as a crate you have never heard of appearing.

A safer update routine

1. Start from a clean tree with passing tests.
2. Run the dry run and save the output in the pull request description.
3. Update in small steps. For one crate, use the precise form from cargo update precise: fix one vulnerable crate.
4. Run build, tests and your advisory check after each step.
5. Commit only Cargo.lock, unless a requirement had to change. See what a plain version means in Cargo.toml.
6. Merge through the same review gate as code.

What a dry run does not tell you

It lists version moves. It does not tell you whether the new versions are safe, whether a maintainer changed hands, or whether a new release adds a build script. Read the release notes for any crate in a sensitive role, and check what build.rs can run when a new native dependency appears.

Automating the habit

If a bot opens update pull requests for you, the same questions apply to each one. A scheduled job can run the dry run weekly and post the list to a channel, so updates are a routine rather than an emergency after an advisory.

Safeguard's dependency scanning checks the lockfile in each pull request, and its fix pull requests are off by default with every category on Manual until you change that. A free scan is at gold.safeguard.sh/scan.

Try it yourself

Click through it at your own pace, or open it full screen.

Open a finding with a fix and look at what version move the fix needs, the same question a dry run answers.

Quick check

Sources

• cargo update documentation

Last reviewed: 19 October 2026.