Run cargo update crate_name --precise 1.2.3 to move one dependency in Cargo.lock to a specific patched version. With a name given, Cargo performs a conservative update: only that crate changes, and its own dependencies change only if they must. Preview with the dry run option first.
When you need this
An advisory says versions below 1.2.3 are affected. Your lockfile has 1.2.1. You want the fix without a surprise update of forty other crates in the same pull request, because a big lockfile diff is hard to review and hard to roll back.
Steps
- Find the patched version in the advisory. Confirm it is not yanked.
- Check that your version requirement allows it. A requirement of
1.2accepts 1.2.3, but a pinned=1.2.1does not, and you would need to editCargo.toml. - Preview the change:
cargo update crate_name --dry-run
- Apply the precise update:
cargo update crate_name --precise 1.2.3
- Rebuild and run tests, then re-run your advisory check.
- Commit the lockfile change alone, with the advisory ID in the message.
What the options do
| Option | Effect |
|---|---|
| a crate name | Conservative update of that crate only |
precise | Sets the exact version, and for git dependencies can be a revision |
recursive | Also forces its dependencies to update (cannot be combined with precise) |
dry-run | Shows changes without writing the lockfile |
locked | Fails if the lockfile would change, which suits CI |
The documentation says you can select a yanked version with precise, but advises against it.
When it will not work
If a parent crate pins the vulnerable crate to an older range, Cargo cannot move it without breaking that requirement. Then you have three options: update the parent, use a patch section to point at a fixed copy, or accept the risk with a written reason and an expiry. To find the parent, use the inverted tree view for that crate.
Why this is a good habit
Small, single purpose lockfile changes are easy to review, easy to revert and easy to connect to an advisory in your audit trail. They also keep fix pull requests from becoming a mixed bundle that nobody wants to approve.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a known fix version is turned into a small change.
Quick check
Does precise change Cargo.toml?
No. It edits the lockfile only, within the range your manifest already allows.
Can I use precise and recursive together?
No. The documentation says they cannot be combined.
Safeguard autonomous remediation can open fix pull requests with evidence. It is off by default and every category starts on Manual, so changes need your approval. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
