To fix a vulnerable Rust crate, run cargo update with the crate name so Cargo moves only that crate and what it needs. If you need a specific fixed version, add the precise option. Cargo.toml requirements still limit the range, so a fix outside that range needs a manifest edit.
What cargo update changes
The Cargo documentation says the command updates dependencies in Cargo.lock to the latest version allowed. With no argument it updates everything. With a crate name it performs a conservative update: only that crate is updated, its own dependencies only if needed, and everything else stays at its recorded version.
Cargo.toml describes your dependencies in a broad sense. Cargo.lock holds the exact versions and is maintained by Cargo. The Cargo book advises checking Cargo.lock into version control when in doubt.
Steps
- Read the advisory for the fixed version.
- Preview the change:
cargo update vulnerable-crate --dry-run
- Apply it, either to the latest allowed version or to a chosen one:
cargo update vulnerable-crate
cargo update vulnerable-crate --precise 1.2.7
- Rebuild, run tests, and commit the Cargo.lock diff.
- Re-run your advisory scan.
The dry run option shows what would change without writing the lockfile.
When the precise option helps
Use it to land on the first fixed version rather than the newest one, which keeps the diff small. The documentation says it works on a named crate, can take a git revision for git sources, cannot be combined with the recursive option, and that yanked versions are allowed but not recommended.
When it does not work
| Symptom | Likely cause | What to do |
|---|---|---|
| Cargo will not move to the fixed version | Cargo.toml requirement excludes it | Edit the requirement in the crate that declares it |
| The crate is a dependency of a dependency | A parent pins an old range | Update the parent, or ask its maintainers |
| Fixed version is yanked | The author withdrew it | Choose another fixed release |
Cargo.toml requirements set the range of allowed versions, and the update picks versions inside that range.
Keep CI honest
Use the locked option in CI so a run fails if Cargo.lock would change. The update command documentation describes it as erroring if the lock file is missing or would change.
cargo build --locked
Quick check
Does cargo update edit Cargo.toml?
The Cargo docs describe it as rewriting Cargo.lock. Version requirements in Cargo.toml set the allowed range and are only changed by a separate, nightly-only breaking option.
Should a library commit Cargo.lock?
The Cargo book says to commit it when in doubt. Libraries are a special case, covered in our guide on committing Cargo.lock for a library.
Safeguard's dependency scanning reads your project files and flags known advisories, and its fix pull requests (off by default, all categories on Manual) keep a person in control. The free scan is a quick first look.
Sources
Last reviewed: 19 October 2026.
