Run cargo vendor in your project. It downloads every crates.io and git dependency into a local vendor directory and prints a config snippet. Save that snippet to .cargo/config.toml, and Cargo will build from the local copies without touching the network.
Steps
- Make sure
Cargo.lockis committed and current, so you vendor exactly what you build. - Run the vendor command, redirecting the printed config into place:
cargo vendor > .cargo/config.toml
- Check that the file contains a source replacement like this:
[source.crates-io]
replace-with = "vendored-sources"
[source.vendored-sources]
directory = "vendor"
- Build with the locked and offline flags to prove nothing reaches the network:
cargo build --locked --offline
- Commit
vendorand the config if your policy is to keep sources in the repository.
Flags worth knowing
| Flag | Effect |
|---|---|
versioned-dirs | Puts the version in every vendored directory name, which makes history easier to read |
locked | Fails if the lockfile is missing or would change |
no-delete | Keeps existing contents of the vendor directory |
sync | Vendors extra manifests into the same directory |
respect-source-config | Honors existing source settings when downloading |
By default Cargo ignores any existing source configuration while vendoring.
What vendoring gives you
You get a build that does not depend on the registry being reachable, and a place where every line of third party code is visible in a diff. When a dependency changes, the change shows up in a pull request that a human can read.
What it does not give you
Vendored code is still third party code. Vendoring does not scan it, does not tell you when an advisory is published, and does not stop a bad version from being copied in. You still need advisory checks against the lockfile, and review on vendor diffs. Cargo also treats vendored sources as read only. To change one, use a patch section or a path dependency rather than editing the directory.
Keeping it fresh
Treat updates as a routine job. Update the lock, re-run the vendor command, review the diff, run your checks, and merge. If nobody owns that routine, a vendored tree turns into a frozen snapshot of old, vulnerable code.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how new advisories are matched to components you already ship.
Quick check
Does cargo vendor include git dependencies?
Yes. It downloads all crates.io and git dependencies for the project.
Can I edit a vendored crate to patch a bug?
Not in place. Cargo treats vendored sources as read only. Use a patch section or a path dependency pointing at a local copy.
Safeguard continuous monitoring and SBOM and dependency scanning can watch the components you ship for new advisories, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
