HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
rust-lang
cargo
Rust2014–2026
rust-lang / cargo

cargo

The Rust package manager

Developer Tools
Explore on GitHubRead Hacker News discussions
100Distinct people
151Mentions
1Explicit recommenders
15.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

The Rust package manager

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

I love Rust, but it's particularly frustrating to me how it (nearly) forces you to use a single centralized package repository. Shameless plug for an issue:…

gspr used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 3:30:57 AM UTC.

Rust 1.100 direct repository linkDebated

The discussion highlights significant new features in Rust 1.100, such as the stabilized never type and unused dependency warnings, while sparking a substantive debate over whether the language's lack of a stable ABI is a necessary trade-off for its generic system or an impediment to library distribution. Participants clash between those viewing the current source-only model as sufficient and those arguing that a native stable ABI is essential for practical binary interoperability.

66 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4

Mentions over time

HN mentions by year151 dated mentions

Observed mentions: 2014-03-19 04:01:54 UTC to 2026-10-01 11:59:02 UTC.

051015202014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 12 mentions; 0 submissions, 12 comments20142015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 8 mentions; 1 submissions, 7 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 12 mentions; 0 submissions, 12 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 10 mentions; 1 submissions, 9 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 13 mentions; 0 submissions, 13 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 11 mentions; 0 submissions, 11 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 7 mentions; 0 submissions, 7 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 14 mentions; 0 submissions, 14 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 11 mentions; 0 submissions, 11 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 19 mentions; 1 submissions, 18 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 12 mentions; 2 submissions, 10 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 12 mentions; 0 submissions, 12 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 10 mentions; 1 submissions, 9 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC12012
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC817
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC12012
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC1019
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC13013
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC11011
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC707
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC14014
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC11011
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC19118
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC12210
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC12012
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC1019

What Hacker News says

19 sources
shepherdjerred·Dec 28, 2023
The author provides very surface-level criticism of two Rust tools , but they don't look into why those choices were made. I'm ignoring the Python complaint since it's discussed in other comments. With about five minutes of my time, I found out: wrap_comments was introduced in 2019 [0]. There are bugs in the implementation (it breaks Markdown tables), so the option hasn't been marked as stable. Progress on the issue has been spotty. --no-merge-sources is not trivial to re-implement [1]. The author has already explained why the flag no longer works -- Cargo integrated the command, but not all of the flags. This commit [2] explains why this functionality was removed in the first place. Rust is open source, so the author of this blog post could improve the state of the software they care about by championing these issues. The --no-merge-sour
Read the rest
ces error message even encourages you to open an issue, presumably so that the authors of Cargo can gauge the importance of certain flags/features. You could even do something much simpler, like adding a comment to the related issues mentioning that you ran into these rough edges and that it made your life a little worse, or with a workaround that you found. Alternatively, you can continue to write about how much free software sucks. [0]: https://github.com/rust-lang/rustfmt/issues/3347 [1]: https://github.com/rust-lang/cargo/pull/10344 [2]: https://github.com/rust-lang/cargo/commit/3842d8e6f20067f716...
In You can't do that because I hate you
Arnavion·Dec 28, 2023
"Beg", and "passive aggressive" from TFA, is an unnecessarily emotional interpretation of that sentence. It's perfectly neutral. When they imported `cargo-vendor` into cargo they removed a feature that was not trivial to reimplement, so they asked for an issue to be opened so that they can see if people want it and so that someone can decide to implement it. That message *could* be updated to point to https://github.com/rust-lang/cargo/issues/10310 instead of asking for new issues to be created or suggesting the old `cargo-vendor`. (The author of TFA already knows about that issue, since they commented on it before they published their article.) (You might say it would've been better to let cargo-vendor remain separate instead of merging it into cargo, but the reason that was done was to ensure it would continue to work with changes to ca
Read the rest
rgo. Indeed that is why the original cargo-vendor does *not* work properly any more.)
In You can't do that because I hate you
cmrdporcupine·Nov 22, 2023
What kind of strawman game are you trying to play? Those are not my words. Cargo is... ok. It has rough edges, but mostly works. Various things frustrate me, though there's usually work arounds. Workspace support is still a bit half-assed -- I mean, take a look at this terminally open but rather critical issue: https://github.com/rust-lang/cargo/issues/3946 ; our $work source tree is littered with brittle hardcoded relative paths because of this basic missing feature. Crates.io is ... not ok. It's a wild west full of hobby and abandoned projects with undisciplined massive dependency trees, has people camping out on names, and lacks even the most basic checks and balances (properly moderated submission process, expiry) and features (org namespaces) that Maven had back in like 2007. Because of this, incredible discipline is required on larg
Read the rest
e projects with large sets of third party deps or you will end up with multiple versions of things linked into your binary, or with abandoned projects in your dep tree, or just dep bloat generally. And this ties back to cargo, too. It was only with last week's 1.74.0 release that we finally got the ability to do authenticated repositories? Again, something that Maven supported from day 1. It's a bad culture that was, I think, imported from the node/npm world. If I were starting a serious corporate project from scratch in 2023, I'd seriously consider a model with checked-in, vendored, moderated dependencies that doesn't use crates.io (or a mirror) at all.
In I think C++ is still a desirable coding platform compared to Rust
saurik·Aug 26, 2023
> ...but at the end of the day Cargo is the reason that Rust is popular. FWIW, maybe that's true for you, but there are numerous other advantages to the language for which many people choose to use Rust--some even "despite" Cargo: you see Google having had to put in way way WAY too much work to get Bazel working for Rust :/--that it honestly feels a bit like belittling an extremely important language to make this claim so flippantly. In my case, I often feel bad that I'm not using Rust more often, as I'm one of those developer churning out tons of C/C++ code. I do my best, but... I'm a security engineer! I know what I'm doing is stupid! But like, I'm having a hard enough time just dealing with the Rust library dependencies I've accumulated, so I'm not going to start developing even more Rust :(. > You can set a default build target for a
Read the rest
Cargo project with two lines of configuration, no nightly features necessary... This doesn't work as, as soon as you start setting target-specific options, it infects the host's options, as they incorrectly modelled the problem as some kind of map from targets to flags. If you don't believe me, on your Linux computer, try cross-compile something complicated that will runs on a "least common denominator" Linux distribution, such as CentOS 7. > Can you clarify what this is referring to? Sure. I've Googled rust cargo target host bugs for you (which, FWIW, finds a number of bugs I've filed or have talked about, but it isn't as if I have a list anywhere). Note that one of these bugs is "closed", but I still provide them for context as a patch might have been merged but (as you'll find out if you read through all of these) it isn't stable. https://github.com/rust-lang/cargo/issues/8147 https://github.com/rust-lang/cargo/issues/3349 https://github.com/rust-lang/cargo/pull/9322 https://github.com/rust-lang/cargo/issues/9453 https://github.com/rust-lang/cargo/pull/9753 The result of this work being left incomplete is that increasingly large numbers of "serious" projects--things I'd expect people in packaging land to have heard of, such as BuildRoot--are being forced to set the ridiculous environment variable __CARGO_TEST_CHANNEL_OVERRIDE_DO_NOT_USE_THIS="nightly" in order to get access to a flag that makes Cargo sort of work. I remember a bunch of other ones but I think they are linked from these bugs (I didn't want to dig too long on this); you can also find--either linked from these bugs (as people will tag the bug in their patch) or by searching for that variable (as no one else would use that in a sane project) the projects that are slowly being forced into this crazy workaround. (What is sad is I often see people surprised at how long it is taking for various of the more important clients to fully get into using Rust, as the safety issues are so severe from continuing to use C/C++; as you made the contention that you believe the reason why people use Rust is Cargo, I will say the opposite: the reason why we don't see more Rust is also Cargo.)
In Leaving Haskell behind
jeroenhd·Jun 28, 2023
You're probably running into this: https://github.com/rust-lang/cargo/issues/7058 `cargo vendor` will download dependencies and dev dependencies for all platforms, which leads to a lot of unused code being pulled in. In this case, the Windows API and Microsoft compiler wrappers. In this instance, during the build process "tempfile" is used as a dev-dependency, which has a runtime dependency on windows-sys when compiling Windows binaries. I'm not entirely sure why (commenting it out in Cargo.toml doesn't seem to break the build). After commenting it out and manually removing the spurious Windows API files as well as the unrelated packages (`cd vendor; rm -rf ctor diff output_vt100 pretty_assertions proc-macro2 quote syn unicode-ident yansi win*`), I get the following results: 0.0358 secs ┌─────────────────────────────────────
Read the rest
──────────────────────────────────────────────────┐ | Language files size blank comment code | ├───────────────────────────────────────────────────────────────────────────────────────┤ | Bash 3 939.00 B 7 2 30 | | C 1 1.31 KB 5 6 44 | | C Header 1 226.00 B 0 0 7 | | D 15 31.75 KB 32 0 143 | | JSON 22 39.69 KB 0 0 22 | | Markdown 16 53.46 KB 425 0 1054 | | Rust 396 4.98 MB 13852 9502 131650 | | Shell 5 2.24 KB 11 18 50 | | Toml 14 9.60 KB 54 61 319 | | Yaml 2 10.14 KB 70 0 341 | ├───────────────────────────────────────────────────────────────────────────────────────┤ | Sum 475 5.13 MB 14456 9589 133660 | └───────────────────────────────────────────────────────────────────────────────────────┘ As a comparison, this is the output for https://github.com/sudo-project/sudo: 0.0439 secs ┌───────────────────────────────────────────────────────────────────────────────────────┐ | Language files size blank comment code | ├───────────────────────────────────────────────────────────────────────────────────────┤ | Autoconf 124 1.90 MB 2618 4317 59031 | | C 365 4.20 MB 15977 22626 111340 | | C Header 90 1.14 MB 1816 4911 18803 | | JSON 7 9.22 KB 0 0 236 | | Markdown 10 133.62 KB 676 0 2498 | | Pascal 3 33.63 KB 79 0 925 | | Perl 2 12.81 KB 54 83 306 | | Plain Text 1 15.00 B 0 0 1 | | Protocol Buffer 2 5.54 KB 22 0 185 | | Python 10 26.41 KB 152 259 295 | | Shell 77 358.96 KB 1589 2534 8961 | | Yaml 4 7.98 KB 16 38 205 | ├───────────────────────────────────────────────────────────────────────────────────────┤ | Sum 695 7.81 MB 22999 34768 202786 | └───────────────────────────────────────────────────────────────────────────────────────┘ It should be noted that the sudo project's dependencies and autogenerated code aren't included in this overview
In Testing the memory safe Rust implementation of Sudo/Su
epage·Jun 8, 2023
There are some efforts for lowering the overhead and would be interesting to explore how we could further do it. First, we allow sharing `Cargo.toml` fields across the workspace since 1.64.0 [0]. In the upcoming 1.71.0, we extend this so that `cargo new` will automatically inherit fields when creating new `Cargo.toml` files [1]. From a different angle, we are also adding support for single-file packages though this is more meant for binaries [2] [0] https://doc.rust-lang.org/cargo/reference/workspaces.html#th... [1] https://github.com/rust-lang/cargo/pull/12069 [2] https://github.com/rust-lang/rfcs/pull/3424
In Rust module system encourages bad practices

Showing the 15 most recent of 19 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.