Dependencies are a huge supply chain security risk; the more of them you have, and the more often you update, the bigger the attack surface.
    • MonkderVierte@lemmy.zip
      1·
      1 小时前

      Not cargo per se, but even the tutorial for a cli-tool is like “setup clap, which has 20 dependencies and a kitchen sink”. The whole (cargo-centric) ecosystem is much like Node, with the same problems.

      And also, cargo.toml has inconsistencies and double-standards.