Docs

Cargo

Description

The cargo crawler looks recursively for all cargo crates from a specific root directory. Then for each of them, it tries to update dependencies specified in Cargo.toml.

Dependencies are read from:

  • [dependencies]

  • [dev-dependencies]

  • [build-dependencies]

  • the [workspace.dependencies] equivalents

This crawler can be enabled either automatically with default behavior by running updatecli diff from a directory containing the files to update. Or by providing a manifest. The automatic discovery behavior can be tuned by providing a YAML manifest with a cargo crawler in top-level directive autodiscovery as explained in the "Autodiscovery" page.

Requirements

Updates are applied by running cargo, so the toolchain has to be reachable from the environment running Updatecli.

Important
If a Cargo.lock sits next to Cargo.toml and neither the cargo command nor cargo upgrade can be found, the whole crate is skipped with a warning. Updatecli will not bump a dependency it cannot re-lock.

cargo upgrade comes from cargo-edit. When it is available, both Cargo.toml and Cargo.lock are updated. When only plain cargo is available, a reduced command is generated that refreshes the lock file alone.

Generated manifests

Each dependency produces:

  • a cargopackage source resolving the latest crate version,

  • a shell condition that stops the pipeline when the discovered version already matches what is declared,

  • a shell target invoking cargo upgrade and cargo update, guarded by a file/checksum over Cargo.toml and Cargo.lock.

The generated command honours Updatecli’s dry-run mode by passing --dry-run to cargo when $DRY_RUN is set, so updatecli diff does not modify the crate.

Private registries

Use registries to describe a non-default crate registry, so generated sources resolve versions against it rather than crates.io.

Manifests

Parameters

The crawler cargo supports the following parameters:

NameTypeDescriptionRequired
ignorearrayIgnore specifies rule to ignore Cargo.toml update.
    cratesobjectCrates specifies the list of Cargo crates to check
    pathstringPath specifies a Cargo crate path pattern, the pattern requires to match all of name, not just a subpart of the path.
    registriesarrayRegistries specifies the list of Cargo registries to check
onlyarrayOnly specify required rule to restrict Cargo.toml update.
    cratesobjectCrates specifies the list of Cargo crates to check
    pathstringPath specifies a Cargo crate path pattern, the pattern requires to match all of name, not just a subpart of the path.
    registriesarrayRegistries specifies the list of Cargo registries to check
registriesobjectAuths provides a map of registry credentials where the key is the registry URL without scheme
    authobject[A][S][C] Auth specifies the cargo registry auth to use for authentication.
        headerformatstring[A][S][C] HeaderFormat specifies the cargo registry header format to use for authentication (defaults to Bearer).
        tokenstring[A][S][C] Token specifies the cargo registry token to use for authentication.
    rootdirstring[A][S][C] RootDir specifies the cargo registry root directory to use as FS index.
    scmidstring[A] SCMID specifies the cargo registry scmId to use as FS index.
    urlstring[A][S][C] URL specifies the cargo registry URL to use for authentication.
rootdirstringRootDir defines the root directory used to recursively search for Cargo.toml
versionfilterobject

versionfilter provides parameters to specify the version pattern used when generating manifest.

kind - semver versionfilter of kind semver uses semantic versioning as version filtering pattern accepts one of: prerelease - Updatecli tries to identify the latest prerelease whatever it means patch - Updatecli only handles patch version update minor - Updatecli handles patch AND minor version update minoronly - Updatecli handles minor version only major - Updatecli handles patch, minor, AND major version update majoronly - Updatecli only handles major version update a version constraint such as >= 1.0.0

kind - regex versionfilter of kind regex uses regular expression as version filtering pattern accepts a valid regular expression

example:

  versionfilter:
    kind: semver
    pattern: minor

and its type like regex, semver, or just latest.

More examples can be found at https://www.updatecli.io/docs/core/versionfilter/

    kindstringspecifies the version kind such as semver, regex, or latest
    patternstringspecifies the version pattern according the version kind for semver, it is a semver constraint for regex, it is a regex pattern for time, it is a date format
    regexstringspecifies the regex pattern, used for regex/semver and regex/time. Output of the first capture group will be used.
    replaceallobjectreplaceAll applies a regex replacement to version strings before filtering. This is useful for transforming versions (e.g., curl-8_15_0 to curl-8.15.0) before regex extraction.
        patternstringPattern specifies the regex pattern to match for replacement
        replacementstringReplacement specifies the replacement string (supports $1, $2, etc. for captured groups)
    strictbooleanstrict enforce strict versioning rule. Only used for semantic versioning at this time
⚠ This table is generated from the Updatecli codebase and may contain inaccurate data. Feel free to report them on github.com/updatecli/updatecli

Example

# updatecli.d/default.yaml
name: "Cargo compose autodiscovery using git scm"
scms:
  default:
    kind: git
    spec:
      url: https://github.com/updatecli-test/cargo-lab.git
      branch: "main"
  private-registry:
    kind: git
    spec:
      url: "https://github.com/updatecli-test/fake-cargo-registry.git"
      branch: "main"

autodiscovery:
  scmid: default
  crawlers:
    cargo:
      registries:
        fake-private-git:
          scmid: private-registry
        fake-private-http:
          url: "https://updatecli-test.github.io/fake-cargo-registry/api/v1/crates"
Last updated on July 30, 2026
Prev
Bazel
Next
Docker Compose