Cargo Dependencies, Features, Versions and Build Configuration: Complete Guide

Rust Learning Path — Chapter 17. Cargo is more than a command that runs rustc. It is Rust's package manager, dependency resolver, build orchestrator, test runner and release tool. Understanding Cargo.toml, Cargo.lock, features and profiles is essential once you build real applications.

1. Cargo.toml is the package manifest#

The manifest describes your package and tells Cargo which dependencies and build settings it needs.

2. Add dependencies#

Cargo writes the corresponding dependency entries into the manifest.

3. Version requirements#

A requirement such as serde = "1.0" normally allows compatible releases in the same major version. For application teams, commit Cargo.lock so everyone and CI use the same resolved versions.

4. Cargo.lock#

Cargo.toml expresses allowed dependency ranges. Cargo.lock records the exact versions Cargo selected. Applications should normally commit it.

cargo tree is extremely useful when investigating duplicate versions or unexpected transitive dependencies.

5. Optional dependencies and feature flags#

Compile with selected features:

Features should represent additive capabilities. Avoid using mutually exclusive feature combinations when a normal configuration value would be clearer.

6. Feature-gated code#

This code is compiled only when the feature is enabled.

7. Default features#

Disable defaults when needed:

8. Development dependencies#

Dependencies used only by tests and benchmarks belong under [dev-dependencies]:

9. Build dependencies#

Build scripts use [build-dependencies]. Keep build scripts small because they execute during compilation.

10. Git and path dependencies#

Path dependencies are common in workspaces. Prefer released crates for reusable public libraries and pin external Git dependencies carefully.

11. Build profiles#

Cargo provides dev and release profiles by default:

Do not blindly enable every optimization. Measure build time, binary size and runtime performance first.

12. Workspace dependencies#

Members can inherit the dependency:

13. Useful Cargo commands#

14. Security and dependency hygiene#

• Prefer well-maintained crates with clear ownership.
• Review transitive dependencies with cargo tree .
• Keep lockfiles in application repositories.
• Update intentionally and run tests after dependency changes.
• Use minimal feature sets to reduce unnecessary code and attack surface.

15. Mini lab#

Create a CLI with an optional json feature. Build once with defaults, then with --no-default-features, and observe which code is compiled.

Key takeaways#

Cargo's manifest defines what your package needs; the lockfile records the exact resolved graph; features make capabilities optional; profiles control build characteristics. Treat dependency configuration as production engineering, not boilerplate.