Cargo.lock: keeping dependencies consistent

Originally published on php2rust.dev — part of the PHP to Rust course. View this lesson on the original site.

When Cargo installs dependencies, it writes a Cargo.lock file that records the exact versions used. This keeps builds consistent for everyone on the project and avoids surprises from dependency updates.

Cargo.lock is similar to package-lock.json (npm) or Pipfile.lock (Python), it stores the resolved versions of all dependencies and their sub-dependencies. Cargo updates it automatically when you change dependencies; you rarely edit it by hand.

To upgrade to the latest compatible versions:

cargo update

This respects the version ranges in Cargo.toml and updates Cargo.lock accordingly.

What's next

Next: Building your project.

From PHP to Rust — Getting Started with Rust