bump.rs: is this upgrade safe?

crate

from to

paste your Cargo.lock to get answers about your project rather than a fresh resolve

Should I take this crate at all? Every file is read as new.

crate version

How upgrades usually arrive: a bot bumping a dozen crates at once. One verdict over the whole delta. A lockfile records no dependency kinds, so every package it names is looked up, which takes a few seconds for a large one on a cold start and is instant on a repeat.

from a public GitHub pull request

old Cargo.lock new Cargo.lock

bump.rs

introduced

pre-existing

dependencies

files

findings