What Is Cargo.lock?

Cargo.lock explained, including what it does and how it matters in CI/CD.

Cargo.lock records the exact versions of every dependency resolved for a Rust project.

What it is

It guarantees reproducible builds. The convention: commit Cargo.lock for binaries/applications; for libraries it is optional.

Why it matters in CI/CD

CI uses cargo build --locked so a stale Cargo.lock fails the build instead of silently resolving new versions.

Key takeaways

• Cargo.lock pins exact crate versions.
• Commit it for applications.
• Use --locked in CI.

Related guides