Sorry, I meant the author and license of e.g. this dependency of regex: https://crates.io/crates/aho-corasick https://crates.io/crates/aho-corasick I'm sure th

Sorry, I meant the author and license of e.g. this dependency of regex: https://crates.io/crates/aho-corasick https://crates.io/crates/aho-corasick I'm sure the Rust team knows and trusts these (or they even are Rust team members), but how should outsiders know this? Researching trustworthiness of individual authors, getting approval for different licenses, tracking and updating required notices in documentation etc. for every single dependency transitively(!) seriously takes a lot of effort. Updating dependencies that switch sub-(sub-...)-dependencies freely can turn from a simple cargo command into a month of work. A big standard library (or an equivalent construct) can really save the day there. > The guarantees aren't advertised, they're known. It is known. -- Jhiqui Glad to hear improving this is in the works anyway.