That's why I started https://github.com/mimoo/cargo-dephell https://github.com/mimoo/cargo-dephell and https://github.com/diem/whackadep https://github.com/diem

That's why I started https://github.com/mimoo/cargo-dephell https://github.com/mimoo/cargo-dephell and https://github.com/diem/whackadep https://github.com/diem/whackadep btw, to try to get a sense of the risk in our Rust dependencies. Whackadep runs a a webserver that updates periodically and shows you what's up with your dependencies. If there's a new update, the idea is to estimate a sense of urgency (are we lagging behind? Is it a major version change? Is there a RUSTSEC advisory?) and a sense of risk. For example, it'll tell you if a new dependency version touches a `build.rs` file. I wanted to add more rules, like the ones mentioned in the article, but never had the time to do it.