Oh, so you trust "cargo build"? Why? Sure, "cargo update" will update the dependencies – that's what it's meant to do. The point of Cargo.lock is to ensure tha

Oh, so you trust "cargo build"? Why? Sure, "cargo update" will update the dependencies – that's what it's meant to do. The point of Cargo.lock is to ensure that all compilations use the same known set of versions, otherwise it's possible for developers to use one library and the users to use a different one. With Cargo.lock a new version of library won't be used without an explicit "cargo update".