Fix Outdated Rust Crate Dependencies Rust
Scan Cargo.toml for CVEs and get a patched version. Fix vulnerable Rust crates — no cargo-audit CLI needed.
⚠ The Problem
cargo outdated shows stale crates but doesn't flag CVEs. cargo audit requires CLI installation and doesn't output a patched Cargo.toml.
Bad Configuration — Cargo.toml
[dependencies] actix-web = "3.3.2" openssl = "0.10.30"
Fixed Configuration — Cargo.toml
[dependencies] actix-web = "4.5.1" openssl = "0.10.66"
✓ Fix
actix-web 3.3.2 (CVE-2022-24977). openssl 0.10.30 has known vulnerabilities. Update to safe versions above. After updating, run cargo update.
Scan your dependencies now — paste your manifest, get a fixed version back in seconds.
Open PackageFix →No signup · No CLI · No GitHub connection · Runs 100% in your browser
Frequently Asked Questions
How do I scan Cargo.toml for CVEs without cargo-audit?
Paste your Cargo.toml into PackageFix. It queries the OSV crates.io advisory database live.
Does PackageFix support Cargo.lock?
Yes. Drop Cargo.lock alongside Cargo.toml for full transitive crate scanning.
What is the RustSec advisory database?
RustSec is the Rust security advisory database. OSV aggregates RustSec advisories — PackageFix queries OSV directly.
How do I fix a build.rs security warning?
If your Cargo.toml has build = 'build.rs', PackageFix flags it for manual review — build.rs runs arbitrary code at compile time.