GitHub extends supply chain security to Rust
GitHub's supply chain security tooling—dependency graph, Dependabot alerts, and security updates—now covers Rust projects using Cargo files. Rust is the fastest growing language on GitHub, and with this addition, Cargo manifests join the languages already analyzed for known vulnerabilities.
Advisory database coverage
The GitHub Advisory Database now lists more than 400 existing Rust vulnerabilities, growing as GitHub curates historical records and triages new reports. Most of these entries come from RustSec, an independent organization that standardizes and publishes Rust library advisories. The database is open, and package maintainers can collaborate privately with reporters through GitHub Security Advisories before public disclosure. Known CVEs that are missing from the database can be submitted via community contribution.
Dependency graph and review
For repositories with Cargo files, the dependency graph parses Cargo.toml and Cargo.lock to map out dependencies. This detection is the foundation Dependabot uses to flag known vulnerabilities and generate updates. The graph is visible under the Insights tab in the Dependency graph sidebar and is on by default for public repositories; private repositories must enable it manually.
Rust support is rolling out in two phases. The first phase, already underway, analyzes Cargo manifests and lockfiles. Full package metadata, including mapping Cargo packages back to GitHub repositories, is planned for a future release, so dependency graph data for Rust repositories may take time to populate fully.
To keep vulnerable dependencies from entering the codebase in the first place, the dependency review GitHub Action inspects pull requests for changes to Rust dependencies and flags any newly introduced packages with known vulnerabilities, allowing teams to block those merges.
Dependabot alerts and security updates
Dependabot alerts notify repository maintainers when new vulnerabilities are published for Rust packages already in use. Security updates go a step further by opening pull requests that bump the affected package to a non-vulnerable release. Both features have notification and automation settings that can be tailored per repository.
Getting started
Teams can begin by reviewing GitHub's guides for any of the relevant features: security advisories, the dependency graph, dependency review, Dependabot alerts, and Dependabot security updates. General guidance on securing a repository is also available.
