Rust Crates and Dependencies

Writing every feature from scratch wastes time. Rust developers share ready-made code packages called crates, and a public library named crates.io hosts thousands of them. Using a crate resembles borrowing a tool from a community workshop: someone built it well, tested it, and left it available for everyone.

Crate Basics

A crate is the smallest unit of code that the Rust compiler handles at once. Two kinds exist.

• A binary crate compiles into a program you can run, and it contains a main function.
• A library crate offers functions and types for other crates to use.

 Package (managed by Cargo)
   |
   +-- Cargo.toml
   +-- Binary crate   (src/main.rs)
   +-- Library crate  (src/lib.rs)   [optional]

Adding a Dependency

The [dependencies] section in Cargo.toml lists every outside crate. The command below adds a crate and edits the file automatically.

cargo add rand@0.8

The same result comes from typing the line manually.

[dependencies]
rand = "0.8"

Cargo downloads the crate and every crate it depends on during the next build.

 Cargo.toml --> Cargo --> crates.io
                  |
                  v
          downloads rand + its helpers
                  |
                  v
          compiles them with your code

Using the Crate in Code

A use statement brings names into scope. The program below rolls a six-sided die with the rand crate at version 0.8.

use rand::Rng;

fn main() {
    let mut rng = rand::thread_rng();
    let roll: u32 = rng.gen_range(1..=6);
    println!("You rolled a {roll}");
}

Crate APIs change between major versions. Always read the documentation that matches the version listed in Cargo.toml.

Understanding Version Numbers

Rust crates follow semantic versioning, which uses three numbers: major, minor, and patch.

Number	Changes When
Major (1.x.x)	Existing code may break
Minor (x.2.x)	New features arrive, old code still works
Patch (x.x.3)	Bugs get fixed

The text "0.8" accepts any 0.8.x release. Cargo never jumps to 0.9 or 1.0 unless you edit the line.

Version Requirement Styles

rand = "0.8"         # compatible updates only
rand = "=0.8.5"      # exactly this version
rand = ">=0.8, <0.9"  # explicit range

Cargo.lock Pins Exact Versions

After the first build, Cargo records exact versions in Cargo.lock. Later builds reuse those versions, so teammates and servers get identical results. Run cargo update to move to newer compatible versions deliberately.

Crate Features

Many crates hide optional parts behind feature flags. Turning on only what you need keeps compile times short.

serde = { version = "1", features = ["derive"] }

Dependencies for Tests and Build Steps

Some crates matter only during testing. List them in a separate section, and the final program stays small.

[dev-dependencies]
pretty_assertions = "1"

Finding Good Crates

• Search crates.io and compare download counts.
• Read the documentation on docs.rs.
• Check the date of the latest release.
• Review open issues in the source repository.
• Prefer crates with clear licenses and active maintenance.

Checking Your Dependencies

The command cargo tree prints a map of every crate your project pulls in. The command cargo doc --open builds local documentation for all of them.

 my_app
  |-- rand v0.8.5
  |    |-- rand_core
  |    |-- rand_chacha
  |-- serde v1.0

Local Crates

A dependency can point to a folder on your own disk. Large projects use this to split work into several related crates.

[dependencies]
helpers = { path = "../helpers" }

Safety Habits

Outside code runs with the same permissions as your program. Choose well-known crates, keep versions current, and read the license before shipping software. The cargo audit tool reports known security advisories for crates in your lock file.

Key Points

• A crate is a package of Rust code that other projects can reuse.
• List dependencies in Cargo.toml or add them with cargo add.
• Semantic versions tell you how risky an update is.
• Cargo.lock keeps builds repeatable.
• Feature flags enable optional parts of a crate.