cargo-upkeep 0.3.2

Unified Rust project maintenance CLI (cargo subcommand)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

# cargo-upkeep

![CI](https://github.com/llbbl/upkeep-rs/actions/workflows/ci.yml/badge.svg)
![crates.io](https://img.shields.io/crates/v/cargo-upkeep.svg)

`cargo-upkeep` is a Rust maintenance CLI that combines the checks you usually run separately into one cargo subcommand. Instead of stitching together `cargo-outdated`, `cargo-audit`, `cargo-machete`, `cargo-geiger`, and `cargo clippy`, it gives you one interface, one JSON contract, workspace-aware dependency resolution, and one quality signal you can feed into CI.

## Install

```bash
cargo install cargo-upkeep
```

For `cargo-binstall`, the install script, and source builds, see [docs/installation.md](./docs/installation.md).

## Why use it

- One command surface for dependency freshness, RustSec advisories, unused dependencies, unsafe code, dependency trees, and a graded quality summary.
- One JSON shape per subcommand, with stdout reserved for machine-readable output and diagnostics kept on stderr.
- Workspace-aware dependency reporting: `deps` groups by crate name plus resolved version, and tells you which members actually own each result.
- A single `quality` grade that stays honest about partial runs through `complete`, `measured_weight`, and `unavailable`.

## Real examples

These are selected-field excerpts from real runs on this repository, not the complete command payloads. For the full canonical JSON for each command, see [docs/commands.md](./docs/commands.md).

The project-health pass is the shortest end-to-end workflow:

```bash
cargo upkeep quality --json
```

```json
{
  "score": 100.0,
  "grade": "A",
  "complete": false,
  "measured_weight": 0.45,
  "unavailable": [
    {
      "name": "Security",
      "weight": 0.25,
      "reason": "failed",
      "detail": "failed to fetch RustSec advisory database"
    },
    {
      "name": "Unused dependencies",
      "weight": 0.15,
      "reason": "not_installed",
      "detail": "cargo-machete is not installed; install with `cargo install cargo-machete`"
    },
    {
      "name": "Unsafe code",
      "weight": 0.15,
      "reason": "not_installed",
      "detail": "cargo-geiger is not installed; install with `cargo install cargo-geiger`"
    }
  ]
}
```

Selected fields from a real run on this repository on August 30, 2026. The full `quality` contract, including `breakdown`, recommendation ordering, and CI guidance, is in [docs/commands.md#quality](./docs/commands.md#quality).

Security-aware dependency checks use the same interface:

```bash
cargo upkeep deps --json --security
```

```json
{
  "total": 15,
  "checked": 15,
  "outdated": 0,
  "major": 0,
  "minor": 0,
  "patch": 0,
  "warnings": [
    "security scan uses Cargo.lock and reports direct workspace dependencies only"
  ],
  "security": {
    "summary": {
      "critical": 0,
      "high": 0,
      "moderate": 0,
      "low": 0,
      "total": 0
    },
    "packages": []
  }
}
```

Selected fields from a real run on this repository on August 30, 2026. The full `deps` contract, including `packages`, `skipped_packages`, and workspace attribution rules, is in [docs/commands.md#deps](./docs/commands.md#deps).

## Docs

- [docs/installation.md](./docs/installation.md): crates.io, `cargo-binstall`, install script, and source installs
- [docs/commands.md](./docs/commands.md): full command reference plus canonical JSON examples for every subcommand
- [docs/spec.md](./docs/spec.md): CLI contract, comparison with the underlying tools, rate limiting, and test-tooling notes

## Invocation forms

The normal form is `cargo upkeep <command>`. The direct binary form, the compatibility alias, and the exact contract around them are documented once in [docs/spec.md#cli-contract](./docs/spec.md#cli-contract).

## Project links

Contributing starts with the open [GitHub issues](https://github.com/llbbl/upkeep-rs/issues) and a local `just check`. Release history lives in [CHANGELOG.md](./CHANGELOG.md). Licensing and credits live in [LICENSE](./LICENSE) and [docs/spec.md](./docs/spec.md).