{"id":13503001,"url":"https://github.com/facebookarchive/cargo-guppy","last_synced_at":"2025-03-29T13:30:33.140Z","repository":{"id":37987721,"uuid":"206652326","full_name":"facebookarchive/cargo-guppy","owner":"facebookarchive","description":"Track and query Cargo dependency graphs.","archived":true,"fork":false,"pushed_at":"2022-09-27T00:10:00.000Z","size":365432,"stargazers_count":351,"open_issues_count":24,"forks_count":26,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-04-08T00:14:48.823Z","etag":null,"topics":["cargo-guppy","cargo-metadata","crates","dependency-graphs","rust"],"latest_commit_sha":null,"homepage":"https://docs.rs/guppy","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/facebookarchive.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE-APACHE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-09-05T20:31:41.000Z","updated_at":"2024-02-07T14:01:29.000Z","dependencies_parsed_at":"2022-07-14T22:17:06.267Z","dependency_job_id":null,"html_url":"https://github.com/facebookarchive/cargo-guppy","commit_stats":null,"previous_names":["facebookincubator/cargo-guppy"],"tags_count":113,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/facebookarchive%2Fcargo-guppy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/facebookarchive%2Fcargo-guppy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/facebookarchive%2Fcargo-guppy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/facebookarchive%2Fcargo-guppy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/facebookarchive","download_url":"https://codeload.github.com/facebookarchive/cargo-guppy/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246174609,"owners_count":20735417,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cargo-guppy","cargo-metadata","crates","dependency-graphs","rust"],"created_at":"2024-07-31T22:02:33.102Z","updated_at":"2025-03-29T13:30:32.430Z","avatar_url":"https://github.com/facebookarchive.png","language":"Rust","funding_links":[],"categories":["Rust"],"sub_categories":[],"readme":"# cargo-guppy: track and query dependency graphs\n\n[![Build Status](https://github.com/facebookincubator/cargo-guppy/workflows/CI/badge.svg?branch=main)]((https://github.com/facebookincubator/cargo-guppy/actions?query=workflow%3ACI+branch%3Amain))\n[![License](https://img.shields.io/badge/license-Apache-green.svg)](LICENSE-APACHE) [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE-MIT)\n\nThis repository contains the source code for:\n* [`guppy`](guppy): a library for performing queries on Cargo dependency graphs [![guppy on crates.io](https://img.shields.io/crates/v/guppy)](https://crates.io/crates/guppy) [![Documentation (latest release)](https://docs.rs/guppy/badge.svg)](https://docs.rs/guppy/) [![Documentation (main)](https://img.shields.io/badge/docs-main-59f)](https://facebookincubator.github.io/cargo-guppy/rustdoc/guppy/)\n* libraries used by guppy:\n  * [`guppy-summaries`](guppy-summaries): a library for managing build summaries listing packages and features [![guppy-summaries on crates.io](https://img.shields.io/crates/v/guppy-summaries)](https://crates.io/crates/guppy-summaries) [![Documentation (latest release)](https://docs.rs/guppy-summaries/badge.svg)](https://docs.rs/guppy-summaries/) [![Documentation (main)](https://img.shields.io/badge/docs-main-59f)](https://facebookincubator.github.io/cargo-guppy/rustdoc/guppy_summaries/)\n  * [`target-spec`](target-spec): an evaluator for `Cargo.toml` target specifications [![target-spec on crates.io](https://img.shields.io/crates/v/target-spec)](https://crates.io/crates/target-spec) [![Documentation (latest release)](https://docs.rs/target-spec/badge.svg)](https://docs.rs/target-spec/) [![Documentation (main)](https://img.shields.io/badge/docs-main-59f)](https://facebookincubator.github.io/cargo-guppy/rustdoc/target_spec/)\n* tools built on top of guppy:\n  * [`determinator`](tools/determinator): figure out what packages changed between two revisions [![determinator on crates.io](https://img.shields.io/crates/v/determinator)](https://crates.io/crates/determinator) [![Documentation (latest release)](https://docs.rs/determinator/badge.svg)](https://docs.rs/determinator/) [![Documentation (main)](https://img.shields.io/badge/docs-main-59f)](https://facebookincubator.github.io/cargo-guppy/rustdoc/determinator/)\n  * [`cargo-hakari`](tools/cargo-hakari): a command-line tool to manage workspace-hack packages [![cargo-hakari on crates.io](https://img.shields.io/crates/v/cargo-hakari)](https://crates.io/crates/cargo-hakari) [![Documentation (latest release)](https://docs.rs/cargo-hakari/badge.svg)](https://docs.rs/cargo-hakari/) [![Documentation (main)](https://img.shields.io/badge/docs-main-59f)](https://facebookincubator.github.io/cargo-guppy/rustdoc/cargo_hakari/)\n    * available in library form as [`hakari`](tools/hakari) [![hakari on crates.io](https://img.shields.io/crates/v/hakari)](https://crates.io/crates/hakari) [![Documentation (latest release)](https://docs.rs/hakari/badge.svg)](https://docs.rs/hakari/) [![Documentation (main)](https://img.shields.io/badge/docs-main-59f)](https://facebookincubator.github.io/cargo-guppy/rustdoc/hakari/)\n  * [`cargo-guppy`](cargo-guppy): an experimental command-line frontend for `guppy` [![Documentation (main)](https://img.shields.io/badge/docs-main-59f)](https://facebookincubator.github.io/cargo-guppy/rustdoc/cargo_guppy/)\n* and a number of [internal tools](internal-tools) and [test fixtures](fixtures) used to verify that `guppy` behaves correctly.\n\n## Use cases\n\n`guppy` and `cargo-guppy` can be used to solve many practical problems related to dependency graphs in large Rust\ncodebases. Some examples -- all of these are available through the `guppy` library, and will eventually be supported in\nthe `cargo-guppy` CLI as well:\n\n* track existing dependencies for a crate or workspace\n* query direct or transitive dependencies of a subset of packages — useful when some packages have greater assurance or\n  reliability requirements\n* figure out what's causing a particular crate to be included as a dependency\n* iterate over reverse dependencies of a crate in [topological order](https://en.wikipedia.org/wiki/Topological_sorting)\n* iterate over some or all links (edges) in a dependency graph, querying if the link is a build, dev or regular\n  dependency\n* filter out dev-only dependencies while performing queries\n* perform queries based on [Cargo features](https://doc.rust-lang.org/cargo/reference/features.html)\n* simulate Cargo builds and return what packages and features would be built by it\n* evaluate target specs for [platform-specific dependencies](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html#platform-specific-dependencies)\n* generate *summary files* for Cargo builds, which can be used to:\n  * receive CI feedback if a dependency is added, updated or removed, or if new features are added\n  * receive CI feedback if a package is added to a high-assurance subset, or if any new features are enabled in\n    an existing package in that subset. This can be used to flag those changes for extra scrutiny.\n* print out a `dot` graph for a subset of crates, for formatting with [graphviz](https://www.graphviz.org/)\n\nStill to come:\n\n* a command-line query language\n\n## Development status\n\nThe core `guppy` code in this repository is considered **mostly complete** and the API is mostly stable.\n\nWe're building a number of tools on top of guppy, and those are still are under **active development**. Tool requirements may cause further changes in the API, but the goal will be to avoid extensive overhauls.\n\n`guppy`'s simulation of Cargo builds is [extensively tested](https://github.com/facebookincubator/cargo-guppy/blob/main/internal-tools/cargo-compare/src/lib.rs) against upstream Cargo, and there are no known differences.\nComparison testing has found a number of bugs in upstream Cargo, for example:\n* [v2 resolver: different handling for inactive, optional dependencies based on how they're specified](https://github.com/rust-lang/cargo/issues/8316)\n* [v2 resolver: a proc macro being specified with the key \"proc_macro\" vs \"proc-macro\" causes different results](https://github.com/rust-lang/cargo/issues/8315)\n* [specifying different versions in unconditional and target-specific dependency sections causes \"multiple rmeta candidates\" error](https://github.com/rust-lang/cargo/issues/8032)\n\n## Production users\n\n`cargo-guppy` is extensively used by the [Diem Core](https://github.com/diem/diem) project.\n\n`guppy` is used for [several lint checks](https://github.com/diem/diem/blob/main/devtools/x/src/lint/guppy.rs). This includes basic rules that look at every workspace package separately:\n* every package has fields like `author` and `license` specified\n* crate names and paths should use `-` instead of `_`\n\nto more complex rules about the overall dependency graph, such as:\n* some third-party dependencies are banned from the workspace entirely, or only from default builds\n* every workspace package depends on a `workspace-hack` crate (similar to [rustc-workspace-hack](https://github.com/rust-lang/rust/tree/master/src/tools/rustc-workspace-hack))\n* for any given third-party dependency, the workspace only depends on one version of it directly (transitive dependencies to other versions are still allowed)\n* every workspace package is categorized as either *production* or *test-only*, and the linter checks that test-only crates are not included in production builds\n* support for *overlay features*, which allow test-only code to be:\n  * included in crates (similar to [the `#[cfg(test)]` annotation](https://doc.rust-lang.org/book/ch11-03-test-organization.html#the-tests-module-and-cfgtest))\n  * depended on by test-only code in other crates (`#[cfg(test)]` does not allow this)\n  * but guaranteed to be excluded from production builds\n\nIn addition, `guppy-summaries` is used to generate build summaries of packages and features (particularly for [high-security subsets](https://en.wikipedia.org/wiki/Trusted_computing_base) of the codebase), and changes to these sets are flagged by Diem's CI ([example](https://github.com/diem/diem/pull/5799#issuecomment-682221102)).\n\n## Design\n\n`guppy` is written on top of the excellent [petgraph](https://github.com/petgraph/petgraph) library. It is a separate\ncodebase from `cargo`, depending only on the stable [`cargo\nmetadata`](https://doc.rust-lang.org/cargo/commands/cargo-metadata.html) format. (Some other tools in this space like\n[`cargo-tree`](https://github.com/sfackler/cargo-tree) use cargo internals directly.)\n\n## Minimum supported Rust version\n\nThe minimum supported Rust version (MSRV) is **1.56**.\n\nWhile a crate is pre-release status (0.x.x) it may have its MSRV bumped in a patch release. Once a crate has reached\n1.x, any MSRV bump will be accompanied with a new minor version.\n\n## Contributing\n\nSee the [CONTRIBUTING](CONTRIBUTING.md) file for how to help out.\n\n## License\n\nThis project is available under the terms of either the [Apache 2.0 license](LICENSE-APACHE) or the [MIT\nlicense](LICENSE-MIT).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffacebookarchive%2Fcargo-guppy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffacebookarchive%2Fcargo-guppy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffacebookarchive%2Fcargo-guppy/lists"}