Hacker ApprovedDepartments

Cargo

Ranked 5 of 35 package managers by recommenders

Rust's all-in-one build tool and package manager that handles building, testing, docs and publishing with little fuss, though critics cite npm-style supply-chain risks and weak C/C++ interop.

Rust's all-in-one build tool and package manager that handles building, testing, docs and publishing with little fuss, though critics cite npm-style supply-chain risks and weak C/C++ interop.

234 people gave an opinion

recommend it
123
criticize it
111
approval share
53%
Each figure is 2 people. RecommendsCriticizes

Recommended in 12 of 13 months

  1. November 2025: recommended
  2. December 2025: recommended
  3. January 2026: recommended
  4. February 2026: recommended
  5. March 2026: recommended
  6. April 2026: recommended
  7. May 2026: recommended
  8. June 2026: recommended
  9. July 2026: recommended
  10. August 2026: recommended
  11. September 2026: recommended
  12. October 2026: recommended
  13. November 2026: not recommended (month in progress)

Owned for 6 years

Median of the 4 owners who said how long they have had it.

Each square is one year.

Why it doesn’t carry the badge

  • 123 people recommend itNeeds 10 or more, met.
  • 1.1 recommenders for every criticNeeds 2 to 1 or better, not met.
  • Recommended in 12 of 13 monthsNeeds 4 or more, met.

The same three rules apply to every product, and the badge can’t be bought. How the badge works

What people say about it

The reasons people give, with the number of comments that give each one. Open a reason to read what they said.

Why people recommend it

Each mark is one comment

  • Builds just work, no dependency hell

    “It just also almost always works flawlessly (and the script itself has a standardised name), so you don't notice most of the time.”

    Comment from 30 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”

    “I can pull down some code, run `cargo build`, and not have to worry about the right libraries being installed on my system”

    Comment from 17 Jan 2026 in “High-Level Is the Goal”

    “the lack of dependency hell until I hit a c/c++ component somewhere in the build is the real winner”

    Comment from 29 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”
  • Build, test, docs, publish in one

    “Cargo is your build system, package manager, test runner, doc generator, and publisher in one coherent thing.”

    Comment from 19 Mar 2026 in “Ask HN: Why is everyone on HN obsessed with Rust?”

    “Something like Cargo does all of this for you, which is why people prefer it to calling rustc directly.”

    Comment from 15 Feb 2026 in “A header-only C vector database library”

    “you can run cargo doc to generate & open the documentation of your project and all your dependencies”

    Comment from 17 Nov 2025 in “Rust in Android: move fast and fix things”
  • Beats other languages' tooling

    “the big adv Cargo/Rust has is learning from past mistakes, and taking good ideas that have come up; discarding bad”

    Comment from 28 Jan 2026 in “Package Management Is a Wicked Problem”

    “Cargo and the crate ecosystem are a dream compared to the lack of any easy-to-use build tooling”

    Comment from 3 May 2026 in “Embedded Rust or C Firmware? Lessons from an Industrial Microcontroller Use Case”

    “The result was a famously well-designed toolchain that the entire community praises.”

    Comment from 28 Dec 2025 in “How uv got so fast”
  • Unifies the Rust ecosystem

    “I love that cargo unifies the ecosystem, no quabble over one shitty build tool over another.”

    Comment from 28 Feb 2026 in “Rust Is Just a Tool”

    “Cargo and the crate ecosystem are a dream compared to the lack of any easy-to-use build tooling”

    Comment from 3 May 2026 in “Embedded Rust or C Firmware? Lessons from an Industrial Microcontroller Use Case”

    “virtually every software package of any version is available to you in cargo or npm”

    Comment from 2 Nov 2025 in “Hard Rust requirements from May onward”

What people warn about

Each mark is one comment

  • Supply-chain risks like npm

    “use package managers (npm, cargo, pip, etc) outside of a VM you are substantially more vulnerable to attack”

    Comment from 28 Mar 2026 in “Make macOS consistently bad (unironically)”

    “Cargo isn't immune to this, as much as I love Rust and wish more shops used it.”

    Comment from 11 May 2026 in “TanStack NPM Packages Compromised”

    “Notably, crates.io / cargo has some of the same issues as NPM and the verbiage of their excuses for not fixing these problems is oddly similar.”

    Comment from 16 May 2026 in “'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens”
  • Poor interop with C/C++ and distros

    “there is a tradeoff between "one first-class package manager and build system" and "lackluster support for various build systems"”

    Comment from 17 Dec 2025 in “Rust GCC backend: Why and how”

    “Cargo is great as long as it is only Rust code and there is little need to interop with platform SDKs”

    Comment from 28 Feb 2026 in “Rust Is Just a Tool”

    “the lack of dependency hell until I hit a c/c++ component somewhere in the build is the real winner”

    Comment from 29 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”
  • Dependency version sprawl

    “The only thing I'd like to see is the ability to programmatically limit transitive dependency count or depth in Cargo.”

    Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload”

    “I haven't run into the "five versions of serde" problem, but I can easily imagine it.”

    Comment from 24 Nov 2025 in “Several core problems with Rust”

    “some package managers (including Cargo and npm) confusingly treat 0.1.0 → 0.1.1 like a "minor" update, despite the spec”

    Comment from 18 Mar 2026 on Hacker News
  • Huge cache and disk clutter

    “Cargo's cache is ridiculously massive (half of which is debug info: zero-cost abstractions have full-cost debug metadata)”

    Comment from 29 Nov 2025 in “Electron vs. Tauri”

    “none of those should be putting their stuff (especially temporary junk) directly and unsegmented into $HOME”

    Comment from 20 Nov 2025 in “Firefox 147 Will Support the XDG Base Directory Specification”

Other package managers people recommend

The four most recommended other package managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.

Cargo compared with 4 alternatives
ProductRecommendCriticizeApprovalMonthsOwnedBadge
Nix37815072%133 yrs24 ownersApproved
Homebrew27117561%1210 yrs13 owners—
npm16146126%12——
pnpm1242484%125 yrs4 ownersApproved
CargoThis page12311153%126 yrs4 owners—
See all 35 package managers, ranked

What people said

40 of the 305 comments that mention it, newest first. Each links to the original comment.

“This isn't C, you don't need to manage all of those builds individually. That's what the build system is for.”

RecommendsComment from 13 Oct 2026 in “A Modern Web App in C”

“The only thing I'd like to see is the ability to programmatically limit transitive dependency count or depth in Cargo.”

MixedComment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload”

“cargo as a tool beats any language tooling for any language with similar breadth”

RecommendsComment from 10 Aug 2026 in “Because It's Not Fun Enough: why languages fail”

“NPM (and cargo/PyPI et. al.) continues to think it can short circuit this requirement for human labor.”

CriticizesComment from 1 Jun 2026 in “NPM packages from RedHat have been compromised”

“Notably, crates.io / cargo has some of the same issues as NPM and the verbiage of their excuses for not fixing these problems is oddly similar.”

CriticizesComment from 16 May 2026 in “'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens”

“Cargo isn't immune to this, as much as I love Rust and wish more shops used it.”

MixedComment from 11 May 2026 in “TanStack NPM Packages Compromised”

“Cargo and the crate ecosystem are a dream compared to the lack of any easy-to-use build tooling”

RecommendsComment from 3 May 2026 in “Embedded Rust or C Firmware? Lessons from an Industrial Microcontroller Use Case”

“it's pure pain for distros like Debian who don't want to use cargo at build time”

MixedComment from 14 Apr 2026 in “Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them”

“cargo because its adjacent to C and C++ in terms of being a low-level compiled language used for systems programming”

RecommendsComment from 9 Apr 2026 in “I built a Cargo-like build tool for C/C++”

“a build.rs is a lot easier for me to read and understand (or even modify) if needed because I already know Rust”

RecommendsComment from 30 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”

“It just also almost always works flawlessly (and the script itself has a standardised name), so you don't notice most of the time.”

RecommendsComment from 30 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”

“the lack of dependency hell until I hit a c/c++ component somewhere in the build is the real winner”

MixedComment from 29 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”

“that I don't ever need to tell it which files to compile or where to find them”

RecommendsComment from 29 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”

“use package managers (npm, cargo, pip, etc) outside of a VM you are substantially more vulnerable to attack”

MixedComment from 28 Mar 2026 in “Make macOS consistently bad (unironically)”

“In practice this means using language-specific package management (uv, cargo, etc) and ignoring the nix way.”

RecommendsComment from 23 Mar 2026 in “Why I love NixOS”

“some choices imposed by the build system (like cargo allowing multiple versions of the same dep in a workspace)”

CriticizesComment from 21 Mar 2026 in “OpenCode – The open source AI coding agent”

“Cargo is your build system, package manager, test runner, doc generator, and publisher in one coherent thing.”

RecommendsComment from 19 Mar 2026 in “Ask HN: Why is everyone on HN obsessed with Rust?”

“some package managers (including Cargo and npm) confusingly treat 0.1.0 → 0.1.1 like a "minor" update, despite the spec”

CriticizesComment from 18 Mar 2026 on Hacker News

“NPM, PyPI, Cargo et. al. continue to think they can short circuit that process and still ship safe software, and they verifiably cannot.”

CriticizesComment from 7 Mar 2026 in “Package Managers Need to Cool Down”

“Cargo is great as long as it is only Rust code and there is little need to interop with platform SDKs”

MixedComment from 28 Feb 2026 in “Rust Is Just a Tool”

“I love that cargo unifies the ecosystem, no quabble over one shitty build tool over another.”

RecommendsComment from 28 Feb 2026 in “Rust Is Just a Tool”

“Something like Cargo does all of this for you, which is why people prefer it to calling rustc directly.”

RecommendsComment from 15 Feb 2026 in “A header-only C vector database library”

“the big adv Cargo/Rust has is learning from past mistakes, and taking good ideas that have come up; discarding bad”

RecommendsComment from 28 Jan 2026 in “Package Management Is a Wicked Problem”

“I can pull down some code, run `cargo build`, and not have to worry about the right libraries being installed on my system”

RecommendsComment from 17 Jan 2026 in “High-Level Is the Goal”

“cargo is just so damned good at such important things that it's hard to imagine a better tool”

RecommendsComment from 7 Jan 2026 in “NPM to implement staged publishing after turbulent shift off classic tokens”

“Cargo compiles and runs build.rs for all dependencies, and there's no real alternative which doesn't.”

CriticizesComment from 6 Jan 2026 in “Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%”

“The result was a famously well-designed toolchain that the entire community praises.”

RecommendsComment from 28 Dec 2025 in “How uv got so fast”

“Frankly, the whole cargo side of rust has the same issues that node has, and that's silly beyond comprehension.”

CriticizesComment from 20 Dec 2025 in “Garage – An S3 object store so reliable you can run it outside datacenters”

“there is a tradeoff between "one first-class package manager and build system" and "lackluster support for various build systems"”

MixedComment from 17 Dec 2025 in “Rust GCC backend: Why and how”

“The big thing that makes me like Rust is that I've never had that experience with cargo.”

RecommendsComment from 12 Dec 2025 in “The Tor Project is switching to Rust”

“the benefits of Cargo in quickly building complex projects cannot be overstated”

RecommendsComment from 5 Dec 2025 in “Thoughts on Go vs. Rust vs. Zig”

“I'd take Maven or Cargo any day over anything in the JavaScript or Python ecosystem.”

RecommendsComment from 3 Dec 2025 in “Anthropic acquires Bun”

“Cargo's cache is ridiculously massive (half of which is debug info: zero-cost abstractions have full-cost debug metadata)”

MixedComment from 29 Nov 2025 in “Electron vs. Tauri”

“any new dependency being added (or even updating an existing one) can in practice cause a dependency to get bumped”

CriticizesComment from 24 Nov 2025 in “The Rust Performance Book (2020)”

“you should also not trust pypi, rubygems, cargo and all the other programming language package managers.”

CriticizesComment from 24 Nov 2025 in “Shai-Hulud Returns: Over 300 NPM Packages Infected”

“I haven't run into the "five versions of serde" problem, but I can easily imagine it.”

MixedComment from 24 Nov 2025 in “Several core problems with Rust”

“none of those should be putting their stuff (especially temporary junk) directly and unsegmented into $HOME”

CriticizesComment from 20 Nov 2025 in “Firefox 147 Will Support the XDG Base Directory Specification”

“you can run cargo doc to generate & open the documentation of your project and all your dependencies”

RecommendsComment from 17 Nov 2025 in “Rust in Android: move fast and fix things”

“Cargo handles package management, building, testing, documentation, and publishing.”

RecommendsComment from 10 Nov 2025 in “Zig and the design choices within”

“virtually every software package of any version is available to you in cargo or npm”

RecommendsComment from 2 Nov 2025 in “Hard Rust requirements from May onward”

Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.