Cargo
Ranked 5 of 35 package managers by recommenders
Rust's all-in-one build tool and package manager that handles building, testing, docs and publishing with little fuss, though critics cite npm-style supply-chain risks and weak C/C++ interop.
Rust's all-in-one build tool and package manager that handles building, testing, docs and publishing with little fuss, though critics cite npm-style supply-chain risks and weak C/C++ interop.
234 people gave an opinion
- recommend it
- 123
- criticize it
- 111
- approval share
- 53%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Owned for 6 years
Median of the 4 owners who said how long they have had it.
Each square is one year.
Why it doesn’t carry the badge
- 123 people recommend itNeeds 10 or more, met.
- 1.1 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Builds just work, no dependency hell
“It just also almost always works flawlessly (and the script itself has a standardised name), so you don't notice most of the time.”
Comment from 30 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report” “I can pull down some code, run `cargo build`, and not have to worry about the right libraries being installed on my system”
Comment from 17 Jan 2026 in “High-Level Is the Goal” “the lack of dependency hell until I hit a c/c++ component somewhere in the build is the real winner”
Comment from 29 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report” - Comment from 7 Jan 2026 in “NPM to implement staged publishing after turbulent shift off classic tokens”
- Comment from 12 Dec 2025 in “The Tor Project is switching to Rust”
- Comment from 5 Dec 2025 in “Thoughts on Go vs. Rust vs. Zig”
Build, test, docs, publish in one
“Cargo is your build system, package manager, test runner, doc generator, and publisher in one coherent thing.”
Comment from 19 Mar 2026 in “Ask HN: Why is everyone on HN obsessed with Rust?” “Something like Cargo does all of this for you, which is why people prefer it to calling rustc directly.”
Comment from 15 Feb 2026 in “A header-only C vector database library” “you can run cargo doc to generate & open the documentation of your project and all your dependencies”
Comment from 17 Nov 2025 in “Rust in Android: move fast and fix things” - Comment from 10 Nov 2025 in “Zig and the design choices within”
- Comment from 29 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report”
Beats other languages' tooling
“the big adv Cargo/Rust has is learning from past mistakes, and taking good ideas that have come up; discarding bad”
Comment from 28 Jan 2026 in “Package Management Is a Wicked Problem” “Cargo and the crate ecosystem are a dream compared to the lack of any easy-to-use build tooling”
Comment from 3 May 2026 in “Embedded Rust or C Firmware? Lessons from an Industrial Microcontroller Use Case” “The result was a famously well-designed toolchain that the entire community praises.”
Comment from 28 Dec 2025 in “How uv got so fast” - Comment from 3 Dec 2025 in “Anthropic acquires Bun”
- Comment from 10 Aug 2026 in “Because It's Not Fun Enough: why languages fail”
Unifies the Rust ecosystem
“I love that cargo unifies the ecosystem, no quabble over one shitty build tool over another.”
Comment from 28 Feb 2026 in “Rust Is Just a Tool” “Cargo and the crate ecosystem are a dream compared to the lack of any easy-to-use build tooling”
Comment from 3 May 2026 in “Embedded Rust or C Firmware? Lessons from an Industrial Microcontroller Use Case” “virtually every software package of any version is available to you in cargo or npm”
Comment from 2 Nov 2025 in “Hard Rust requirements from May onward”
What people warn about
Each mark is one comment
Supply-chain risks like npm
“use package managers (npm, cargo, pip, etc) outside of a VM you are substantially more vulnerable to attack”
Comment from 28 Mar 2026 in “Make macOS consistently bad (unironically)” “Cargo isn't immune to this, as much as I love Rust and wish more shops used it.”
Comment from 11 May 2026 in “TanStack NPM Packages Compromised” “Notably, crates.io / cargo has some of the same issues as NPM and the verbiage of their excuses for not fixing these problems is oddly similar.”
Comment from 16 May 2026 in “'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens” - Comment from 7 Mar 2026 in “Package Managers Need to Cool Down”
- Comment from 20 Dec 2025 in “Garage – An S3 object store so reliable you can run it outside datacenters”
- Comment from 24 Nov 2025 in “Shai-Hulud Returns: Over 300 NPM Packages Infected”
- Comment from 1 Jun 2026 in “NPM packages from RedHat have been compromised”
- Comment from 6 Jan 2026 in “Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%”
Poor interop with C/C++ and distros
“there is a tradeoff between "one first-class package manager and build system" and "lackluster support for various build systems"”
Comment from 17 Dec 2025 in “Rust GCC backend: Why and how” “Cargo is great as long as it is only Rust code and there is little need to interop with platform SDKs”
Comment from 28 Feb 2026 in “Rust Is Just a Tool” “the lack of dependency hell until I hit a c/c++ component somewhere in the build is the real winner”
Comment from 29 Mar 2026 in “C++26 is done ISO C++ standards meeting, Trip Report” - Comment from 14 Apr 2026 in “Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them”
Dependency version sprawl
“The only thing I'd like to see is the ability to programmatically limit transitive dependency count or depth in Cargo.”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” “I haven't run into the "five versions of serde" problem, but I can easily imagine it.”
Comment from 24 Nov 2025 in “Several core problems with Rust” “some package managers (including Cargo and npm) confusingly treat 0.1.0 → 0.1.1 like a "minor" update, despite the spec”
Comment from 18 Mar 2026 on Hacker News - Comment from 24 Nov 2025 in “The Rust Performance Book (2020)”
- Comment from 21 Mar 2026 in “OpenCode – The open source AI coding agent”
Huge cache and disk clutter
“Cargo's cache is ridiculously massive (half of which is debug info: zero-cost abstractions have full-cost debug metadata)”
Comment from 29 Nov 2025 in “Electron vs. Tauri” “none of those should be putting their stuff (especially temporary junk) directly and unsegmented into $HOME”
Comment from 20 Nov 2025 in “Firefox 147 Will Support the XDG Base Directory Specification”
Other package managers people recommend
The four most recommended other package managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 35 package managers, rankedWhat people said
40 of the 305 comments that mention it, newest first. Each links to the original comment.
“This isn't C, you don't need to manage all of those builds individually. That's what the build system is for.”
“The only thing I'd like to see is the ability to programmatically limit transitive dependency count or depth in Cargo.”
“cargo as a tool beats any language tooling for any language with similar breadth”
“NPM (and cargo/PyPI et. al.) continues to think it can short circuit this requirement for human labor.”
“Notably, crates.io / cargo has some of the same issues as NPM and the verbiage of their excuses for not fixing these problems is oddly similar.”
“Cargo isn't immune to this, as much as I love Rust and wish more shops used it.”
“Cargo and the crate ecosystem are a dream compared to the lack of any easy-to-use build tooling”
“it's pure pain for distros like Debian who don't want to use cargo at build time”
“cargo because its adjacent to C and C++ in terms of being a low-level compiled language used for systems programming”
“a build.rs is a lot easier for me to read and understand (or even modify) if needed because I already know Rust”
“It just also almost always works flawlessly (and the script itself has a standardised name), so you don't notice most of the time.”
“the lack of dependency hell until I hit a c/c++ component somewhere in the build is the real winner”
“that I don't ever need to tell it which files to compile or where to find them”
“use package managers (npm, cargo, pip, etc) outside of a VM you are substantially more vulnerable to attack”
“In practice this means using language-specific package management (uv, cargo, etc) and ignoring the nix way.”
“some choices imposed by the build system (like cargo allowing multiple versions of the same dep in a workspace)”
“Cargo is your build system, package manager, test runner, doc generator, and publisher in one coherent thing.”
“some package managers (including Cargo and npm) confusingly treat 0.1.0 → 0.1.1 like a "minor" update, despite the spec”
“NPM, PyPI, Cargo et. al. continue to think they can short circuit that process and still ship safe software, and they verifiably cannot.”
“Cargo is great as long as it is only Rust code and there is little need to interop with platform SDKs”
“I love that cargo unifies the ecosystem, no quabble over one shitty build tool over another.”
“Something like Cargo does all of this for you, which is why people prefer it to calling rustc directly.”
“the big adv Cargo/Rust has is learning from past mistakes, and taking good ideas that have come up; discarding bad”
“I can pull down some code, run `cargo build`, and not have to worry about the right libraries being installed on my system”
“cargo is just so damned good at such important things that it's hard to imagine a better tool”
“Cargo compiles and runs build.rs for all dependencies, and there's no real alternative which doesn't.”
“The result was a famously well-designed toolchain that the entire community praises.”
“Frankly, the whole cargo side of rust has the same issues that node has, and that's silly beyond comprehension.”
“there is a tradeoff between "one first-class package manager and build system" and "lackluster support for various build systems"”
“The big thing that makes me like Rust is that I've never had that experience with cargo.”
“the benefits of Cargo in quickly building complex projects cannot be overstated”
“I'd take Maven or Cargo any day over anything in the JavaScript or Python ecosystem.”
“Cargo's cache is ridiculously massive (half of which is debug info: zero-cost abstractions have full-cost debug metadata)”
“any new dependency being added (or even updating an existing one) can in practice cause a dependency to get bumped”
“you should also not trust pypi, rubygems, cargo and all the other programming language package managers.”
“I haven't run into the "five versions of serde" problem, but I can easily imagine it.”
“none of those should be putting their stuff (especially temporary junk) directly and unsegmented into $HOME”
“you can run cargo doc to generate & open the documentation of your project and all your dependencies”
“Cargo handles package management, building, testing, documentation, and publishing.”
“virtually every software package of any version is available to you in cargo or npm”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.