All the comments and suggestions for improving rust dependency handling seem useful to me. To deal with dependency sprawl now, until the situation changes, I use a number of tools. To avoid having to set this up for each new project, I've made a template project that I simply unzip to create new rust projects.

The tools I have found useful are:

cargo outdated # check for newer versions of deps

cargo deny check # check dependency licenses

cargo about # generate list of used licenses

cargo audit # check dependencies for known security issues

cargo geiger # check deps for unsafe rust

I haven't found a cargo tool I like for generating SBOMs, so I installed syft and run that.

cargo install-update # keep these tools updated

cargo mutants # not related to deps, but worth a mention, used when testing.

Having configured all these tools once and simply unzipping a template works well for me.

Suggestions for different or additional tools welcome!

Disclaimer: I'm not a professional rust developer.