timweri/cargo-oxidate

Check Cargo dependency for packages that are too new (supply chain risk) or too old (staleness/CVE risk)

Trust Signals

name	description	required	default
cargo-lock-path	Path to the Cargo.lock file	no	Cargo.lock
min-age-days	Minimum age in days. Packages newer than this are flagged (supply chain security).	no	—
max-age-days	Maximum age in days. Packages older than this are flagged (staleness).	no	—
exempt-packages	Newline-separated list of package names to exempt from checks	no	""
exclude-missing	Exclude packages whose publish date cannot be determined from violations (by default they are included)	no	false
timeout	HTTP request timeout in seconds	no	10
suggest-fix	For "too new" violations, suggest cargo update commands to downgrade to compliant versions	no	false
cache-responses	Cache crates.io API responses between runs	no	true

no outputs