Introduction

Rust Recursive Dependency Updater (rrdu) is a fast, safe, zero-privilege CLI tool and GitHub Action designed to inspect, navigate, and recursively update dependencies across Rust workspaces and multi-crate repositories.

Mission & Core Objectives

1. Workspace & Crate Discovery: Automatically locates all Cargo.toml manifests across cargo workspaces and nested standalone crates.
2. Selective crates.io Auditing: Checks dependencies exclusively against crates.io, intentionally ignoring git and path dependencies.
3. Accurate SemVer Classification: Categorizes updates according to official Cargo SemVer rules into compatible non-breaking bumps ([No migration needed]) and breaking updates ([Need manual migration]).
4. Formatting-Preserving Manifest Updates: Modifies manifests via toml_edit to ensure that 100% of formatting, indentation, whitespace, and user comments are preserved.
5. Zero-Privilege & Pure User-Space: Runs with #![forbid(unsafe_code)] across all internal logic and never requests elevated root or administrator permissions.

Architectural Highlights

• Dual-Mode Execution: Interactive terminal interface with pagination, visual spinners, in-place overwriting, and keyboard navigation, alongside headless CI execution (--headless). All dependency updates require interactive validation by the user.
• Two-Tier Registry Strategy: Fast static queries via the crates.io Sparse Index for CI gates, paired with rich metadata queries strictly throttled to 1 request per second in interactive mode adhering to the crates.io Data Access Policy.
• Tri-Cache Layer: Persistent disk cache in ~/.rrdu/cache/ (Index, Web API, and RustSec advisories) with TTL expiration checks.
• Terminal Safety & Execution Boundaries:
  • In Headless Mode (--headless), the tool completely avoids unsafe code and low-level TTY interactions, utilizing comfy-table-inline with Table::force_no_tty to eliminate unsafe ioctl terminal calls.
  • In Interactive Mode, rich terminal interactions rely on audited dependencies (dialoguer, indicatif). Potential risks stemming from low-level FFI/unsafe in their underlying libraries (console, libc, windows-sys) are actively minimized through defensive fallbacks: verifying TTY attachments (Term::is_term()) to prevent ioctl errors in non-interactive pipes, and implementing signal trapping (Ctrl+C) to cleanly restore terminal state and exit with code 2.

Current State and Integrated Handlings

rrdu is currently under active pre-release development. Fundamental components including recursive workspace discovery, scoped ignore rules, registry index queries, tri-caching, and SemVer classification are fully implemented and covered by unit tests. Interactive terminal navigation and comment-preserving manifest updates are actively being integrated.

Detailed information regarding completed milestones and upcoming implementations can be found in the Pre-Release Roadmap.

Installation

rrdu is available as a pre-compiled standalone binary, via Cargo, and as a GitHub Marketplace Action.

1. Pre-Compiled Binaries (Linux & Windows)

Download the latest pre-compiled binary matching your system architecture directly from the GitHub Releases page:

• Linux (x86_64 glibc): rrdu-x86_64-unknown-linux-gnu.tar.gz
• Linux (x86_64 musl static): rrdu-x86_64-unknown-linux-musl.tar.gz
• Windows (x86_64 MSVC): rrdu-x86_64-pc-windows-msvc.zip
• macOS (Apple Silicon & Intel): rrdu-aarch64-apple-darwin.tar.gz / rrdu-x86_64-apple-darwin.tar.gz

Extract the binary and place it in your $PATH (e.g. ~/.local/bin or /usr/local/bin).

2. Via Cargo

Install rrdu using Cargo from crates.io:

cargo install rust-recursive-deps-updater

To update an existing installation:

cargo install rust-recursive-deps-updater --force

3. GitHub Actions Composite Action

You can integrate rrdu directly into your GitHub Actions CI/CD workflows:

- name: Check Rust Dependencies
  uses: AnnoDomine/rust-recursive-deps-updater@v1
  with:
    run: "scan"

For security, pinning to full immutable commit SHAs is recommended.

Configuration (.rrduconfig)

rrdu uses an optional YAML configuration file named .rrduconfig located in the root of your workspace or project repository.

Initializing Configuration

Generate a tailored .rrduconfig automatically by running:

rrdu --init

If a .rrduconfig file already exists, rrdu will prompt for confirmation before overwriting.

Configuration Schema

workspace:
  - project: Root
    path: ./
    exclude:
      project: # Excludes all named dependencies project-wide
        - tokio
      section: # Excludes named dependencies from specific sections
        dev-dependencies: # Exclude serde only from [dev-dependencies]
          - serde
        dependencies.clap: [] # Exclude [dependencies.clap] section completely
  - project: WorkspaceCrate
    path: crates/workspace_crate
    sub-config: true

updater:
  exclude:
    - target
    - vendor
  max-lines: 10 # Entries per page during interactive pagination
  version: 0.0.5 # Schema version

Field Reference

workspace

• project: Human-readable identifier for the crate or workspace root.
• path: Relative path to the project directory containing Cargo.toml. Paths must stay within ./ or subdirectories; parent traversal (../) and root paths (/) are strictly rejected.
• exclude.project: List of crate names excluded from all sections.
• exclude.section: Section-scoped exclusions.
• sub-config: When true, stops recursive traversal and uses the sub-project’s own .rrduconfig.

updater

• exclude: Directory names ignored during recursive filesystem traversal.
• max-lines: Number of dependency rows per page during interactive CLI navigation.
• version: Version of the schema for backward compatibility checks.

Use-Cases

rrdu accommodates workflows ranging from interactive local development to automated CI/CD pipelines.

1. Interactive Developer Workflow

Launch rrdu in your repository root without arguments:

rrdu

• Hierarchical Inspection: Navigate through workspace projects, inspect dependency sections ([dependencies], [dev-dependencies], [build-dependencies]), and drill down into individual dependencies.
• Visual Status & Counts: Each project displays section counts and dependency tallies (e.g., Sections: 2 / 2 | Total dependencies: 14 / 16), with SemVer update statuses highlighted (Update required, Migration required, No action).
• Sliding-Window Navigation:
  • ↑ / ↓: Move the highlighted selection across rows.
  • ← / →: Flip pages smoothly (bounded by updater.max-lines).
  • Enter: Select item and drill down into child view.
  • Backspace: Return to the previous view level.
  • u: Trigger update for the selected dependency.
  • Esc / Ctrl+C: Exit cleanly while restoring terminal state.

2. Headless CI / Pull Request Gate (--headless)

Automate dependency health checks on Pull Requests:

rrdu --headless

Example output:

┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ rrdu workspace dependency audit                                                                                                                    │
╞════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╡
╞═══════════════════════════════════════════════════════════════════════════════════════════════════════╤══════════════════════╤═════════════════════╡
│ Project                                                                                               ┆ Sections             ┆ Dependencies        │
╞═══════════════════════════════════════════════════════════════════════════════════════════════════════╪══════════════════════╪═════════════════════╡
│ rust-recursive-deps-updater                                                                           ┆ 2                    ┆ 16                  │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════════════════════════════════════════════════════════╧═════════════════════╤╧═════════════════════╡
│ Section                                                                                                                     ┆ Dependencies         │
╞═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╪══════════════════════╡
│ [dev-dependencies]                                                                                                          ┆ 2                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ tempfile                                          ┆ 3.27.0                      ┆ 3.27.0               ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ criterion                                         ┆ 0.8.2                       ┆ 0.8.2                ┆ True                ┆ False               │
╞═══════════════════════════════════════════════════╧═════════════════════════════╧══════════════════════╧════════════════════╤╧═════════════════════╡
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ [dependencies]                                                                                                              ┆ 14                   │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ semver                                            ┆ 1.0.28                      ┆ 1.0.28               ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ comfy-table-inline [Key: comfy-table]             ┆ Excluded project wide!      ┆ Not requested        ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ thiserror                                         ┆ 2.0.21                      ┆ 2.0.21               ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ toml_edit                                         ┆ 0.25.16                     ┆ 0.25.16+spec-1.1.0   ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ indicatif                                         ┆ 0.18.6                      ┆ 0.18.6               ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ureq                                              ┆ 3.4.2                       ┆ 3.4.2                ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ log                                               ┆ 0.4.34                      ┆ 0.4.34               ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ clap                                              ┆ 4.6.7                       ┆ 4.6.7                ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ serde_json                                        ┆ 1.0.151                     ┆ 1.0.151              ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ noyalib                                           ┆ 0.0.56                      ┆ 0.0.56               ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ simple_logger                                     ┆ 5.2.0                       ┆ 5.2.0                ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ time                                              ┆ 0.3.55                      ┆ 0.3.55               ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ serde                                             ┆ 1.0.229                     ┆ 1.0.229              ┆ True                ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ colored                                           ┆ 3.1.1                       ┆ 3.1.1                ┆ True                ┆ False               │
╞═══════════════════════════════════════════════════╧═════════════════════════════╧══════════════════════╧════════════════════╤╧═════════════════════╡
╞═══════════════════════════════════════════════════════════════════════════════════════════════════════╤═════════════════════╧╤═════════════════════╡
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ test-project                                                                                          ┆ 6                    ┆ 9                   │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════════════════════════════════════════════════════════╧═════════════════════╤╧═════════════════════╡
│ Section                                                                                                                     ┆ Dependencies         │
╞═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╪══════════════════════╡
│ [dependencies]                                                                                                              ┆ 4                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ serde                                             ┆ 1.0.190 -> 1.0.229          ┆ 1.0.229              ┆ False               ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ tokio                                             ┆ 1.35.0 -> 1.53.2            ┆ 1.53.2               ┆ False               ┆ False               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ colored [Key: my_colored]                         ┆ 2.1.0 -> 3.1.1              ┆ 3.1.1                ┆ False               ┆ True                │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ local_dep                                         ┆ Unsupported key: path       ┆ Not requested        ┆ True                ┆ False               │
╞═══════════════════════════════════════════════════╧═════════════════════════════╧══════════════════════╧════════════════════╤╧═════════════════════╡
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ [dev-dependencies]                                                                                                          ┆ 1                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ tempfile                                          ┆ 3.10.0 -> 3.27.0            ┆ 3.27.0               ┆ False               ┆ False               │
╞═══════════════════════════════════════════════════╧═════════════════════════════╧══════════════════════╧════════════════════╤╧═════════════════════╡
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ [build-dependencies]                                                                                                        ┆ 1                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ cc                                                ┆ 1.0.83 -> 1.6.0             ┆ 1.6.0                ┆ False               ┆ False               │
╞═══════════════════════════════════════════════════╧═════════════════════════════╧══════════════════════╧════════════════════╤╧═════════════════════╡
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ [workspace.dependencies]                                                                                                    ┆ 1                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ serde_json                                        ┆ 1.0.0 -> 1.0.151            ┆ 1.0.151              ┆ False               ┆ False               │
╞═══════════════════════════════════════════════════╧═════════════════════════════╧══════════════════════╧════════════════════╤╧═════════════════════╡
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ [target.cfg(windows).dependencies]                                                                                          ┆ 1                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ windows-sys                                       ┆ 0.52.0 -> 0.61.2            ┆ 0.61.2               ┆ False               ┆ True                │
╞═══════════════════════════════════════════════════╧═════════════════════════════╧══════════════════════╧════════════════════╤╧═════════════════════╡
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ [dependencies.clap]                                                                                                         ┆ 1                    │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
╞═══════════════════════════════════════════════════╤═════════════════════════════╤══════════════════════╤════════════════════╧╤═════════════════════╡
│ Dependency                                        ┆ Version                     ┆ Latest               ┆ Is latest           ┆ Needs Migration     │
╞═══════════════════════════════════════════════════╪═════════════════════════════╪══════════════════════╪═════════════════════╪═════════════════════╡
│ clap                                              ┆ 4.4.18 -> 4.6.7             ┆ 4.6.7                ┆ False               ┆ False               │
└───────────────────────────────────────────────────┴─────────────────────────────┴──────────────────────┴─────────────────────┴─────────────────────┘

• Renders a clean audit formatted via comfy-table-inline.
• Exit Code 0: All dependencies are up to date.
• Exit Code 1: Outdated dependencies were discovered (or a validation error occurred).
• Fails the CI pipeline if dependencies require updating, preventing dependency drift.

3. Safe Manifest Updates (User-Validated)

To protect your codebase from unintended breaking changes, dependency updates to Cargo.toml manifests are strictly interactive:

• Human Validation Requirement: All version modifications must be reviewed and explicitly validated in interactive mode. Unattended automated writes are intentionally prohibited.
• In-Place Updates via Key u: In the interactive dependency view, pressing key u initiates the update procedure for the highlighted dependency requirement.
• SemVer Classification Awareness: The interface clearly distinguishes between compatible upgrades ([No migration needed]) and breaking bumps ([Need manual migration]), allowing developers to make informed upgrade choices.
• 100% Format Preservation: Modifications are performed in-place using toml_edit, preserving all comments, indentation, whitespace, and table formatting in Cargo.toml.

4. Multi-Crate Monorepos and Nested Crates

In repositories containing mixed workspace members and standalone nested crates:

• rrdu identifies the root workspace members as well as independent sub-crates.
• Central [workspace.dependencies] are detected and updated, and member crates inheriting from workspace dependencies (dep = { workspace = true }) remain properly linked.

5. Diagnostic Reporting (--report)

Generate a privacy-sanitized system diagnostic report for issue reporting or troubleshooting:

rrdu --report

Output includes OS architecture, system CPU/memory details, Rust edition, rrdu version, and discovered workspaces, while automatically masking user home directories and sensitive tokens.

Pre-Release Roadmap

This document outlines the milestones, current progress, and upcoming engineering phases leading to the official v0.1.0 release of rust-recursive-deps-updater (rrdu).

Milestone Progress

Phase 0: Setup, Governance, CI/CD & Marketplace Infrastructure

• GNU General Public License v3.0 setup (LICENSE).
• Governance documentation (CODE_OF_CONDUCT.md, SECURITY.md, CONTRIBUTING.md).
• AI agent directives (AGENTS.md) and anti-vibe-coding standards.
• CI workflows with cross-platform matrix testing (Linux GNU/musl, Windows) and PR title linting.
• Immutable SHA pinning for all GitHub Actions.
• Composite Action implementation (action.yml).

Phase 1: Configuration Layer (.rrduconfig) & init Command

• Configuration data models (RrduConfig, ProjectConfig, UpdaterConfig).
• YAML parsing via pure-safe noyalib.
• Path canonicalization and strict traversal validation (rejecting ../ and /).
• Interactive template generator (rrdu --init) with overwrite protection.

Phase 2: Workspace & Sub-Crate Discovery Engine (workspace)

• Manifest traversal and dependency mapping.
• Scoped .gitignore and .rrduignore filtering via standard library traversal.
• Fine-grained exclusions (workspace.exclude and updater.exclude).
• Filtration of git and path dependencies (strictly checking crates.io).

Phase 3: crates.io Registry Client, Security & SemVer Engine (registry)

• Sub-config boundaries for nested .rrduconfig manifests (sub-config: true).
• Hierarchical module status codes (1YXX - 7YXX) and structured logging.
• Persistent tri-cache (~/.rrdu/cache/) with TTL validation (Index, Web API, RustSec).
• Two-tier querying: fast sparse index queries for CI and throttled Web API queries (1 req/s) for interactive mode.
• Cargo SemVer comparison engine with pre-1.0 and post-1.0 breaking change detection.

Phase 4: Interactive CLI, Table Formatter & Headless Modes (cli)

• Split architecture into rrdu core library and thin CLI binary.
• Integration of comfy-table-inline (custom comfy-table edition with inline table support and force_no_tty safety).
• Dual-mode logging (file-based ./rrdu.log for interactive CLI, stderr for CI).
• Filter out yanked versions from registry responses.
• Headless CI check (rrdu --headless) with hierarchical audit tables.
• Interactive pagination, spinners, and keyboard navigation (arrow keys, Backspace, Esc).
• Privacy-sanitized diagnostics report (rrdu --report).
• CLI documentation and argument help display (rrdu --help).
• Integration of the first benchmarks.

Phase 5: Comment-Preserving Manifest Updater (updater)

• In-place AST modifications via toml_edit.
• Full preservation of comments, whitespace, indentation, and inline tables.
• Workspace-level dependency updates ([workspace.dependencies]).
• Re-enable interactive dependency selection (SpecialInputs::Select in Views::Dependecy) and wire key u.

Phase 6: End-to-End Verification, Fixtures & Release v0.1.0

• Integration test suite in tests/ using tempfile.
• End-to-end headless CI verification across Linux and Windows.
• Criterion benchmark suite in benches/.
• Clean security audit (cargo audit).
• Official v0.1.0 release on GitHub and crates.io.

Quality & Verification

rrdu enforces strict engineering standards to ensure zero panics, complete memory safety, and dependable performance.

Standards Overview

• 100% Safe Rust Core Logic: #![forbid(unsafe_code)] enforced at the crate root (src/main.rs and src/lib.rs).
• Zero-Unsafe Headless Execution: Completely eliminates unsafe TTY code and ioctl calls in --headless CI mode via Table::force_no_tty.
• Defensive Interactive Fallbacks: Isolates terminal dependencies (dialoguer, indicatif) to interactive mode, mitigating dependency-level FFI risks with proactive TTY checks and signal trapping (Ctrl+C cleanup).
• Zero-Privilege: Strictly user-space execution.
• Continuous Integration: Every commit is validated across:
  • Formatting (cargo fmt --check)
  • Linter warnings (cargo clippy --all-targets -- -D warnings)
  • Unit and integration tests (cargo test)
  • Cross-platform builds (Linux GNU/musl, Windows, macOS)
  • Security audit (cargo audit)

Sections

• Test Results: Overview of unit testing, integration tests, and CI test matrices.
• Benchmarks: Performance benchmarks and Criterion test results.

Test Results & Verification

rrdu maintains high unit test and integration test coverage across all core subsystems.

Current Test Status

• Unit Tests: 46 unit tests covering configuration parsing, path validation, ignore rules, workspace discovery, terminal pagination, domain models, and SemVer categorization.
• Fixture Tests: Real-world API response schemas verified against 42 network fixtures across 14 crates.
• Safe Execution: 0 panics, zero unwrap() or expect() calls in production code paths.

Test Execution Matrix

Running Tests Locally

cargo test

Micro-Benchmarks & Performance

Performance, low latency, and zero overhead are fundamental design pillars of rust-recursive-deps-updater (rrdu). Because the tool interacts with large monorepos containing dozens or hundreds of crates, core algorithms must scale with strict predictability and minimal memory allocation.

This chapter details the methodology, benchmark harness, and execution workloads implemented in Criterion across parametric sample sizes of 10, 20, 50, 100, 500, and 1,000 items.

Tooling & Methodology

Micro-benchmarks are implemented using criterion (v0.8.2) under benches/rrdu_benchmarks.rs.

• 100% Safe Execution: The benchmark harness strictly enforces #![forbid(unsafe_code)] at its root.
• Statistical Rigor: Criterion executes warmup iterations, statistical sample collection, outlier filtering, and distribution analysis (mean, median, standard deviation).
• Parametric Scaling: Workloads are parameterized across uniform sample sizes of $N \in {10, 20, 50, 100, 500, 1000}$ to profile asymptotic time complexity ($O(1)$, $O(N)$).
• Zero External Network Dependencies: All benchmarks operate on in-memory ASTs, mock registries, and synthesized dependency trees, guaranteeing repeatable, isolated measurements without network latency or external side effects.

Core Benchmark Scenarios

The benchmark suite profiles four performance-critical subsystems:

1. SemVer Comparison & Classification

• Target Functions: DependencyEntry::check_if_latest and DependencyEntry::get_dependency_row_valus in rrdu::workspace::project.
• Workload: Evaluates Cargo SemVer compatibility rules across synthetic dependency entries with realistic version bump patterns:
  • Post-1.0 breaking updates (e.g. 1.2.0 vs. 2.0.0 -> [Need manual migration])
  • Post-1.0 non-breaking updates (e.g. 1.2.0 vs. 1.3.0 -> [No migration needed])
  • Pre-1.0 breaking updates (e.g. 0.2.1 vs. 0.3.0 -> [Need manual migration])
  • Pre-1.0 patch updates (e.g. 0.2.1 vs. 0.2.2 -> [No migration needed])
  • Up-to-date versions (e.g. 1.0.0 vs. 1.0.0)
• Complexity: $O(N)$ linear scaling relative to total scanned dependencies.

2. Terminal Pagination & UI Line Formatting

• Target Functions: Terminal::prepare_paginated_input_line and Terminal::get_selection_line in rrdu::interactivity::terminal.
• Workload: Simulates interactive arrow-key navigation through large lists of $N$ items. Evaluates sliding-window page boundary calculations and row rendering for the active viewport (default: 10 rows).
• Complexity: $O(1)$ constant-time viewport rendering, ensuring responsive navigation regardless of total repository crate count.

3. YAML Configuration Roundtrip

• Target Functions: noyalib::to_string_with_config (Serialization) and noyalib::from_str_with_config (Deserialization) with RrduConfig.
• Workload: Evaluates in-memory encoding and decoding of complete .rrduconfig workspace structures containing $N$ project crate definitions and exclusion rules.
• Complexity: $O(N)$ linear scaling for both serialization and deserialization.

4. Dependency Tree Metrics & Filtering

• Target Functions: ProjectDependency::total_values, ProjectDependency::count_valid_sections, and ProjectDependency::count_supported_total_values in rrdu::enums.
• Workload: Evaluates multi-criteria dependency counting and section traversal across dependencies, dev-dependencies, and build-dependencies.
• Complexity: $O(N)$ linear traversal with data locality and zero-allocation predicate matching.

Running Benchmarks Locally

Smoke Test (Single Iteration)

To verify compilation and functionality of the benchmark harness without running the full statistical sampling suite:

cargo bench --bench rrdu_benchmarks -- --test

Full Benchmark Execution

To execute full Criterion statistical measurements:

cargo bench --bench rrdu_benchmarks

Criterion generates detailed HTML reports, line plots, and distribution charts under:

target/criterion/report/index.html

Interactive Benchmark Dashboard

When viewed on GitHub Pages or built locally, the full interactive Criterion dashboard generated by the benchmark suite is embedded below:

• Open Interactive Benchmark Dashboard (Full Screen)

Embedded Dashboard

Project History & Migrations

This section tracks all releases, behavioral updates, and migration guides for rust-recursive-deps-updater.

• Changelog: Detailed release notes and changes per version.
• Migration Guide: Instructions for migrating .rrduconfig between versions.

Changelog

All notable changes to rust-recursive-deps-updater (rrdu) will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning and Conventional Commits.

[v0.0.5] - 2026-10-11

Added

• Interactive TUI & Sliding-Window Pagination: Terminal interface with directional pagination (←/→), item navigation (↑/↓), line filler padding calculation, and keyboard navigation controls (Enter, Backspace, u, Esc).
• Headless Audit Mode (--headless): Pure-safe non-interactive CI execution displaying formatted dependency audit tables with exit code 0 (clean) or 1 (updates pending/error).
• Diagnostics Reporting (--report): Hardware and OS diagnostic markdown report using sysinfo with privacy sanitization of user home directory tokens.
• CLI Reference Help (--help / -h): Detailed CLI argument help texts powered by Clap derive.
• Criterion Benchmark Suite: Comprehensive performance benchmarks (benches/rrdu_benchmarks.rs) across sample sizes of 10, 20, 50, 100, 500, and 1000 items.
• CI Documentation & Benchmark Pipeline: Automated GitHub Actions workflow (pages.yml) building mdBook and embedding interactive Criterion benchmark reports on GitHub Pages.
• Non-TTY Stream Protection: Proactively detects non-interactive streams in interactive mode and exits with a guidance message pointing to --headless.

Changed

• Legacy Configuration Cleanup: Removed updater.auto-update and updater.auto-scan from config models with backwards-compatible, non-breaking deserialization.
• Default Viewport Size: Reduced default updater.max-lines from 50 to 10 entries for responsive terminal rendering.

[v0.0.4] - 2026-09-30

Added

• Two-Tier Registry Client: High-performance crates.io integration querying the sparse index (https://index.crates.io/) for crate availability and web API (/api/v1/crates/<crate>) for detailed metadata.
• Security Vulnerability Auditing: Direct integration with RustSec OSV advisory database (https://rustsec.org/packages/<crate>.json) to identify security advisories and vulnerable dependency versions.
• Persistent Tri-Cache Engine: Generic disk-backed caching layer (CacheRegistry<T>) stored in ~/.rrdu/cache/ with individual TTL policies (24 hours for index/API metadata, 6 hours for RustSec advisories).
• Rate Limiting & Compliant HTTP: Outgoing crates.io request throttling with a 1-second cooldown (TIME_BETWEEN_REQUESTS) and compliant User-Agent headers.
• Standardized Structured Logging: Structured logging architecture with standardized 4-digit status codes (1YXX - 6YXX) and typed status macros (simple_status!, meta_status!) backed by the log facade and simple_logger.
• Rustdoc Documentation Enforcement: 100% Rustdoc documentation coverage across all public APIs, strictly enforced via .githooks/pre-commit and GitHub Actions docs CI workflow.
• Real-World Test Fixtures: Comprehensive offline test suite featuring captured index, API, and RustSec responses across 14 diverse crates.

Changed

• Zero Raw Console Output: Replaced all raw println! and eprintln! calls across production code paths with structured status logging macros to prevent terminal output pollution and CI reporting corruption.
• Configuration Schema Update: Updated updater.auto-update options in .rrduconfig to support none, semver-safe, and full.
• Crate Metadata Links: Added explicit homepage (releases) and documentation links to Cargo.toml.

Fixed

• Nested Sub-Config Discovery Recursion: Prevented recursive traversal from entering subdirectories containing their own .rrduconfig, respecting sub-project boundaries (fixes #5).
• Sparse Index 3-Letter Path Resolution: Corrected sparse index directory prefix resolution for 3-letter crate names (3/<first-char>/<crate>).
• Defensive Deserialization: Made nullable and missing API and RustSec response fields optional (Option<T>) to prevent deserialization failures on edge cases.

[v0.0.3] - 2026-09-27

Added

• Workspace & Standalone Crate Discovery: Native recursive filesystem traversal discovering all Cargo.toml manifests across cargo workspaces and nested standalone crates.
• Hierarchical Ignore Engine: Scoped ignore handling supporting .gitignore, .rrduignore, hidden directory exclusions (.*), and automatic crate build/source folder filtering (target, src).
• Dependency AST Representation: Support for all Cargo dependency definitions (simple strings, inline tables, explicit table sections, workspace dependencies, and target-specific dependencies).
• SemVer Classification Engine: Built-in Cargo SemVer comparison categorizing updates into compatible bumps ([No migration needed]) and breaking bumps ([Need manual migration]).
• Granular Exclusion Schema: Support for project-wide and section-specific dependency exclusions in .rrduconfig.
• Sub-Config Support: Ability to delegate sub-crate configuration via sub-config: true.
• Zero External Traversal Dependencies: Eliminated walkdir in favor of pure standard library std::fs::read_dir.
• Unit Test Coverage: 23 passing unit tests verifying discovery, path resolution, ignore scoping, and dependency parsing.

Changed

• Migrated .rrduconfig schema: toml renamed to path, introduced granular exclude.project and exclude.section mapping, added updater.version.

[v0.0.2] - 2026-09-21

Added

• Configuration engine with YAML parsing via noyalib (#![forbid(unsafe_code)]).
• Path traversal defense rejecting parent references (../) and root paths (/).
• Initial CLI configuration generator (rrdu --init).
• Domain-specific typed error hierarchy (ConfigError).

[v0.0.1] - 2026-09-20

Added

• Project foundation, governance, GitHub Actions CI/CD workflows, and GPL-3.0 licensing.

Migration Guide

As the project may introduce breaking changes during early development, this document provides a guide for updating your configuration files between versions.

Version 0.0.4 to 0.0.5

Changes in .rrduconfig

1. Removed fields updater.auto-update and updater.auto-scan: As updater.auto-update and updater.auto-scan are no more needed, we removed them from .rrduconfig. These are no breaking changes.

Version 0.0.3 to 0.0.4

Changes in .rrduconfig

1. Change value of updater.auto-update: For better readability we changed the possible values of the updater.auto-update to none, semver-safe and full. As this key currently is not used, it is not breaking the application.

Version 0.0.1/0.0.2 to 0.0.3

Changes in .rrduconfig

1. Renamed toml to path:
   Starting from version 0.0.3, sub-project .rrduconfig files are supported. Therefore, the field toml in the workspace array has been renamed to path.
2. Added sub-config field (boolean):
   • false (default): No dedicated .rrduconfig file for this sub-project. path points directly to the directory / Cargo.toml.
   • true: path points to a sub-project directory containing its own .rrduconfig.
3. Changed schema of exclude: exclude was before a simple list with project wide excluded dependencies. With the 0.0.3 we changed it to a more granular schema which differs between project wide exclusion and section specified exclusion to give more control.
4. Added updater.version field:
   Specifies the configuration schema version for easier compatibility checks.

Rationale: These changes avoid unnecessary discoveries of projects in deep child folders and keep the root .rrduconfig concise.

Configuration Diff

# Before (0.0.1):
workspace:
  - project: Root
    toml: ./
    exclude:
      - tokio
      - serde
  - project: WorkspaceCrate
    toml: crates/workspace_crate

updater:
  exclude:
    - excluded_folder
  auto-update: none
  auto-scan: true
  max-lines: 50

# After (0.0.3):
workspace:
  - project: Root
    path: ./
    exclude:
      project: # Excludes all named dependencies project wide
        - tokio
      section: # Excludes all named dependencies from specific sections
        dev-dependencies: # Only exclude named dependencies from [dev-dependencies] section
          - serde
        dependencies.clap: [] # Exclude [dependencies.clap] section in total.
  - project: WorkspaceCrate
    path: crates/workspace_crate
    sub-config: true

updater:
  exclude:
    - excluded_folder
  auto-update: none
  auto-scan: true
  max-lines: 50
  version: 0.0.3

Third-Party Dependencies & Licenses

rust-recursive-deps-updater (rrdu) is licensed under the GNU General Public License v3.0 or later (GPL-3.0-or-later).

All dependencies used in this project are strictly sourced from crates.io and adhere to permissive open-source licenses compatible with the GPL-3.0.

Direct Dependencies

Development Dependencies

License Notice for comfy-table-inline

rrdu utilizes comfy-table-inline, a customized edition of comfy-table published on crates.io by Dominic Seel:

• Repository: https://github.com/AnnoDomine/comfy-table
• License: Mozilla Public License 2.0 (MPL-2.0)
• Modifications: Extended the upstream table engine with first-class inline table rendering capabilities for cleaner multi-column dependency views, while strictly maintaining Table::force_no_tty to ensure 100% safe Rust without OS-level ioctl calls.