cargo-dedupe

A cargo subcommand to detect and automatically eliminate duplicate dependency versions across a Rust workspace.

Goals:

• Detect duplicate crates (like cargo tree -d).
• Automate version unification by editing local Cargo.toml files.
• If duplicates are caused by transitive mismatches, also attempts to adjust your direct dependencies to versions whose transitive trees unify the duplicates.
• Fully automated: no dry-run or interactive modes. Ensure you've commited your Cargo.toml before running!

Status: experimental. It works for both single Cargo.toml projects and multi-crate workspaces. It focuses on versions defined in the local project’s manifests. It does not modify third‑party crates directly, and does not add workspace patches.

Install

cargo install cargo-dedupe

This builds the cargo-dedupe binary, so you can run it as cargo dedupe.

Usage

cargo dedupe [-v]

• -v, --verbose: More logging.

How it works

1. Runs cargo metadata to obtain the resolved dependency graph.
2. Detects crates that appear in multiple versions across the graph.
3. For each duplicated crate (handles 2, 3, or more versions the same way):
   • Picks the highest version as the target (upgrade-first strategy for all duplicates).
   • Edits all workspace manifests that directly depend on that crate, setting their requirement to the chosen exact version.
   • Runs cargo check and reverts those edits if the build fails.
   • If the duplicate stems from transitive dependencies of your direct dependencies, tries updating your direct dependencies to versions that unify transitives. It upgrades first by broadening the requirement and running a global cargo update; on success, the exact resolved version is written back to your Cargo.toml. If needed, it may try a conservative downgrade constraint on the direct dependency to achieve unification.
4. Repeats detection because resolving one duplicate can help others.
5. Finishes with a final cargo check.

Notes and limitations

• This tool currently only edits standard sections: [dependencies], [dev-dependencies], [build-dependencies] (including inline tables and renamed dependencies). Target-specific dependency tables (e.g. [target.'cfg(...)'.dependencies]) are not yet updated.
• It does not fetch registry information to discover newer versions of your direct dependencies; it only adjusts versions you control.
• Always review diffs and CI before committing changes.

License

MIT OR Apache-2.0