Start with the idea
Cargo.toml describes allowed versions while Cargo.lock records the exact chosen graph. Applications normally commit the lockfile so a later build does not silently select newer compatible releases.
Cargo.toml says which versions are acceptable; Cargo.lock records which exact package versions the resolver selected. If a manifest permits several compatible releases, the lockfile keeps subsequent ordinary builds on the same chosen graph until an update changes it. This helps a team reproduce a bug and compare results without silently pulling a newer dependency on every checkout.
An application normally commits its lockfile. A library crate may also commit one for its own development and tests, but downstream consumers resolve dependencies using their own lockfiles.
Keep learning, for free
The rest of this lesson is waiting for you.
Create a free account to read the complete explanation, see the infographic, explore the code, and try the exercises. All 742 lessons and algorithm steps are included.
No payment details. Your account opens the complete Academy.