Will It Vibe?Cargo.toml dependency with wildcard version
Part of Dependencies & Hygiene, which counts for 10% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Cargo.toml [dependencies] entry is constrained to "*" (bare or in map form), accepting any published crate version; cargo itself warns against this.
Why it matters
A Cargo.toml dependency constrained to "*" accepts any published crate version, including a breaking major release, with no review window. cargo itself treats this as bad practice and community linting tools flag it for the same reason wildcard npm/composer ranges are risky: there is no boundary at all on what gets pulled in.
How to fix it
Replace the "*" with a caret-style range anchored to the version currently recorded in Cargo.lock (Cargo's default caret behavior if you just write the version number, e.g. "1.0.195"), or an exact version for tighter control.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo