)]}'
{
  "commit": "3a846dc33eb06d8104f87d21274a07416701effb",
  "tree": "5e5faf0c4d9114eff0f078038322d85e56243bdb",
  "parents": [
    "b443e33abab4633a0403d833eb3d8bed779a177b"
  ],
  "author": {
    "name": "konstin",
    "email": "konstin@mailbox.org",
    "time": "Fri Aug 28 20:55:33 2026 +0200"
  },
  "committer": {
    "name": "konstin",
    "email": "konstin@mailbox.org",
    "time": "Fri Aug 28 20:55:33 2026 +0200"
  },
  "message": "Install cargo tools with locked dependencies\n\nInstalling cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies.\n\nI went through all `rg \"cargo install\"` hits in the repository and added `--locked` to all but explanatory examples (such as cargo\u0027s docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0.\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "de5de4bebaa91ef8bb0dc079a5a480ea22440f44",
      "old_mode": 33188,
      "old_path": "book/src/development/infrastructure/book.md",
      "new_id": "30e404233407b38bc36c8d6281246260bdeeee61",
      "new_mode": 33188,
      "new_path": "book/src/development/infrastructure/book.md"
    }
  ]
}