crates.io: development update

crates.io：开发进展更新

July 13, 2026 · Tobias Bieniek on behalf of the crates.io team 2026年7月13日 · Tobias Bieniek 代表 crates.io 团队

Another six months have passed since our last development update, and the crates.io team has been busy. Here’s a summary of the most notable changes and improvements made to crates.io since then. 距离我们上一次开发进展更新已经过去了六个月，crates.io 团队一直忙碌于各项工作。以下是自那时以来 crates.io 最显著的变化和改进总结。

Source Code Viewer

源代码查看器

Crate pages now have a “Code” tab that lets you browse the contents of published crate versions directly on crates.io. This shows you the exact files that cargo downloads when you add a crate as a dependency, which might differ from the linked repository. This makes it much easier to audit your dependencies, including files that never appear in the repository, like the normalized Cargo.toml files that cargo generates. Crate 页面现在新增了一个“Code”（代码）标签页，允许你直接在 crates.io 上浏览已发布 crate 版本的具体内容。这展示了当你将某个 crate 添加为依赖项时，cargo 实际下载的文件，这些文件可能与链接的仓库内容有所不同。这使得审计依赖项变得更加容易，包括那些从未出现在仓库中、由 cargo 生成的标准化 Cargo.toml 文件。

The viewer comes with a file tree sidebar with search functionality, syntax highlighting, and GitHub-style line selection, where clicking or dragging line numbers produces shareable #L10-L20 URLs. 该查看器配备了一个带有搜索功能的文件树侧边栏、语法高亮显示以及 GitHub 风格的行选择功能，点击或拖动行号即可生成可分享的 #L10-L20 格式链接。

Under the hood, the server now builds a zip file for every published version. Since the .crate files that cargo consumes are gzipped tarballs without random access support, a background job re-packs each of them into a seekable zip archive plus a JSON manifest describing the contained files. Both are served from our static CDN. The frontend then fetches only the manifest and loads each file on demand with an HTTP range request. Because of this architecture, browsing crate sources essentially adds no load on the crates.io API servers. Existing crate versions have been backfilled, so this works for old releases too. 在底层实现上，服务器现在会为每个已发布的版本构建一个 zip 文件。由于 cargo 使用的 .crate 文件是不支持随机访问的 gzipped tarball，后台任务会将它们重新打包成可寻址的 zip 归档文件，并附带一个描述所含文件的 JSON 清单。两者均通过我们的静态 CDN 提供服务。前端仅获取清单，并根据需要通过 HTTP 范围请求加载每个文件。得益于这种架构，浏览 crate 源代码几乎不会给 crates.io API 服务器增加任何负载。现有的 crate 版本已经完成了回填，因此旧版本也支持此功能。

The rendering library behind the code viewer is a diff renderer at heart, and that’s no accident: a version-to-version diff viewer built on the same infrastructure is currently in the works. This will allow you to review exactly what changed between two published versions, right on crates.io. Stay tuned! 代码查看器背后的渲染库本质上是一个差异（diff）渲染器，这并非偶然：一个基于相同基础设施的版本间差异查看器目前正在开发中。这将允许你直接在 crates.io 上查看两个已发布版本之间究竟发生了哪些变化。敬请期待！

Untangling crates.io Accounts from GitHub

将 crates.io 账户与 GitHub 解耦

At the end of May, the crates.io team accepted RFC #3946. Crates.io accounts always have been tightly coupled to GitHub: signing in means “Log in with GitHub”, and your crates.io identity is your GitHub username. The RFC changes that. It introduces usernames that are native to crates.io and independent of linked GitHub accounts, as a prerequisite for eventually supporting login via other identity providers. 5月底，crates.io 团队采纳了 RFC #3946。crates.io 账户一直与 GitHub 紧密耦合：登录即意味着“使用 GitHub 登录”，且你的 crates.io 身份就是你的 GitHub 用户名。该 RFC 改变了这一点。它引入了 crates.io 原生的、独立于关联 GitHub 账户的用户名，这是最终支持通过其他身份提供商登录的前提条件。

The implementation of crates.io usernames has started, but there is still a lot left to do, most visibly the ability to change your crates.io username. After that is complete, there will be future RFCs and implementation for signing in with identity providers other than GitHub. Since all of this touches authentication and account security, we are deliberately taking it slow and rolling these changes out in small, carefully reviewed steps. crates.io 用户名的实现工作已经开始，但仍有许多工作要做，最明显的就是修改 crates.io 用户名的功能。在此完成后，未来将会有关于使用非 GitHub 身份提供商登录的 RFC 和实现。由于这一切涉及身份验证和账户安全，我们特意放慢了节奏，以小步快跑且经过仔细审查的方式逐步推出这些变更。

Advisories and Suggestions

安全公告与建议

In our January update we introduced the “Security” tab, which shows security advisories from the RustSec database. We have since taken this integration one step further: crates that RustSec has flagged as unmaintained now show a warning banner directly on their crate pages, linking to the corresponding advisory for details and possible alternatives. Thanks to Dirkjan Ochtman for implementing this feature! 在1月份的更新中，我们引入了“Security”（安全）标签页，用于显示来自 RustSec 数据库的安全公告。此后，我们将这一集成更进一步：被 RustSec 标记为“未维护”的 crate 现在会在其页面上直接显示警告横幅，并链接到相应的公告以获取详细信息和可能的替代方案。感谢 Dirkjan Ochtman 实现此功能！

Related to this, some popular crates have been largely absorbed into the Rust standard library over the years, like lazy_static, which has been superseded by std::sync::LazyLock since Rust 1.80. Crate pages of such crates now show a friendly “You might not need this dependency” banner describing the standard library replacement, and superseded crates in dependency lists get a small light bulb icon with a similar hint. 与此相关，多年来一些流行的 crate 已被 Rust 标准库吸收，例如 lazy_static，自 Rust 1.80 起已被 std::sync::LazyLock 取代。此类 crate 的页面现在会显示一个友好的“你可能不需要这个依赖”横幅，描述标准库中的替代方案；而在依赖列表中，被取代的 crate 会带有一个小灯泡图标，并附带类似的提示。

The dataset behind this feature lives in the new rust-lang/std-replacement-data repository, together with a documented inclusion policy: standard library replacements only, every entry must cite the stable std, core, or alloc API and Rust version, and crate maintainers get a notice-and-comment window before an entry is added. New entries can be proposed upstream and can benefit other tools too. 该功能背后的数据集位于新的 rust-lang/std-replacement-data 仓库中，并附带了明确的收录政策：仅限标准库替代方案，每个条目必须引用稳定的 std、core 或 alloc API 及 Rust 版本，且在添加条目之前，crate 维护者会获得通知并有权发表意见。新条目可以在上游提出，并能惠及其他工具。

Ferris

The most delightful change of this cycle: the Ferris on our error pages now follows your mouse cursor with its eyes: Getting a 404 error on crates.io is now slightly less sad. 本周期中最令人愉悦的变化：我们错误页面上的 Ferris 现在会用眼睛跟随你的鼠标光标移动：在 crates.io 上遇到 404 错误现在没那么令人沮丧了。

Svelte Frontend Migration Completed

Svelte 前端迁移完成

In our January update, we announced that we were experimenting with porting the crates.io frontend from Ember.js to Svelte. This experiment has concluded successfully: the new frontend reached feature parity, went through a public testing phase in April, became the default at the beginning of May, and the Ember.js app has been removed from our repository. 在1月份的更新中，我们宣布正在尝试将 crates.io 前端从 Ember.js 迁移到 Svelte。该实验已圆满结束：新前端实现了功能对等，在4月份经历了公开测试阶段，于5月初成为默认版本，且 Ember.js 应用已从我们的仓库中移除。

We designed this change to be invisible for our users, since the new frontend is a 1:1 port of the previous design and functionality. For the team and our contributors, however, it is a big deal: the frontend is now built on a more modern framework, which should make it easier for new contributors to get started. It also allows us to iterate faster, as the source code viewer above demonstrates. We want to thank the Ember.js team for a framework that served crates.io well for many years, and the Svelte team for making the transition so enjoyable. 我们将此变更设计为对用户透明，因为新前端是对之前设计和功能的 1:1 移植。然而，对于团队和贡献者来说，这是一件大事：前端现在基于更现代的框架构建，这应该会让新贡献者更容易上手。它还使我们能够更快地进行迭代，正如上面提到的源代码查看器所展示的那样。我们要感谢 Ember.js 团队多年来为 crates.io 提供的出色框架，也要感谢 Svelte 团队让这次迁移变得如此愉快。

Miscellaneous

其他事项

These were some of the more visible changes to crates.io over the past six months, but a lot has happened “under the hood” as well: 以上是过去六个月中 crates.io 一些较为显著的变化，但“底层”也发生了很多事情：

Search performance: Relevance-sorted search queries previously ranked every crate matching the query, which could take 1-2 seconds for short or common search terms. Ranking is now bounded to the 1,000 matching crates with the highest recent download counts. 搜索性能： 以前，按相关性排序的搜索查询会对所有匹配的 crate 进行排名，对于简短或常见的搜索词，这可能需要 1-2 秒。现在，排名限制在近期下载量最高的 1,000 个匹配 crate 中。
Reverse dependencies performance: The reverse dependencies endpoint no longer recomputes the full dependent set on every request. It is now served from a precomputed table kept in sync by database triggers, turning an expensive join into a bounded index scan and greatly reducing the chance of getting a timeout error. 反向依赖性能： 反向依赖接口不再在每次请求时重新计算完整的依赖集。它现在由一个通过数据库触发器保持同步的预计算表提供服务，将昂贵的连接操作转变为有界的索引扫描，大大降低了出现超时错误的几率。
New ARCHITECTURE.md: If you’ve ever wondered how crates.io actually works, our ARCHITECTURE.md document got a complete rewrite. It is now organized around the high-level… 新的 ARCHITECTURE.md： 如果你曾经好奇 crates.io 是如何运作的，我们的 ARCHITECTURE.md 文档已经进行了彻底重写。它现在围绕高层级……（原文截断）