[cmrdporcupine]

Your thoughts about crates.io mirrors mine exactly. I'm becoming more and more interested in just ditching it entirely and using vendored checked-in (or submoduled) dependencies and managing the transitive dependency tree myself. Cargo&crates.io seems to have been inspired too much by npm. Lots of half-baked, abandoned libs that wantonly pull-in piles of other 3rd party deps and create a sprawling graph of dependencies that ends up with binary bloat and multiple versions of the same package, etc. etc.

[Yoric]

FWIW, that's what Mozilla is doing.

[cmrdporcupine]

I suspect Google is, too (Bazel).

If CLion/RustRover support was there, I'd probably switch my personal project over to Bazel+vendored deps.