crates.io

class

CargoRegistry

purl type

pkg:cargo

api

crates.io

version status

yanked

Address it

await fetchPackageFromPURL("pkg:cargo/serde");
await fetchDependenciesFromPURL("pkg:cargo/serde@1.0.229");

Crates have no namespace. Names are used as they are.

What it reads

latestVersion is max_stable_version, with max_version as the fallback for crates that only have pre-releases. documentation is the crate's own docs link, repository and homepage come straight from the crate. metadata carries downloads, recent downloads, categories and creation and update dates.

Versions

Every version has publishedAt from created_at, integrity as sha256- plus the checksum, and its own license. A yanked version has status: "yanked". metadata carries the crate size, the feature map and the downloads of that version.

Dependencies

optional is the crate's own optional flag. Dependencies that apply to one target only are included with no marker; the target is not surfaced.

Maintainers

Owner users, each with a login, a name and a URL. Owner teams are not listed; the endpoint only returns users.

URLs

urls.registry("serde"); // https://crates.io/crates/serde
urls.download("serde", "1.0.229"); // https://crates.io/api/v1/crates/serde/1.0.229/download
urls.documentation("serde", "1.0.229"); // https://docs.rs/serde/1.0.229
urls.readme("serde", "1.0.229"); // https://crates.io/api/v1/crates/serde/1.0.229/readme

Gotchas

• crates.io requires a User-Agent and rate limits anonymous clients. The default client sends registries/0.1.0; set your own through new Client({ userAgent }) if you make many calls.
• max_stable_version can be older than max_version when the newest release is a pre-release; latestVersion follows the stable one on purpose.
• The dependencies endpoint answers per version. Asking for a version that does not exist is a NotFoundError with the version attached.

Where it lives

src/registries/cargo.ts.