Reading a Rust crate's capabilities out of its compiled symbols

Cargo tells you once_cell 1.19.0 → 1.20.2. It doesn't tell you whether the new

version started opening a socket. A dependency bump is a trust decision, and the

lockfile diff gives you almost nothing to make it with.

I kept chewing on this after xz. Not the specific attack so much as its shape: the

change that mattered was invisible at the level anyone actually reviews. Nobody