packageurl

25.1K downloads in the last 30 days (837/day), up 26% from the previous period.

177 crates depend on packageurl. Reasonable ecosystem adoption, though not yet a core dependency.

This crate is maintained by a team (3 owners), reducing bus-factor risk and ensuring continuity.

Despite being 7+ years old, packageurl hasn't reached 1.0 yet. Expect potential API changes between versions.

At 41KB, packageurl is lightweight. Small crate size correlates with focused, well-scoped functionality.

Notable dependents include cargo-sbom, cargo-pants, cdviz-collector, csaf, guac. When high-quality crates choose packageurl, it's a strong quality signal.