EmbarkStudios · Jake-Shadle · Jul 9, 2026 · Jul 8, 2026 · Jul 9, 2026 · Jul 9, 2026
@@ -8,8 +8,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- next-header -->
 ## [Unreleased] - ReleaseDate
+### Changed
+- [PR#881](https://github.com/EmbarkStudios/cargo-deny/pull/881) refactored the CLI, moving some duplicated options/flags into the root and removing several deprecated options/flags/values. See the PR for a full list of changes.
+
 ### Added
-- [PR#879](https://github.com/EmbarkStudios/cargo-deny/pull/879) resolves [#873](https://github.com/EmbarkStudios/cargo-deny/issues/873) by adding a new [`bans.std-replacements`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-std-replacements-field-optional) lint which checks the graph for crates.io sourced crates that have been partially or fully replaced in `std` and/or `core`.
+- [PR#879](https://github.com/EmbarkStudios/cargo-deny/pull/879) resolved [#873](https://github.com/EmbarkStudios/cargo-deny/issues/873) by adding a new [`bans.std-replacements`](https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html#the-std-replacements-field-optional) lint which checks the graph for crates.io sourced crates that have been partially or fully replaced in `std` and/or `core`.
+
+### Fixed
+- [PR#881](https://github.com/EmbarkStudios/cargo-deny/pull/881) resolved [#874](https://github.com/EmbarkStudios/cargo-deny/issues/874) by cleaning up the CLI, deduplicating some options/flags that caused bug in the `list` subcommand.
 
 ## [0.19.9] - 2026-06-15
 ### Added

@@ -34,8 +34,8 @@ bitvec = { version = "1.0", features = ["alloc"] }
 # Much nicer paths
 camino = "1.1"
 cfg-expr = "0.20"
-# Argument parsing, kept aligned with cargo
-clap = { version = "4.5", features = ["derive", "env"] }
+# Argument parsing
+clap = { version = "4.5", features = ["env"] }
 # Used for diagnostic reporting
 codespan = { version = "0.13", features = ["serialization"] }
 codespan-reporting = { version = "0.13", features = ["serialization"] }

@@ -4,7 +4,7 @@ The check command is the primary subcommand of cargo-deny as it is what actually
 
 ## Args
 
-### `<which>`
+### `<WHICH>`
 
 The check(s) to perform. By default, **all** checks will be performed, unless one or more checks are specified here.
 
@@ -22,24 +22,6 @@ To ease transition from cargo-audit to cargo-deny, this flag will tell cargo-den
 
 Note that this flag only applies when the output format is JSON, and note that since cargo-deny supports multiple advisory databases, instead of a single JSON object, there will be 1 for each unique advisory database.
 
-### `-c, --config <CONFIG>`
-
-Path to the config to use
-
-Defaults to `<cwd>/deny.toml` if not specified
-
-### `-d, --disable-fetch`
-
-Disable fetching of the advisory database
-
-When running the `advisories` check, the configured advisory database will be fetched and opened. If this flag is passed, the database won't be fetched, but an error will occur if it doesn't already exist locally.
-
-This option is also set if the `--offline` flag is used in the global options.
-
-### `--exclude-dev`
-
-If set to `true`, all `dev-dependencies`, even one for workspace crates, are not included in the crate graph used for any of the checks.
-
 ### `-D, --deny <DENY>`
 
 Set lint denied
@@ -81,7 +63,7 @@ Set lint warnings
 
 ## Exit Codes
 
-As of [0.14.1](https://github.com/EmbarkStudios/cargo-deny/releases/tag/0.14.1), the exit code for the check command is a bitset of the checks that were executed and had 1 or more errors.
+As of [0.14.1](https://github.com/EmbarkStudios/cargo-deny/releases/tag/0.14.1), the exit code for the check command is a bitset of the checks that were executed that had 1 or more errors.
 
 A script or program can use the following values to determine exactly which check(s) failed.
 

@@ -8,6 +8,18 @@ The subcommands share some common options that can be used before the subcommand
 
 The path to a `Cargo.toml` file which is used as the context for operations.
 
+### `-c, --config <CONFIG>`
+
+Path to the config to use.
+
+Defaults to `<cwd>/deny.toml` if not specified.
+
+### `--metadata-path`
+
+Path to cargo metadata json.
+
+By default we use `cargo metadata` to generate the metadata json, but you can override that behaviour by providing the path to the output of `cargo metadata`.
+
 ### `--all-features` (single crate or workspace)
 
 Enables all features when determining which crates to consider. Works for both single crates and workspaces.
@@ -42,31 +54,32 @@ The log level for messages, only log messages at or above the level will be emit
 
 Possible values:
 
-* `off` - No output will be emitted
-* `error`
-* `warn` (default)
-* `info`
-* `debug`
-* `trace`
+- `off` - No output will be emitted
+- `error`
+- `warn` (default)
+- `info`
+- `debug`
+- `trace`
 
 ### `--format`
 
 The format of the output of both log and diagnostic messages.
 
 Possible values:
 
-* `human` (default) - Output for the pesky humans
-* `json` - Each log message/diagnostic is outputted as a single line JSON object
+- `human` (default) - Output for the pesky humans
+- `json` - Each log message/diagnostic is outputted as a single line JSON object
+- `sarif` - [SARIF](https://sarifweb.azurewebsites.net/) output
 
 ### `--color`
 
 Whether coloring is applied to human-formatted output, using it on JSON output has no effect.
 
 Possible values:
 
-* `auto` (default) - Coloring is applied if the output stream is a TTY
-* `always` - Coloring is always applied
-* `never` - No coloring is applied for any output
+- `auto` (default) - Coloring is applied if the output stream is a TTY
+- `always` - Coloring is always applied
+- `never` - No coloring is applied for any output
 
 ### `-t, --target`
 
@@ -78,24 +91,20 @@ If set, exclude unpublished workspace members from graph roots.
 
 Workspace members are considered unpublished if they they are explicitly marked with `publish = false`. Note that the excluded workspace members are still used for the initial dependency resolution by cargo, which might affect the exact version of used dependencies.
 
-### `--allow-git-index`
-
-If set, the crates.io git index is initialized for use in fetching crate information, otherwise it is enabled only if using a cargo < 1.70.0 without the sparse protocol enabled
-
 ### [`--locked`](https://doc.rust-lang.org/cargo/commands/cargo-fetch.html#option-cargo-fetch---locked)
 
 Asserts that the exact same dependencies and versions are used as when the existing Cargo.lock file was originally generated. Cargo will exit with an error when either of the following scenarios arises:
 
-* The lock file is missing.
-* Cargo attempted to change the lock file due to a different dependency resolution.
+- The lock file is missing.
+- Cargo attempted to change the lock file due to a different dependency resolution.
 
 ### [`--offline`](https://doc.rust-lang.org/cargo/commands/cargo-fetch.html#option-cargo-fetch---offline)
 
 Prevents Cargo and `cargo-deny` from accessing the network for any reason. Without this flag, Cargo will stop with an error if it needs to access the network and the network is not available. With this flag, Cargo will attempt to proceed without the network if possible.
 
 Beware that this may result in different dependency resolution than online mode. Cargo will restrict itself to crates that are downloaded locally, even if there might be a newer version as indicated in the local copy of the index. See the cargo-fetch(1) command to download dependencies before going offline.
 
-`cargo-deny` will also not fetch advisory databases with this option, meaning that any new or updated advisories since the last time the database(s) were fetched won't be known and thus won't be checked against the dependency graph.
+`cargo-deny` will also not fetch advisory databases with this option, meaning that any new or updated advisories since the last time the database(s) were fetched won't be known and thus won't be checked against the dependency graph, nor will it fetch `std-replacement-data` which means if that database is not already present on the filesystem then crates will not be checked to determine if they are partially or fully replaced in std/core.
 
 ### [`--frozen`](https://doc.rust-lang.org/cargo/commands/cargo-fetch.html#option-cargo-fetch---frozen)
 

@@ -0,0 +1,14 @@
+# The `fetch` command
+
+Fetches remote datat that may be used by the `check` and/or `list` subcommands.
+
+## Args
+
+### `SOURCES`
+
+Possible values:
+
+- db - Fetches the configured advisory databases. Defaults to <https://github.com/RustSec/advisory-db>.
+- index - Fetches the crate sources and index information for the crates in the graph.
+- std-replacement - Fetches the std-replacement-data from <https://github.com/EmbarkStudios/std-replacement-data/tree/collated>
+- all (default) - Fetches all of the above sources.
@@ -10,10 +10,10 @@ cargo deny init
 
 ## Specify a path
 
-The `init` command can take a path as an argument to use as path of the config instead of the default which is `<cwd>/deny.toml`.
+Using the root `--config` option can be used to change the default path (`<cwd>/deny.toml`) of the config file created.
 
 ```bash
-cargo deny init path/to/config.toml
+cargo deny --config path/to/config.toml init
 ```
 
 ## Template

@@ -4,52 +4,46 @@ Similarly to [cargo-license](https://github.com/onur/cargo-license), `list` prin
 
 ## Options
 
-### `-c, --config <CONFIG>`
-
-Path to the config to use
-
-Defaults to `<cwd>/deny.toml` if not specified
-
 ### `-f, --format`
 
 The format of the output
 
-* `human` (default) - Simple format where each crate or license is its own line
-* `json`
-* `tsv`
+- `human` (default) - Simple format where each crate or license is its own line
+- `json` - JSON
+- `tsv` - Tab-separated values, note that the `crate` layout does not apply to this format
 
 ### [`--color`](../cli/common.md#--color)
 
 Colors:
 
-* SPDX identifier - ![blue](https://placehold.it/15/5dade2/000000?text=+)
-* Crate with 1 license - ![white](https://placehold.it/15/717d7e/000000?text=+)
-* Crate with 2 or more licenses - ![yellow](https://placehold.it/15/f1c40f/000000?text=+)
-* Crate with 0 licenses - ![yellow](https://placehold.it/15/e74c3c/000000?text=+)
+- SPDX identifier - ![blue](https://placehold.it/15/5dade2/000000?text=+)
+- Crate with 1 license - ![white](https://placehold.it/15/717d7e/000000?text=+)
+- Crate with 2 or more licenses - ![yellow](https://placehold.it/15/f1c40f/000000?text=+)
+- Crate with 0 licenses - ![yellow](https://placehold.it/15/e74c3c/000000?text=+)
 
 ### `-l, --layout`
 
 The layout of the output. Does not apply to the `tsv` format.
 
-* `license` (default) - Each license acts as the key, and the values are all of the crates that use that license
-* `crate` - Each crate is a key, and the values are the list of licenses it uses.
+- `license` (default) - Each license acts as the key, and the values are all of the crates that use that license
+- `crate` - Each crate is a key, and the values are the list of licenses it uses.
 
 ### `-t, --threshold`
 
 The confidence threshold required for assigning a license identifier to a license text file. See the [license configuration](../checks/licenses/cfg.md#the-confidence-threshold-field-optional) for more information.
 
-* `layout = license, format = human` (default)
+- `layout = license, format = human` (default)
 
 ![Imgur](https://i.imgur.com/Iejfc7h.png)
 
-* `layout = crate, format = human`
+- `layout = crate, format = human`
 
 ![Imgur](https://i.imgur.com/zZdcFXI.png)
 
-* `layout = license, format = json`
+- `layout = license, format = json`
 
 ![Imgur](https://i.imgur.com/wC2R0ym.png)
 
-* `layout = license, format = tsv`
+- `layout = license, format = tsv`
 
 ![Imgur](https://i.imgur.com/14l8a5K.png)