[pknopf]

Package managers that use git are less prone to this kinda of attack (goland, rust).

[steveklabnik]

Cargo does not “use git.”

[3836293648]

Cargo absolutely uses git, or else we wouldn't've had that thing where setting it to use the cli git instead of some reimplementation lead to massive speedups

[AnyTimeTraveler]

What they meant was probably, that you have the option to rely entirely on using git repositories for your dependencies or even just paths to other projects on your disk.

You can also setup your own dependency registry and only work with that.