Hi, thanks for maintaining node-rs! We ship `@node-rs/argon2` (specifically the `-darwin-arm64` prebuilt) inside a desktop application, and as part of open-source license compliance we need to list the copyright and license notices of all Rust crates statically linked into the published `.node` binary. Currently this is hard to do accurately, because: - The repository does not commit `Cargo.lock` (and CI does not build with `--locked`), so the exact transitive crate versions used for a given published binary are not recorded anywhere. - The npm packages have provenance attestations (thanks for that!), which pins the source commit — but regenerating a lockfile from that commit today resolves different versions than the ones actually linked (e.g. the published `argon2-darwin-arm64@2.0.2` binary embeds `napi-3.0.0-alpha.22`, while a fresh resolution picks a much newer napi). - The prebuilt npm package contains only the project's own LICENSE, not the third-party crate notices. We completely understand if you prefer to keep `Cargo.lock` out of version control — that has long been common practice for library crates, and we're not questioning it. Our ask is only about the published prebuilt binaries: any record of the dependency set that went into them (in whatever form is most convenient for you) would be a big help for downstream license compliance. (For reference, Cargo's defaults changed in August 2023 — rust-lang/cargo#12382 — to check in `Cargo.lock` by default; but every option below works equally well for us, and the last one avoids committing a lockfile entirely.) Would you consider any of the following? Any one of them would make downstream compliance much more reliable: 1. **Commit `Cargo.lock`** and build releases with `--locked` (also improves build reproducibility), or 2. **Build release binaries with [`cargo auditable`](https://github.com/rust-secure-code/cargo-auditable)**, which embeds the exact dependency list into the binary at negligible size cost (this also enables `cargo audit bin` for security scanning), or 3. **Bundle a generated third-party license file** (e.g. via [`cargo-about`](https://github.com/EmbarkStudios/cargo-about)) in the prebuilt npm packages, or 4. If you'd rather not commit a lockfile at all: generate one in CI, build with `--locked`, and **attach that `Cargo.lock` as a release/CI artifact** — that equally records what shipped. Happy to provide more details about our use case if helpful. Thanks!