docs: always suggest using --locked with "cargo install"

Otherwise the lockfile is completely ignored as <https://doc.rust-lang.org/cargo/commands/cargo-install.html#dealing-with-the-lockfile> says "By default, the Cargo.lock file that is included with the package will be ignored." Mostly a reaction to <https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/>
2026-10-03 03:30:36 +03:00 · 2026-08-20 16:00:15 +00:00
parent 357c6e74d5
commit f09f8fd8a4
4 changed files with 4 additions and 4 deletions
@@ -167,7 +167,7 @@ $ cargo test -- --ignored

 Install [`cargo-bolero`](https://github.com/camshaft/bolero) with
 ```sh
-$ cargo install cargo-bolero
+$ cargo install --locked cargo-bolero
 ```

 Run fuzzing tests with