When operating on a Rust project the analyser will load the dependencies from the lock file, so if a lock is missing, this will be generated using “cargo generate-lock”. The analyser may also use directly the "cargo" command in order to collect more information for certain dependencies.