Sorry, I meant the author and license of e.g. this dependency of regex: https://crates.io/crates/aho-corasick
I'm sure the Rust team knows and trusts these (or they even are Rust team members), but how should outsiders know this?
Researching trustworthiness of individual authors, getting approval for different licenses, tracking and updating required notices in documentation etc. for every single dependency transitively(!) seriously takes a lot of effort. Updating dependencies that switch sub-(sub-...)-dependencies freely can turn from a simple cargo command into a month of work. A big standard library (or an equivalent construct) can really save the day there.
> The guarantees aren't advertised, they're known.
It is known. -- Jhiqui
Glad to hear improving this is in the works anyway.
https://crates.io/crates/regex
(Regex moved out of the nursery a while back)
The nursery is more of a "These crates are officially blessed and we wish to make them part of rust-lang, unless the community comes up with something better".
The guarantees aren't advertised, they're known. We can do a better job of advertising this, some of the work this year is related to that.