Cargo has the tools to do this properly, but in practice it's still a bit of a mess. Firefox was building half a dozen barely-different versions of libraries from different dependency chains, though someone eventually deduped most of these by hand.

Additionally, the Rust community has a propensity (from what I've seen) to ship dependencies on v0.x.y libraries. I mean, just look at the version numbers on https://crates.io/! Below v1.0.0, otherwise-minor sem-ver updates are breaking, and can't be de-duplicated. (0.6 is breaking from 0.5, though Cargo does allow 0.6.1 from 0.6.0 upgrades)