I think I’ve noticed that cargo install would pick up newer semver-compatible versions than what was in the lockfile unless I passed —-locked explicitly, which seemed surprising to me.
Both behaviors can be surprising. We picked one. It happens. I am not sure myself if it was the right choice or not.