I recently came across the cargo-deny tool, which can be used to keep dependencies under control. I think they have grown quite a bit and, by looking at Cargo.lock there seem to be some duplicates, so it seems like using this tool in CI would be very useful.