`Cargo.lock` is a lockfile machine generated by Cargo. It's similar to package-lock.json. In any case, its machine generated the old fashioned way.

I am fully aware what Cargo.lock is. What I am surprised at is how many dependencies there are.