When the breaking change lives inside vendored code, the flip commit in your repository is only the messenger. crux identifies the dependency, its version transition, and where possible the upstream commits behind it.

local evidence

Files under vendor/, third_party/, deps/, extern/ or node_modules/ trigger manifest reads at both the parent & flip commits. A vendored crate reports its name & version from Cargo.toml at each revision. A Cargo.lock diff gets parsed for package version transitions, including the case where package names appear only as shared context lines between changed blocks. Output:

dependency: libc [vendored-crate] 0.1.0 -> 0.2.0
  upstream: https://github.com/example/libc

upstream attribution

With --upstream-deep, crux resolves the old & new version tags on the repository URL declared in the manifest, clones the upstream repo blobless, and lists the commits between the 2 tags. That's the honest form of cross-repo blame: the history you inherited, listed. Tags don't resolve or the network is down, and it prints that attribution was unavailable. A version bump alone is never reported as an upstream cause.