Yeah, I just usually shell out to cargo metadata to get a string, and then do a string search therein. Another hack is that, to get version from Cargo.toml, I shell out to cargo pkgid. If cargo contained some plumbing commands so that I can run cargo metadata --query "dependencies" and get result as a list of strings, that would simplify a bunch of tasks.
Alternatively, I am fairly certain that it's possible to implement a version of https://docs.rs/cargo_metadata/latest/cargo_metadata/ which is massively more lightweight, by not depending on serde ecosystem, and just pre-generating all parsing code for a fixed structure it has to deal with.
That... actually I think is a project the ecosystem could benefit quite a bit I think.