feat(resolver): Stabilize min-publish-age by epage · Pull Request #17335 · rust-lang/cargo

epage · 2026-08-07T20:04:56Z

What does this PR try to resolve?

To ensure dependencies have had a chance to be scanned, a user can set:

[registry]
global-min-publish-age = "7 days"

To force a critical update through, a user can

$ CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p foo

That will be preserved within the lockfile.

To ensure users can observe what is going on and address concerns,

Locking messages notify of:
- That min-publish-age is in use and what the age is if there is a single one
- a newer, unpicked version is available and its age
- a version is being used that is incompatible with min-publish-age (either through allow or an unchange dep shown through -v)
Error messages notify of:
- a newer, unpicked version is available and its age
- a compatible version requirement to downgrade to
- how to use CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE

Fixes #17009

How to test and review this PR?

Items from the tracking issue:

deny precedence between this and incompatible-rust-version: we can always adjust this over time
cargo install behavior
- there was some confusion over what was being stabilized due to edits that happened during the FCP that weren't noticed
- resolver is defined as not affecting cargo install which this preserves, just like incompatible-rust-version
cargo update --breaking: this feature is being stabilized first and the other is being considered for removal (fix(update)!: Remove unstable --breaking #17333)

rustbot · 2026-08-07T20:05:02Z

r? @weihanglo

rustbot has assigned @weihanglo.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: @epage, @weihanglo
@epage, @weihanglo expanded to epage, weihanglo

weihanglo · 2026-08-07T20:24:13Z

Before diving into other aspects of the stabilization, have we got any feedback for this using in CI / production?

View changes since the review

Not that I know of.

As identified at rust-lang#17335 (comment)

### What does this PR try to resolve? As identified at rust-lang#17335 (comment) ### How to test and review this PR?

# `[registry]` vs `[registries.<name>]` per-key semantics Review notes for [rust-lang#17335] (min-publish-age stabilization), comparing how each config key behaves across the two tables. Verified against PR head `7b009184` with repro tests in `tests/testsuite/registry_table_confusion.rs` and the PR's own `tests/testsuite/min_publish_age.rs`. [rust-lang#17335]: rust-lang#17335 (comment) | Key | `[registry]` | `[registries.crates-io]` | `[registries.<alt>]` | Evidence | |---|---|---|---|---| | `token` | works for crates.io; does **not** follow `registry.default` | **silently ignored** (config and `CARGO_REGISTRIES_CRATES_IO_TOKEN` env) | works | `registries_crates_io_token_ignored_for_crates_io`, `registry_token_does_not_follow_registry_default` | | `credential-provider` | works for crates.io | **silently ignored** | works | `registries_crates_io_credential_provider_ignored` | | `secret-key` / `secret-key-subject` | works for crates.io | silently ignored (same code path as `token`) | works | code: `src/util/auth/mod.rs:212` returns `[registry]` for crates.io before any name lookup | | `min-publish-age` (new) | crates.io only; ignored for alt registries even with `registry.default` pointing at them | **honored; overrides `registry.min-publish-age`** | honored | `registry_alt_ignores_min_publish_age`, `registries_crates_io_overrides_registry_default` | | `global-min-publish-age` (new) | fallback for **all** registries | silently ignored (not a `RegistryConfig` field) | silently ignored | code: `src/context/schema.rs:530` | | `protocol` | silently ignored (not a `GlobalRegistryConfig` field) | honored | parsed but unused (`_protocol`) | code: `SourceId::crates_io_is_sparse` reads `registries.crates-io.protocol` only | | `index` | hard error: "no longer supported" | silently ignored (`SourceId::alt_registry` short-circuits `crates-io`) | required; defines the registry | code: `check_registry_index_not_set`, `src/workspace/source_id.rs:296` | | `default` | selects target registry for `publish`/`login`/`owner`/`yank` when `--registry`/`--index` absent | silently ignored | n/a | code: `src/util/command_prelude.rs:919` | | `global-credential-providers` | fallback providers for **all** registries | silently ignored | silently ignored | code: `src/util/auth/mod.rs:57` | Key asymmetries: * `min-publish-age` is the first key where `[registries.crates-io]` both works and overrides its `[registry]` counterpart; for the auth keys, `[registries.crates-io]` is dead config. * Auth resolves crates.io **by URL first** (`is_crates_io()`, `src/util/auth/mod.rs:212`); min-publish-age resolves **by name first** (`alt_registry_key()`, `src/resolver/version_prefs.rs:279`). A named mirror of crates.io's index gets `[registry]` credentials but `registries.<mirror>.min-publish-age`. * `registries.<name>.global-min-publish-age` and `registry.protocol` are silent no-ops — the same "subtle `s` distinction" concern raised in [rust-lang#12334](rust-lang#12334 (comment)).

weihanglo · 2026-08-12T19:13:43Z

@rfcbot fcp merge T-cargo

This stabilizes rust-lang/rfcs#3923 the min-publish-age. See the PR description for details.

Drifts from the RFC:

registry.min-publish-age is removed. There are confusion between [registry] and [registries.crates-io] tables and to avoid adding more things onto the confusions, we defer the field.
cargo install not respecting min-publish-age. There was a miscommunication in the RFC over what was being stabilized due to edits that happened during the FCP that weren't noticed. [resolver] is defined as not affecting cargo install which this preserves, just like incompatible-rust-version.

rust-rfcbot · 2026-08-12T19:13:47Z

@weihanglo has proposed to merge this. The next step is review by the rest of the tagged team members:

No concerns currently listed.

Once a majority of reviewers approve (and at most 2 approvals are outstanding), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for info about what commands tagged team members can give me.

To ensure dependencies have had a chance to be scanned, a user can set: ```toml [registry] global-min-publish-age = "7 days" ``` To force a critical update through, a user can ```console $ CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p foo ``` That will be preserved within the lockfile. To ensure users can observe what is going on and address concerns, - Locking messages notify of: - That min-publish-age is in use and what the age is if there is a single one - a newer, unpicked version is available and its age - a version is being used that is incompatible with min-publish-age (either through `allow` or an unchange dep shown through `-v`) - Error messages notify of: - a newer, unpicked version is available and its age - a compatible version requirement to downgrade to - how to use `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE` Items from the tracking issue: - `deny` precedence between this and `incompatible-rust-version`: we can always adjust this over time - the `registry.min-publish-age` / `registries.*.min-publish-age` precedence rule: mimics credential providers - `cargo install` behavior - there was some confusion over what was being stabilized due to edits that happened during the FCP that weren't noticed - `resolver` is defined as not affecting `cargo install` which this preserves, just like `incompatible-rust-version` - `cargo update --breaking`: this feature is being stabilized first and the other is being considered for removal (rust-lang#17333) Fixes rust-lang#17009

rustbot · 2026-08-13T18:28:07Z

This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

rustbot assigned weihanglo Aug 7, 2026

weihanglo reviewed Aug 7, 2026

View reviewed changes

weihanglo reviewed Aug 10, 2026

View reviewed changes

Comment thread doc/book/src/reference/config.md Outdated

weihanglo reviewed Aug 10, 2026

View reviewed changes

Comment thread doc/book/src/reference/config.md

epage mentioned this pull request Aug 10, 2026

docs(ref): Add missing config env variables #17345

Merged

epage force-pushed the min-publish-age branch from acbbbcc to 7b00918 Compare August 10, 2026 19:29

This comment has been minimized.

Sign in to view

weihanglo mentioned this pull request Aug 10, 2026

chore(renovate): Use a 3day minimum release age #17346

Merged

This comment has been minimized.

Sign in to view

pull Bot pushed a commit to Mattlk13/cargo that referenced this pull request Aug 10, 2026

docs(ref): Add missing config env variables

f49eeff

As identified at rust-lang#17335 (comment)

pull Bot pushed a commit to Mattlk13/cargo that referenced this pull request Aug 10, 2026

docs(ref): Add missing config env variables (rust-lang#17345)

b3c8bf8

### What does this PR try to resolve? As identified at rust-lang#17335 (comment) ### How to test and review this PR?

weihanglo mentioned this pull request Aug 11, 2026

[registry] vs [registries] per-key semantics weihanglo/cargo#100

Closed

weihanglo added the T-cargo Team: Cargo label Aug 12, 2026

epage force-pushed the min-publish-age branch from 7b00918 to 4ac338d Compare August 12, 2026 19:06

This comment has been minimized.

Sign in to view

rust-rfcbot added proposed-final-comment-period An FCP proposal has started, but not yet signed off. disposition-merge FCP with intent to merge labels Aug 12, 2026

epage force-pushed the min-publish-age branch from 4ac338d to 29e62c3 Compare August 12, 2026 20:35

This comment has been minimized.

Sign in to view

epage force-pushed the min-publish-age branch from 29e62c3 to 83f7820 Compare August 13, 2026 18:28

Navigation Menu

Uh oh!

Uh oh!

feat(resolver): Stabilize min-publish-age - #17335

feat(resolver): Stabilize min-publish-age#17335
epage wants to merge 1 commit into
rust-lang:masterfrom
epage:min-publish-age

epage commented Aug 7, 2026 •

edited by weihanglo

Loading

Uh oh!

rustbot commented Aug 7, 2026

Uh oh!

weihanglo Aug 7, 2026 •

edited by rustbot

Loading

Uh oh!

epage Aug 7, 2026

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

weihanglo commented Aug 12, 2026

Uh oh!

rust-rfcbot commented Aug 12, 2026 •

edited by joshtriplett

Loading

Uh oh!

This comment has been minimized.

rustbot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

epage commented Aug 7, 2026 • edited by weihanglo Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR try to resolve?

How to test and review this PR?

Uh oh!

rustbot commented Aug 7, 2026

Uh oh!

weihanglo Aug 7, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

epage Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

weihanglo commented Aug 12, 2026

Uh oh!

rust-rfcbot commented Aug 12, 2026 • edited by joshtriplett Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

rustbot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

epage commented Aug 7, 2026 •

edited by weihanglo

Loading

weihanglo Aug 7, 2026 •

edited by rustbot

Loading

rust-rfcbot commented Aug 12, 2026 •

edited by joshtriplett

Loading