From ff5f80421c1165b70d1391a99955ed7f5790bc0b Mon Sep 17 00:00:00 2001
From: Jose Storopoli <jose@storopoli.com>
Date: Wed, 2 Sep 2026 07:07:17 -0300
Subject: [PATCH] chore(cargo): enforce 14-day min-publish-age for crates.io
 deps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cargo excludes crates.io versions published less than 14 days ago unless they are already locked. This matches the organization’s Dependabot cooldown. The [unstable] table is temporary until Rust 1.100.
---
 .cargo/config.toml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 .cargo/config.toml

diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 00000000..e6e617dd
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,13 @@
+# Cooldown for crates.io dependencies (RFC 3923, `min-publish-age`).
+# Versions published less than 14 days ago are not selected by the resolver
+# unless they are already in `Cargo.lock`. Matches the Dependabot cooldown.
+# Urgent override for a single resolve:
+#   CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p <crate>
+
+# Stable cargo ignores this table. Nightly cargo needs it until the feature
+# is stable (Rust 1.100, 2026-11-12); remove it once the toolchain has it.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"