chore(cargo): enforce 14-day min-publish-age for crates.io deps - #2
Conversation
This prevents newly published crates.io versions from being selected for 14 days. It matches the organization’s Dependabot cooldown. The `[unstable]` table is temporary until Rust 1.100.
|
@robin-alpen could you review? I could not request reviewers on this repo through the API, so tagging here instead. One thing to know: the root |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 243ebe1d06
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
deny is cargo's default, but a user-level ~/.cargo/config.toml with "allow" would otherwise switch the cooldown off for this repo. The repo config wins over the home config, while the CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE environment variable still overrides both for one-off updates. Suggested by Robin.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6bb1e81e71
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [registry] | ||
| global-min-publish-age = "14 days" |
There was a problem hiding this comment.
This root-only configuration is not available to the production image builds: the reusable Docker workflow sets the build context to each service directory (.github/workflows/_docker-build-push.yml:99), so those cargo chef cook/cargo build invocations cannot read /.cargo/config.toml. Consequently, whenever such a build needs to regenerate or update a lockfile (for example, after a manifest/lockfile mismatch), it can resolve a newly published crate despite this setting; pass the config into those contexts or enforce the policy in the builder image/workflow.
Useful? React with 👍 / 👎.
2 participants
Description
Adds a 14-day cooldown for crates.io dependencies through Cargo's new
min-publish-agesetting (RFC 3923), in a root.cargo/config.toml:Dependabot already waits 14 days before proposing a bump. This makes plain
cargo add,cargo update, and hand-edited version requirements follow the same rule, so a freshly published (and possibly compromised) release can't slip in through a developer's PR. Versions already inCargo.lockare left alone. For an urgent fix there is a one-off escape hatch:There is no toolchain pin in this repo. On a nightly from 2026-06-21 or later the cooldown is active. On stable, cargo prints a one-line warning and enforces nothing until Rust 1.100 ships on 2026-11-12.
Tracking: STR-3852.
Update: a follow-up commit also sets
[resolver] incompatible-publish-age = "deny". That is cargo's default, but spelling it out in the repo config means a developer withallowin their user-level~/.cargo/config.tomlno longer switches the cooldown off here. TheCARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allowescape hatch still works, since environment variables take precedence over both. Robin's suggestion from the Slack thread.Type of Change
Notes to Reviewers
One gap worth knowing about: versions already in
Cargo.lockare exempt by design, so a lockfile produced with the override still passescargo build --lockedin CI. If we want CI to catch that,cargo update --dry-runprints aDowngradingline for every locked version that violates the policy and can be turned into a check. That is out of scope for this PR.The
[unstable]table is temporary. Stable cargo ignores it, and nightly cargo needs it until the feature reaches stable in Rust 1.100 (2026-11-12). After that it can be dropped.Verified locally with
cargo update --dry-run --workspace:AI disclosure: the change and this PR body were produced with Claude Code and Codex, then reviewed and tested by me.
Is this PR addressing any specification, design doc or external reference document?
If yes, please add relevant links:
Checklist
Related Issues
STR-3852