From d3a99dbf54a15b8141341792f9027aa616ddd831 Mon Sep 17 00:00:00 2001
From: Jose Storopoli <jose@storopoli.com>
Date: Wed, 2 Sep 2026 07:06:45 -0300
Subject: [PATCH] chore(cargo): enforce 14-day min-publish-age for crates.io
 deps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This prevents the resolver from selecting crates.io releases published within the last 14 days unless they are already locked. It matches the organization’s Dependabot cooldown. The [unstable] opt-in is temporary until Rust 1.100.
---
 .cargo/config.toml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 .cargo/config.toml

diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..e6e617d
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,13 @@
+# Cooldown for crates.io dependencies (RFC 3923, `min-publish-age`).
+# Versions published less than 14 days ago are not selected by the resolver
+# unless they are already in `Cargo.lock`. Matches the Dependabot cooldown.
+# Urgent override for a single resolve:
+#   CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p <crate>
+
+# Stable cargo ignores this table. Nightly cargo needs it until the feature
+# is stable (Rust 1.100, 2026-11-12); remove it once the toolchain has it.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"