chore(cargo): enforce 14-day min-publish-age for crates.io deps - #183
Conversation
This prevents the resolver from selecting crates.io releases published within the last 14 days unless they are already locked. It matches the organization’s Dependabot cooldown. The [unstable] table is temporary until Rust 1.100.
🔒 AI Security Review (claude-opus-5)✅ No security issues found. |
deny is cargo's default, but a user-level ~/.cargo/config.toml with "allow" would otherwise switch the cooldown off for this repo. The repo config wins over the home config, while the CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE environment variable still overrides both for one-off updates. Suggested by Robin.
🔒 AI Security Review (claude-opus-5)✅ No security issues found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 73edae1ba4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [unstable] | ||
| min-publish-age = true | ||
|
|
||
| [registry] | ||
| global-min-publish-age = "14 days" |
There was a problem hiding this comment.
The workspace still pins nightly-2026-07-01 in rust-toolchain.toml, whose Cargo predates the min-publish-age implementation. Cargo silently accepts unknown entries under [registry], so this setting is inert with the repository toolchain and cargo update can still resolve a freshly published crate; the missing expected age suffix in the recorded dry run is consistent with that. Bump the pinned nightly to a release containing the feature (or defer this config) before relying on it as a supply-chain control.
Useful? React with 👍 / 👎.
2 participants
Description
Adds a 14-day cooldown for crates.io dependencies through Cargo's new
min-publish-agesetting (RFC 3923), in a root.cargo/config.toml:Dependabot already waits 14 days before proposing a bump. This makes plain
cargo add,cargo update, and hand-edited version requirements follow the same rule, so a freshly published (and possibly compromised) release can't slip in through a developer's PR. Versions already inCargo.lockare left alone. For an urgent fix there is a one-off escape hatch:This repo pins a nightly that already has the feature, so the cooldown is active right away for anyone building with the repo toolchain.
Tracking: STR-3852.
Update: a follow-up commit also sets
[resolver] incompatible-publish-age = "deny". That is cargo's default, but spelling it out in the repo config means a developer withallowin their user-level~/.cargo/config.tomlno longer switches the cooldown off here. TheCARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allowescape hatch still works, since environment variables take precedence over both. Robin's suggestion from the Slack thread.Type of Change
Notes to Reviewers
One gap worth knowing about: versions already in
Cargo.lockare exempt by design, so a lockfile produced with the override still passescargo build --lockedin CI. If we want CI to catch that,cargo update --dry-runprints aDowngradingline for every locked version that violates the policy and can be turned into a check. That is out of scope for this PR.The
[unstable]table is temporary. Stable cargo ignores it, and nightly cargo needs it until the feature reaches stable in Rust 1.100 (2026-11-12). After that it can be dropped.Verified locally with
cargo update --dry-run --workspace:AI disclosure: the change and this PR body were produced with Claude Code and Codex, then reviewed and tested by me.
Is this PR addressing any specification, design doc or external reference document?
If yes, please add relevant links:
Checklist
Related Issues
STR-3852