From aebfb49488d8b4836a33d3fec02db562ba5b029b Mon Sep 17 00:00:00 2001
From: Jose Storopoli <jose@storopoli.com>
Date: Wed, 2 Sep 2026 07:07:34 -0300
Subject: [PATCH 1/2] chore(cargo): enforce 14-day min-publish-age for
 crates.io deps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This prevents the resolver from selecting crates.io releases published within the last 14 days unless they are already locked. It matches the organization’s Dependabot cooldown. The [unstable] table is temporary until Rust 1.100.
---
 .cargo/config.toml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 .cargo/config.toml

diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..e6e617d
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,13 @@
+# Cooldown for crates.io dependencies (RFC 3923, `min-publish-age`).
+# Versions published less than 14 days ago are not selected by the resolver
+# unless they are already in `Cargo.lock`. Matches the Dependabot cooldown.
+# Urgent override for a single resolve:
+#   CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p <crate>
+
+# Stable cargo ignores this table. Nightly cargo needs it until the feature
+# is stable (Rust 1.100, 2026-11-12); remove it once the toolchain has it.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"

From 73edae1ba4eb5b6e2c8ebe59538729efd6f2814b Mon Sep 17 00:00:00 2001
From: Jose Storopoli <jose@storopoli.com>
Date: Wed, 2 Sep 2026 19:25:12 -0300
Subject: [PATCH 2/2] chore(cargo): set incompatible-publish-age to deny
 explicitly

deny is cargo's default, but a user-level ~/.cargo/config.toml with
"allow" would otherwise switch the cooldown off for this repo. The repo
config wins over the home config, while the
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE environment variable still
overrides both for one-off updates. Suggested by Robin.
---
 .cargo/config.toml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index e6e617d..d8d2edf 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -11,3 +11,9 @@ min-publish-age = true
 
 [registry]
 global-min-publish-age = "14 days"
+
+# Reject too-new versions even when a user-level cargo config sets "allow".
+# The CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE environment variable still
+# overrides this for one-off updates.
+[resolver]
+incompatible-publish-age = "deny"