feat: `-Zmin-publish-age` (RFC 3923) by weihanglo · Pull Request #17012 · rust-lang/cargo

weihanglo · 2026-05-19T14:50:27Z

What does this PR try to resolve?

This implements RFC 3923 min-publish-age (rust-lang/rfcs#3923, #17009).

The policy lives entirely at the resolver layer. A PublishAgePolicy is built before resolution and applied wherever a version filer needs to be applied

Where the filter is applied

Because the policy is enforced in the resolver, every code path that selects a version outside the resolver must apply it explicitly. Full audit:

Site	Kind	Filtered?
resolver (`dep_cache::query`)	selects (resolution)	yes
`cargo add` (`get_latest_dependency`)	selects (writes `Cargo.toml`)	yes
`cargo add` path/git (`select_package`)	non-registry source	no
`cargo add` features (`populate_available_features`)	enumerates features only	no
`cargo install` (`select_dep_pkg`)	selects (install target)	no
`cargo update --breaking` (`upgrade_dependency`)	selects (writes `Cargo.toml`)	no
`cargo update` report (`report_latest`)	displays "available: vX"	no
future-incompat (`get_updates`)	displays "newer versions"	no
`cargo info` (`query_summaries`)	displays	no

How to test and review this PR?

25+ tests in tests/testsuite/min_publish_age.rs cover:

feature gate + ignored-config warnings
deny/allow logic and "0" disabling
per-registry config precedence
lockfile and [patch] preservation of too-new versions
cargo install / cargo add selection paths

Open questions

The registry.min-publish-age / registries.min-publish-age precedence rule
- feat: -Zmin-publish-age (RFC 3923) #17012 (comment)
cargo install behavior (there were some miscommunication in the RFC)
- feat: -Zmin-publish-age (RFC 3923) #17012 (comment)
cargo update --breaking behavior
- feat: -Zmin-publish-age (RFC 3923) #17012 (comment)
More help context needs to be added, though currently it is awkward to add
- feat: -Zmin-publish-age (RFC 3923) #17012 (comment)
- feat: -Zmin-publish-age (RFC 3923) #17012 (comment)

rustbot · 2026-05-19T14:50:35Z

r? @epage

rustbot has assigned @epage.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: @ehuss, @epage, @weihanglo
@ehuss, @epage, @weihanglo expanded to ehuss, epage, weihanglo
Random selection from ehuss, epage

weihanglo · 2026-05-19T14:59:25Z

Found something wrong. Wait a sec.

weihanglo · 2026-05-19T14:52:06Z

    }
 }

+fn warn_unused_min_publish_age(gctx: &GlobalContext) -> CargoResult<()> {


We warn all unused min-publish-age all at once, regardless of the precedence rule.

View changes since the review

clouatre

The largest=Day, smallest=Minute rounding produces output like published 2d 8h 23m ago. Suggest simplifying to a single unit based on magnitude: >= 2 days rounds to nearest day (published 3 days ago), < 2 days rounds to nearest hour (published 11 hours ago). The sub-day precision is noise at the day scale and the user cannot act on the minutes component.

For context: we currently enforce this in CI with a bash script that diffs Cargo.lock against the base branch and calls the crates.io API to check publish timestamps on net-new crates. This feature would replace that entirely. The error message is the main user-facing surface, so getting the formatting right matters.

View changes since this review

weihanglo

This revision:

Addressed lockfile change reporting issue to also "report_too_new".
Preserve the raw min-publish-age config for later display, and encapsulate it inside a PublishAgeViolation struct, so that we don't need to reformat the min-age config/

View changes since this review

Also warn when `-Zmin-publish-age` is absent

The juicy part is `PublishAgePolicy::too_new`

Implement the `-Zmin-publish-age` filter at the resolver layer. The resolver filters out versions that are too new, unless pinned by a lock file or a `[patch]` entry.

When resolution fails because every candidate is newer than the configured `min-publish-age`, report "version X is too new (published N ago)" instead of the generic "version X is unavailable". The display format is rounded to a single unit like `published 3 days ago` / `published 11 hours ago` instead of a multi-unit span like `2d 8h 23m ago`, because sub-day precision is noisy

annotate the `(available: vX)` status line with `, published N ago`. This mirrors the existing `, requires Rust X` MSRV note

Only `cargo install --path` is affected

Since policy is now in resolver layer, any query doesn't use resolver should enforce the policy if needed. `cargo add` is one of these places.

epage

Thanks!

I'm assuming you will transfer the Open/Deferred to the tracking issue.

View changes since this review

Update cargo submodule 8 commits in 598ab48ec328e3e4f5e4e373d8df7264bc8e27cd..71e52e6ef695518c3a7d166fdde0dc3650c2fedd 2026-06-17 02:39:50 +0000 to 2026-06-19 16:23:18 +0000 - chore(deps): update msrv to v1.94 (rust-lang/cargo#17121) - test(update): show cross-registry multi-spec precise (rust-lang/cargo#17119) - fix(resolver): hint how to resolve too-new versions (rust-lang/cargo#17118) - fix(add): list too-new versions and how to override (rust-lang/cargo#17117) - feat: `-Zmin-publish-age` (RFC 3923) (rust-lang/cargo#17012) - feat(diag): Support `build.warnings` for cargo lints (rust-lang/cargo#17112) - Remove windows-sys dependencies older than 0.61 (rust-lang/cargo#17115) - fix(install): Run cargo lints like rustc lints (rust-lang/cargo#17107) r? ghost

Update cargo submodule 9 commits in 598ab48ec328e3e4f5e4e373d8df7264bc8e27cd..a595d0da21f228b7fdae64d3d5c0e527ea66bb59 2026-06-17 02:39:50 +0000 to 2026-06-20 13:42:59 +0000 - fix(host-config): dont apply target config to host artifacts (rust-lang/cargo#17123) - chore(deps): update msrv to v1.94 (rust-lang/cargo#17121) - test(update): show cross-registry multi-spec precise (rust-lang/cargo#17119) - fix(resolver): hint how to resolve too-new versions (rust-lang/cargo#17118) - fix(add): list too-new versions and how to override (rust-lang/cargo#17117) - feat: `-Zmin-publish-age` (RFC 3923) (rust-lang/cargo#17012) - feat(diag): Support `build.warnings` for cargo lints (rust-lang/cargo#17112) - Remove windows-sys dependencies older than 0.61 (rust-lang/cargo#17115) - fix(install): Run cargo lints like rustc lints (rust-lang/cargo#17107)

rustbot assigned epage May 19, 2026

weihanglo marked this pull request as draft May 19, 2026 14:58

rustbot removed the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label May 19, 2026

weihanglo force-pushed the min-publish-age branch 2 times, most recently from 2477e6c to bc3e9c0 Compare May 19, 2026 15:24

weihanglo commented May 19, 2026

View reviewed changes

weihanglo mentioned this pull request May 19, 2026

refactor: drop yanked_whitelist from source loading #17014

Merged

weihanglo force-pushed the min-publish-age branch 2 times, most recently from 1ea1f55 to ddba374 Compare May 19, 2026 15:43

clouatre reviewed May 19, 2026

View reviewed changes

weihanglo commented Jun 18, 2026

View reviewed changes

Comment thread src/cargo/ops/cargo_update.rs

weihanglo marked this pull request as ready for review June 18, 2026 04:06

rustbot added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Jun 18, 2026

weihanglo added 11 commits June 18, 2026 00:42

test: -Zmin-publish-age (RFC 3923)

ffbf00a

feat(config): resolver.incompatible-publish-age

3126b88

Also warn when `-Zmin-publish-age` is absent

fix: warn if -Zmin-publish-age is not used

a3d392b

feat(resolver): add PublishAgePolicy

b1091a4

The juicy part is `PublishAgePolicy::too_new`

feat(resolver): filter versions newer than min-publish-age

10c6aea

Implement the `-Zmin-publish-age` filter at the resolver layer. The resolver filters out versions that are too new, unless pinned by a lock file or a `[patch]` entry.

fix(resolver): note configured min age in error message

f33780f

fix(update): note publish age on held-back versions

f736672

annotate the `(available: vX)` status line with `, published N ago`. This mirrors the existing `, requires Rust X` MSRV note

fix(install): cargo install ignores min-publish-age

09d1e1d

Only `cargo install --path` is affected

fix(add): filter versions newer than min-publish-age

54f0c1b

Since policy is now in resolver layer, any query doesn't use resolver should enforce the policy if needed. `cargo add` is one of these places.

docs: -Zmin-publish-age (RFC 3923)

a49ee42

weihanglo force-pushed the min-publish-age branch from 50f1812 to a49ee42 Compare June 18, 2026 04:42

epage approved these changes Jun 18, 2026

View reviewed changes

epage added this pull request to the merge queue Jun 18, 2026

Merged via the queue into rust-lang:master with commit b5a4cd4 Jun 18, 2026
29 checks passed

rustbot removed the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Jun 18, 2026

This was referenced Jun 18, 2026

fix: stabilize -Zrustdoc-depinfo #17020

Open

feat: Add -Zhint-msrv flag #17106

Merged

harryzcy mentioned this pull request Jun 19, 2026

Enforce min-publish-age harryzcy/artifact-store#962

Open

weihanglo deleted the min-publish-age branch June 19, 2026 17:15

weihanglo mentioned this pull request Jun 20, 2026

Update cargo submodule rust-lang/rust#158164

Merged

rustbot added this to the 1.98.0 milestone Jun 20, 2026

weihanglo linked an issue Jun 25, 2026 that may be closed by this pull request

Minimum age for dependencies #15973

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: `-Zmin-publish-age` (RFC 3923)#17012

feat: `-Zmin-publish-age` (RFC 3923)#17012
epage merged 17 commits into
rust-lang:masterfrom
weihanglo:min-publish-age

weihanglo commented May 19, 2026 •

edited

Loading

Uh oh!

rustbot commented May 19, 2026

Uh oh!

weihanglo commented May 19, 2026

Uh oh!

Uh oh!

weihanglo May 19, 2026 •

edited by rustbot

Loading

Uh oh!

Uh oh!

clouatre left a comment •

edited by rustbot

Loading

Uh oh!

weihanglo left a comment •

edited by rustbot

Loading

Uh oh!

Uh oh!

epage left a comment •

edited by rustbot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

weihanglo commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR try to resolve?

Where the filter is applied

How to test and review this PR?

Open questions

Uh oh!

rustbot commented May 19, 2026

Uh oh!

weihanglo commented May 19, 2026

Uh oh!

Uh oh!

weihanglo May 19, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

clouatre left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

weihanglo left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

epage left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

weihanglo commented May 19, 2026 •

edited

Loading

weihanglo May 19, 2026 •

edited by rustbot

Loading

clouatre left a comment •

edited by rustbot

Loading

weihanglo left a comment •

edited by rustbot

Loading

epage left a comment •

edited by rustbot

Loading