Repository navigation
chore: switch cargo deps-age gate to native when -Zmin-publish-age stabilizes #225
Description
Goal
Drop the Dependabot-side cooldown: { default-days: 7 } workaround for cargo and switch to native crate-version-age enforcement (-Zmin-publish-age / RFC 3923) once it lands on Rust stable.
Background
For supply-chain defense, every dep update must be ≥7 days old before being pulled into this project. As of 2026-07-19:
- npm — handled natively by
.npmrcmin-release-age=7(npm help install). - Dependabot-driven cargo bumps — handled by
cooldown: { default-days: 7 }in.github/dependabot.yml(PR fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper) #224). - \u0060cargo update\u0060 / \u0060cargo install\u0060 on dev machines — only available path today is the post-hoc
cargo audit-style wrapper, OR opt-in nightly Cargo with-Zmin-publish-age.
Native option: RFC 3923 / -Zmin-publish-age
- RFC: https://github.com/rust-lang/rfcs/blob/master/text/3923-cargo-min-publish-age.md — merged 2026-05-18
- Tracking: Tracking Issue for min-publish-age RFC 3923 rust-lang/cargo#17009
- Implementation:
rust-lang/cargo#17012— merged 2026-06-18, milestone 1.98.0 - Stable availability (projected): roughly Aug–Sep 2026 if Cargo's usual nightly→stable window holds (~6–12 weeks)
When this lands on stable Rust, the migration is:`
# `src-tauri/.cargo/config.toml`
[registry]
global-min-publish-age = "7 days"
# optional: per-registry override
# [registries.crates-io]
# min-publish-age = "7 days"
# override for urgent security bumps:
# CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update clap --precise 4.5.3Once native enforcement is on, Dependabot's cargo cooldown can be relaxed or removed (it's belt-and-suspenders against bot-driven bumps; native covers manual cargo update).
Acceptance criteria
-
rust-lang/cargo#17009releases on stable Rust (~\u003e= 1.98) - Add
registry.global-min-publish-age = "7 days"\u0060 tosrc-tauri/.cargo/config.toml(or repo-root.cargo/config.toml` if preferred) - Verify
cargo build/cargo testagainst a deliberate pin override (CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update … --precise X) still works for urgent security bumps - Decide whether to keep or remove the cargo `cooldown\u0060 in dependabot.yml (recommendation: keep as defense-in-depth, then remove if it creates dup-alert noise)
Related
- PR fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper) #224 (Dependabot cooldown + .npmrc + script deletion) — the prior change
- fix: 5 cargo deps too new for npm deps:check gate #223 — the original "rule works correctly" finding that kicked off this workstream
- Cargo nightly doc: https://doc.rust-lang.org/cargo/reference/unstable.html#min-publish-age
- Cargo config doc: https://doc.rust-lang.org/cargo/reference/config.html
Activity
EVWorth commentedon Sep 12, 2026
Status check, since this is the only issue left that is genuinely blocked upstream.
cargo -Z min-publish-ageis still nightly-only as of Rust 1.94 — RFC 3923 has not landed on stable, so the workaround this issue exists to remove is still the only option for cargo.Nothing to do here yet. The two things that would change that:
min-publish-ageappearing in a stable Cargo release, at which point thecooldownblock in.github/dependabot.ymlcomes out and the setting goes in.cargo/config.tomlwhere it coverscargo updateon dev machines too — which the Dependabot workaround never did.cooldown, which would force the issue sooner.Left open deliberately: it is a real gap (a local
cargo updatecan still pull a crate published an hour ago), tracked so it is not forgotten, and not actionable today.chore: bump version to 1.0.0 (#683)
EVWorth commentedon Sep 17, 2026
Checked upstream on 2026-09-16. Stabilized in cargo, not yet on stable Rust.
rust-toolchain.tomlTwo corrections to the description above, both of which were reasonable when
it was written and are not any more:
the feature, so anyone checking "is it in stable yet?" against 1.98 will get
a misleading no-for-the-wrong-reason.
date is 2026-11-12.
The config key stabilized exactly as the description anticipates
(
[registry] global-min-publish-age = "7 days", withCARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allowas the escape hatch), so themigration plan needs no revision — only the date does.
One extra step for us when it lands: this repo pins an exact toolchain, so
adopting it means bumping
rust-toolchain.tomlfrom 1.95.0 to 1.100.0 aswell. That is a deliberate change with its own blast radius, not a side effect
of the config edit.
Nothing actionable until mid-November. Worth re-checking after 2026-11-12.
fix(deps): align the rmcp pin the bump left behind