{"id":"55121b93d810d736","repo":"rust-lang/cargo","slug":"already-a-valid-dependency","errorCode":null,"errorMessage":"already a valid dependency","messagePattern":"already a valid dependency","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/ops/cargo_update.rs","lineNumber":1111,"sourceCode":"                change.is_transitive = Some(false);\n            }\n        }\n\n        changes\n    }\n\n    /// For querying [`PackageRegistry`] for alternative versions to report to the user\n    fn alternatives_query(&self) -> Option<crate::workspace::dependency::Dependency> {\n        if !self.package_id.source_id().is_registry() {\n            return None;\n        }\n\n        let query = crate::workspace::dependency::Dependency::parse(\n            self.package_id.name(),\n            None,\n            self.package_id.source_id(),\n        )\n        .expect(\"already a valid dependency\");\n        Some(query)\n    }\n}\n\nimpl std::fmt::Display for PackageChange {\n    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n        let package_id = self.package_id;\n        if let Some(previous_id) = self.previous_id {\n            if package_id.source_id().is_git() {\n                write!(\n                    f,\n                    \"{previous_id} -> #{}\",\n                    &package_id.source_id().precise_git_fragment().unwrap()[..8],\n                )\n            } else {\n                write!(f, \"{previous_id} -> v{}\", package_id.version())\n            }\n        } else {","sourceCodeStart":1093,"sourceCodeEnd":1129,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/ops/cargo_update.rs#L1093-L1129","documentation":"Invariant in `PackageChange::alternatives_query`. It rebuilds a `Dependency` from a registry-sourced `PackageId` via `Dependency::parse(name, None, source_id).expect(\"already a valid dependency\")`. The package came from a registry, so its name and source are by construction parseable back into a Dependency.","triggerScenarios":"Fires only if a `PackageId` whose `source_id().is_registry()` is true nonetheless has a name or source that `Dependency::parse` rejects (e.g. a name containing characters forbidden by the parser, or a registry source URL that became invalid).","commonSituations":"Cargo bug where a registry package has an unusual name; a corrupted registry index entry; a `[patch]`/`[replace]` that mangles a source URL into something the parser rejects. End users running `cargo update` against crates.io effectively never hit this.","solutions":["Report a cargo bug with the offending package name/version and registry.","Run `cargo update -p <name>` to isolate which package triggers it; inspect its index entry.","Clear the registry cache (`cargo cache` / remove `~/.cargo/registry`) and re-fetch."],"exampleFix":"// before\nlet query = Dependency::parse(self.package_id.name(), None, self.package_id.source_id())\n    .expect(\"already a valid dependency\");\n\n// after\nlet query = Dependency::parse(self.package_id.name(), None, self.package_id.source_id())\n    .with_context(|| format!(\"registry package {} has an unparsable name/source\", self.package_id()))?;","handlingStrategy":"validation","validationCode":"// Before the alternatives query, sanity-check the package id round-trips.\nif let Err(e) = Dependency::parse(pkg.name(), None, pkg.source_id()) {\n    return Err(anyhow!(\"package {} cannot be re-parsed as a dependency: {}\", pkg, e));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the registry index clean; clear cache if you suspect corruption.","Avoid `[patch]` entries that mangle registry source URLs."],"tags":["cargo","panic","invariant","cargo-update","registry","dependency","rust"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}