{"id":"5d7d07f7d7967ec3","repo":"rust-lang/cargo","slug":"all-dependencies-must-have-a-version-requirement-s","errorCode":null,"errorMessage":"all dependencies must have a version requirement specified when {}.\ndependency `{}` does not specify a version\nNote: The {} dependency will use the version from {},\nthe `{}` specification will be removed from the dependency declaration.","messagePattern":"all dependencies must have a version requirement specified when (.+?)\\.\ndependency `(.+?)` does not specify a version\nNote: The (.+?) dependency will use the version from (.+?),\nthe `(.+?)` specification will be removed from the dependency declaration\\.","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/ops/mod.rs","lineNumber":103,"sourceCode":"/// This check is performed on dependencies before publishing or packaging\nfn check_dep_has_version(\n    dep: &crate::workspace::Dependency,\n    publish: bool,\n) -> crate::CargoResult<bool> {\n    let which = if dep.source_id().is_path() {\n        \"path\"\n    } else if dep.source_id().is_git() {\n        \"git\"\n    } else {\n        return Ok(false);\n    };\n\n    if !dep.specified_req() && dep.is_transitive() {\n        let dep_version_source = dep.registry_id().map_or_else(\n            || CRATES_IO_DOMAIN.to_string(),\n            |registry_id| registry_id.display_registry_name(),\n        );\n        anyhow::bail!(\n            \"all dependencies must have a version requirement specified when {}.\\n\\\n             dependency `{}` does not specify a version\\n\\\n             Note: The {} dependency will use the version from {},\\n\\\n             the `{}` specification will be removed from the dependency declaration.\",\n            if publish { \"publishing\" } else { \"packaging\" },\n            dep.package_name(),\n            if publish { \"published\" } else { \"packaged\" },\n            dep_version_source,\n            which,\n        )\n    }\n    Ok(true)\n}\n","sourceCodeStart":85,"sourceCodeEnd":117,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/ops/mod.rs#L85-L117","documentation":"Before packaging/publishing, check_dep_has_version requires that path and git dependencies which are transitive (i.e. used by the published library, not just dev-only) carry an explicit `version` requirement. Without it, downstream consumers on crates.io could not resolve the dependency. It bails at mod.rs:103, noting that the source/path spec will be stripped and the registry version used instead.","triggerScenarios":"`cargo package` or `cargo publish` when a path/git dependency used by non-dev code lacks `version = \"...\"` in Cargo.toml.","commonSituations":"Local path deps during development added without a version; monorepo crates referenced by path only; forgetting to pin before release.","solutions":["Add a `version = \"x.y.z\"` (or a requirement like `version = \"1.0\"`) to the path/git dependency in Cargo.toml.","If the dep is only needed for tests, mark it `[dev-dependencies]` so the transitive check does not apply.","Ensure the version matches what will be published to the registry for that dependency."],"exampleFix":"# before\n[dependencies]\nmy-utils = { path = \"../my-utils\" }\n\n$ cargo publish\nerror: all dependencies must have a version requirement specified when publishing ...\n\n# after\n[dependencies]\nmy-utils = { path = \"../my-utils\", version = \"0.1.0\" }","handlingStrategy":"validation","validationCode":"# Fail if any path/git non-dev dependency lacks a version:\nawk '\n  /^\\[dependencies\\]/      {in_deps=1; in_dev=0; next}\n  /^\\[dev-dependencies\\]/  {in_deps=0; in_dev=1; next}\n  /^\\[/                     {in_deps=0; in_dev=0}\n  in_deps && !in_dev && /path|git/ && !/version/ {\n    print \"missing version on: \" $0 > \"/dev/stderr\"; bad=1\n  }\n  END { exit bad }\n' Cargo.toml || exit 1\ncargo package","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add `version = \"...\"` to every path/git dependency before publish.","Move test-only path deps to [dev-dependencies] to bypass the check.","Run `cargo publish --dry-run` locally to surface this before the real publish."],"tags":["packaging","publish","dependencies","manifest","version"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}