rust-lang/cargo · error · anyhow::Error

all dependencies must have a version requirement specified w

Error message

all dependencies must have a version requirement specified when {}.
dependency `{}` does not specify a version
Note: The {} dependency will use the version from {},
the `{}` specification will be removed from the dependency declaration.

What it means

Before packaging/publishing, check_dep_has_version requires that path and git dependencies which are transitive (i.e. used by the published library, not just dev-only) carry an explicit `version` requirement. Without it, downstream consumers on crates.io could not resolve the dependency. It bails at mod.rs:103, noting that the source/path spec will be stripped and the registry version used instead.

Source

Thrown at src/ops/mod.rs:103

/// This check is performed on dependencies before publishing or packaging
fn check_dep_has_version(
    dep: &crate::workspace::Dependency,
    publish: bool,
) -> crate::CargoResult<bool> {
    let which = if dep.source_id().is_path() {
        "path"
    } else if dep.source_id().is_git() {
        "git"
    } else {
        return Ok(false);
    };

    if !dep.specified_req() && dep.is_transitive() {
        let dep_version_source = dep.registry_id().map_or_else(
            || CRATES_IO_DOMAIN.to_string(),
            |registry_id| registry_id.display_registry_name(),
        );
        anyhow::bail!(
            "all dependencies must have a version requirement specified when {}.\n\
             dependency `{}` does not specify a version\n\
             Note: The {} dependency will use the version from {},\n\
             the `{}` specification will be removed from the dependency declaration.",
            if publish { "publishing" } else { "packaging" },
            dep.package_name(),
            if publish { "published" } else { "packaged" },
            dep_version_source,
            which,
        )
    }
    Ok(true)
}

View on GitHub (pinned to 0e07a15537)

Solutions

1. Add a `version = "x.y.z"` (or a requirement like `version = "1.0"`) to the path/git dependency in Cargo.toml.
2. If the dep is only needed for tests, mark it `[dev-dependencies]` so the transitive check does not apply.
3. Ensure the version matches what will be published to the registry for that dependency.

Example fix

# before
[dependencies]
my-utils = { path = "../my-utils" }

$ cargo publish
error: all dependencies must have a version requirement specified when publishing ...

# after
[dependencies]
my-utils = { path = "../my-utils", version = "0.1.0" }

# Fail if any path/git non-dev dependency lacks a version:
awk '
  /^\[dependencies\]/      {in_deps=1; in_dev=0; next}
  /^\[dev-dependencies\]/  {in_deps=0; in_dev=1; next}
  /^\[/                     {in_deps=0; in_dev=0}
  in_deps && !in_dev && /path|git/ && !/version/ {
    print "missing version on: " $0 > "/dev/stderr"; bad=1
  }
  END { exit bad }
' Cargo.toml || exit 1
cargo package

When it happens

Trigger: `cargo package` or `cargo publish` when a path/git dependency used by non-dev code lacks `version = "..."` in Cargo.toml.

Common situations: Local path deps during development added without a version; monorepo crates referenced by path only; forgetting to pin before release.

Related errors

• found a virtual manifest at `{}` instead of a package manife
• invalid feature `{}` in required-features of target `{}`: `d
• {}This may cause issue during packaging, as modules resoluti
• cannot package a filename with a special character `{}`: {}
• {} files in the working directory contain changes that were

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/5d7d07f7d7967ec3.json. Report an issue: GitHub.