rust-lang/cargo · error · anyhow::Error

all versions of crate `{dependency}` are too new per `min-pu

Error message

all versions of crate `{dependency}` are too new per `min-publish-age`

What it means

When a `min-publish-age` resolver policy is configured (to avoid depending on crates published too recently, e.g. for supply-chain cooling-off), cargo-add filters candidate versions through `PublishAgePolicy::too_new`. If *every* candidate is filtered out as too new, the operation bails at mod.rs:876 with the offending versions listed. The message includes an escape hatch: set `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow`.

Source

Thrown at src/ops/cargo_add/mod.rs:876

                        false
                    }
                    None => true,
                });
                if possibilities.is_empty() && has_candidates {
                    too_new.sort_by(|(a, _), (b, _)| a.cmp(b));
                    let mut msg = format!(
                        "all versions of crate `{dependency}` are too new per `min-publish-age`"
                    );
                    for (version, violation) in &too_new {
                        let note = violation.note();
                        let _ = write!(&mut msg, "\n  version {version} is too new ({note})",);
                    }
                    let _ = write!(
                        &mut msg,
                        "\nhelp: to add the latest version anyways, \
                         re-run with `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow`"
                    );
                    anyhow::bail!(msg);
                }
            }

            possibilities.sort_by_key(|s| {
                // Fallback to a pre-release if no official release is available by sorting them as
                // less.
                let stable = s.version().pre.is_empty();
                (stable, s.version().clone())
            });

            let mut latest = possibilities.last().ok_or_else(|| {
                anyhow::format_err!(
                    "the crate `{dependency}` could not be found in registry index."
                )
            })?;

            if honor_rust_version.unwrap_or(true) {
                let (req_msrv, is_msrv) = spec

View on GitHub (pinned to 0e07a15537)

Solutions

1. Re-run with `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo add <crate>` to override for this one add.
2. Pin to an older, aged version explicitly: `cargo add <crate>@<older-version>` if one exists outside the window.
3. Relax or disable the `min-publish-age` policy in `.cargo/config.toml` if the cooling-off is no longer required.

Example fix

# before
cargo add brand-new-crate

# after (one-off override)
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo add brand-new-crate

// Before adding, check whether any candidate version is aged enough for the policy.
fn has_aged_version(crate_name: &str, min_age_days: u32) -> bool {
    let now = std::time::SystemTime::now();
    crate_versions(crate_name).iter().any(|v| {
        now.duration_since(v.published_at).map(|d| d.as_secs() / 86400 >= min_age_days as u64).unwrap_or(false)
    })
}
// if !has_aged_version(name, policy_days) { decide: allow or skip }

When it happens

Trigger: A crate whose only published versions are all newer than the configured `min-publish-age` window, while running `cargo add <crate>`. The policy is read from config (`PublishAgePolicy::new(gctx)`).

Common situations: Supply-chain policies in regulated environments, or a brand-new crate that has no aged version yet. Also seen right after a security patch is published and the team policy requires a wait period.

Related errors

• Deprecated dependency sections are unsupported: {}
• cannot add `{}` as a dependency to itself
• unrecognized feature{} for crate {}: {}
• the manifest file {} needs to be updated but {locked_flag} w
• cannot specify a git URL (`{url}`) with a version (`{v}`).

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/fb3cda3ad4cf8426.json. Report an issue: GitHub.