What causes "already a valid dependency" in rust-lang/cargo?

Report a cargo bug with the offending package name/version and registry.

already a valid dependency

Error message

already a valid dependency

What it means

Invariant in `PackageChange::alternatives_query`. It rebuilds a `Dependency` from a registry-sourced `PackageId` via `Dependency::parse(name, None, source_id).expect("already a valid dependency")`. The package came from a registry, so its name and source are by construction parseable back into a Dependency.

Source

Thrown at src/ops/cargo_update.rs:1111

                change.is_transitive = Some(false);
            }
        }

        changes
    }

    /// For querying [`PackageRegistry`] for alternative versions to report to the user
    fn alternatives_query(&self) -> Option<crate::workspace::dependency::Dependency> {
        if !self.package_id.source_id().is_registry() {
            return None;
        }

        let query = crate::workspace::dependency::Dependency::parse(
            self.package_id.name(),
            None,
            self.package_id.source_id(),
        )
        .expect("already a valid dependency");
        Some(query)
    }
}

impl std::fmt::Display for PackageChange {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        let package_id = self.package_id;
        if let Some(previous_id) = self.previous_id {
            if package_id.source_id().is_git() {
                write!(
                    f,
                    "{previous_id} -> #{}",
                    &package_id.source_id().precise_git_fragment().unwrap()[..8],
                )
            } else {
                write!(f, "{previous_id} -> v{}", package_id.version())
            }
        } else {

View on GitHub (pinned to 0e07a15537)

Solutions

Report a cargo bug with the offending package name/version and registry.
Run `cargo update -p <name>` to isolate which package triggers it; inspect its index entry.
Clear the registry cache (`cargo cache` / remove `~/.cargo/registry`) and re-fetch.

Example fix

// before
let query = Dependency::parse(self.package_id.name(), None, self.package_id.source_id())
    .expect("already a valid dependency");

// after
let query = Dependency::parse(self.package_id.name(), None, self.package_id.source_id())
    .with_context(|| format!("registry package {} has an unparsable name/source", self.package_id()))?;

Defensive patterns

Strategy: validation

Validate before calling

// Before the alternatives query, sanity-check the package id round-trips.
if let Err(e) = Dependency::parse(pkg.name(), None, pkg.source_id()) {
    return Err(anyhow!("package {} cannot be re-parsed as a dependency: {}", pkg, e));
}

Prevention

Keep the registry index clean; clear cache if you suspect corruption.
Avoid `[patch]` entries that mangle registry source URLs.

When it happens

Trigger: Fires only if a `PackageId` whose `source_id().is_registry()` is true nonetheless has a name or source that `Dependency::parse` rejects (e.g. a name containing characters forbidden by the parser, or a registry source URL that became invalid).

Common situations: Cargo bug where a registry package has an unusual name; a corrupted registry index entry; a `[patch]`/`[replace]` that mangles a source URL into something the parser rejects. End users running `cargo update` against crates.io effectively never hit this.

Related errors

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/55121b93d810d736.json. Report an issue: GitHub.