rust-lang/cargo · error · anyhow::Error

dependency ({name_in_toml}) specified without providing a lo

Error message

dependency ({name_in_toml}) specified without providing a local path, Git repository, version, or workspace dependency to use

What it means

Thrown by `dep_to_dependency` at src/workspace/parser/mod.rs:2234, the main manifest parser's counterpart of the editor's error 202. When a dependency's detailed table has none of `version`, `path`, or `git` (and it is not a workspace-inherited dependency, since those are resolved earlier), cargo cannot determine the source and bails. The message also mentions the workspace option for discoverability.

Source

Thrown at src/workspace/parser/mod.rs:2234

    dep_to_dependency(config_patch, name, manifest_ctx, None)
}

fn dep_to_dependency<P: ResolveToPath + Clone>(
    orig: &manifest::TomlDependency<P>,
    name_in_toml: &str,
    manifest_ctx: &mut ManifestContext<'_, '_>,
    kind: Option<DepKind>,
) -> CargoResult<Dependency> {
    let orig = match orig {
        manifest::TomlDependency::Simple(version) => &manifest::TomlDetailedDependency::<P> {
            version: Some(version.clone()),
            ..Default::default()
        },
        manifest::TomlDependency::Detailed(details) => details,
    };

    if orig.version.is_none() && orig.path.is_none() && orig.git.is_none() {
        anyhow::bail!(
            "dependency ({name_in_toml}) specified without \
                 providing a local path, Git repository, version, or \
                 workspace dependency to use"
        );
    }

    if let Some(version) = &orig.version {
        if version.contains('+') {
            manifest_ctx.warnings.push(format!(
                "version requirement `{}` for dependency `{}` \
                     includes semver metadata which will be ignored, removing the \
                     metadata is recommended to avoid confusion",
                version, name_in_toml
            ));
        }
    }

    if orig.git.is_none() {

View on GitHub (pinned to 0e07a15537)

Solutions

Add a source: `foo = { version = "1.0", optional = true }`, or `path`, or `git`.
To inherit, set `workspace = true` and define the dep under `[workspace.dependencies]`.
Re-generate the entry with `cargo add foo`.

Example fix

# before
[dependencies]
foo = { optional = true }
# after
[dependencies]
foo = { version = "1.0", optional = true }

Defensive patterns

Strategy: validation

Validate before calling

for (k, item) in deps {
    if let Some(t) = item.as_table_like() {
        let has_source = ["version","path","git"].iter().any(|s| t.contains_key(s))
            || t.get("workspace").and_then(|v| v.as_bool()) == Some(true);
        if !has_source { return Err(format!("dep {k} has no source")); }
    }
}

Prevention

Every dependency needs version/path/git or workspace inheritance.
Validate manifests with a schema/toml check in CI.
Use `cargo add` to author dependency entries.

When it happens

Trigger: A `[dependencies]` entry like `foo = { optional = true }`, `foo = { features = ["a"] }`, or `foo = { registry = "myreg" }` with no version/path/git, in a normal (non-workspace-inherited) dependency.

Common situations: Partial manifest edits; depending on a renamed package and dropping the version; migration scripts that strip fields.

Related errors

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/616d7d0d359f343e.json. Report an issue: GitHub.