rust-lang/cargo · error · anyhow::Error

failed to parse the version requirement `{}` for dependency

Error message

failed to parse the version requirement `{}` for dependency `{}`

What it means

Raised in `Dependency::parse` (src/workspace/dependency.rs:128) when `semver::VersionReq::parse(v)` returns an `Err` for the version string of a dependency. The original parse error is wrapped with a context message naming the bad requirement and the dependency, giving `failed to parse the version requirement \"<v>\" for dependency \"<name>\"`.

Source

Thrown at src/workspace/dependency.rs:128

            DepKind::Build => Some("build"),
        }
        .serialize(s)
    }
}

impl Dependency {
    /// Attempt to create a `Dependency` from an entry in the manifest.
    pub fn parse(
        name: impl Into<InternedString>,
        version: Option<&str>,
        source_id: SourceId,
    ) -> CargoResult<Dependency> {
        let name = name.into();
        let (specified_req, version_req) = match version {
            Some(v) => match VersionReq::parse(v) {
                Ok(req) => (true, OptVersionReq::Req(req)),
                Err(err) => {
                    return Err(anyhow::Error::new(err).context(format!(
                        "failed to parse the version requirement `{}` for dependency `{}`",
                        v, name,
                    )));
                }
            },
            None => (false, OptVersionReq::Any),
        };

        let mut ret = Dependency::new_override(name, source_id);
        {
            let ptr = Arc::make_mut(&mut ret.inner);
            ptr.only_match_name = false;
            ptr.req = version_req;
            ptr.specified_req = specified_req;
        }
        Ok(ret)
    }

View on GitHub (pinned to 0e07a15537)

Solutions

Validate the version string against semver requirement grammar (e.g. `cargo metadata` or the `semver` crate) and correct it.
Use a simple exact or caret form first (`"1.2.3"` or `"^1.2.3"`) to isolate the issue.
Check the dependency's actual published versions and use a valid comparator against them.

Example fix

# before
[dependencies]
serde = { version = "^1..0" }
# after
[dependencies]
serde = { version = "^1.0" }

Defensive patterns

Strategy: validation

Validate before calling

use semver::VersionReq;
fn valid_version_req(v: &str) -> bool { VersionReq::parse(v).is_ok() }
// before writing a dependency, assert valid_version_req(&version_string)

Try / catch

match Dependency::parse(name, Some(v), sid) {
    Err(e) if e.to_string().contains("failed to parse the version requirement") => { /* prompt user */ }
    res => res,
}

Prevention

Lint Cargo.toml version strings with `cargo metadata` or `toml`+`semver` in CI.
Use caret or exact forms to avoid exotic syntax.
Validate programmatically generated manifests.

When it happens

Trigger: Any dependency whose `version = "..."` string is not a valid semver version requirement: typos like `"^1..2"`, `">>1.0"`, `"1.0.0-"`, bare `"latest"`, or stray characters. `VersionReq::parse` fails and the context is attached.

Common situations: Hand-editing Cargo.toml and introducing a typo; using npm/cargo-style `"*"` where unsupported; pasting a version from a release notes page with extra text; migration tooling emitting malformed requirements; caret/tilde confusion across ecosystems.

Related errors

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/1c133e1a8b39a79d.json. Report an issue: GitHub.