What causes "latest always has a source" in rust-lang/cargo?

Switch to the default crates.io registry to see if the issue is registry-specific.

latest always has a source

Error message

latest always has a source

What it means

This panic is in the cargo add dependency-resolution path. When a dependency has no explicit source (not path, not git, not workspace), cargo calls get_latest_dependency() to query the registry and then does dependency.set_source(latest.source.expect("latest always has a source")). The invariant is that a registry-queried latest dependency always carries a source (the registry source it was found in).

Source

Thrown at src/ops/cargo_add/mod.rs:501

        } else if let Some((registry, public_source)) =
            get_public_dependency(spec, manifest, ws, section, gctx, &dependency)?
        {
            if let Some(registry) = registry {
                dependency = dependency.set_registry(registry);
            }
            dependency = dependency.set_source(public_source);
        } else {
            let latest =
                get_latest_dependency(spec, &dependency, honor_rust_version, gctx, registry)?;

            if dependency.name != latest.name {
                gctx.shell().warn(format!(
                    "translating `{}` to `{}`",
                    dependency.name, latest.name,
                ))?;
                dependency.name = latest.name; // Normalize the name
            }
            dependency = dependency.set_source(latest.source.expect("latest always has a source"));
        }
    }

    if let Some(Source::Workspace(_)) = dependency.source() {
        check_invalid_ws_keys(dependency.toml_key(), arg)?;
    }

    let version_required = dependency.source().and_then(|s| s.as_registry()).is_some();
    let version_optional_in_section = section.kind() == DepKind::Development;
    let preserve_existing_version = old_dep
        .as_ref()
        .map(|d| d.version().is_some())
        .unwrap_or(false);
    if !version_required && !preserve_existing_version && version_optional_in_section {
        // dev-dependencies do not need the version populated
        dependency = dependency.clear_version();
    }

View on GitHub (pinned to 0e07a15537)

Solutions

Switch to the default crates.io registry to see if the issue is registry-specific.
Specify the dependency source explicitly: cargo add <crate>@<version> or cargo add --path / --git.
Update cargo and the registry index (cargo update --dry-run) to refresh metadata.
Report the issue to the custom registry maintainer if using a private registry.

Defensive patterns

Strategy: validation

Validate before calling

// Before cargo add, verify the crate exists and has source metadata
// Run: cargo search <crate-name> to confirm availability
// Or check the registry index manually

Prevention

Always specify the registry explicitly for private crates: cargo add --registry <name> <crate>.
Verify crate existence with cargo search before cargo add.
Keep registry indices up to date: cargo update --dry-run.

When it happens

Trigger: Querying a registry that returns a summary (IndexSummary::Candidate) where the resulting Dependency object has source = None. This would require a bug in how registry query results are converted to Dependency objects, or a registry source that doesn't populate the source field.

Common situations: Using a custom/private registry that returns malformed summary data; a cargo version with a bug in the registry-to-Dependency conversion; a sparse registry or vendored source that produces incomplete metadata.

Related errors

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/64e7db0b30271f66.json. Report an issue: GitHub.