# Pre-RFC: MSRV-aware resolver **URL:** \ **Category:** cargo\ **Created:** [November 14, 2023, 10:48pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871 "2023-11-14T22:48:35Z")\ **Posts on this page:** 11\ **Page:** 4
**Author:** ![epage](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/epage/32/3171_2.png) [@epage](https://internals.rust-lang.org/u/epage)\ **Post date:** [November 29, 2023, 7:22pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/61 "2023-11-29T19:22:08Z")
I've gone ahead and created an RFC: [RFC: MSRV Resolver by epage · Pull Request #3537 · rust-lang/rfcs · GitHub](https://github.com/rust-lang/rfcs/pull/3537) ---
**Author:** ![kornel](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/kornel/32/2711_2.png) [@kornel](https://internals.rust-lang.org/u/kornel)\ **Post date:** [November 29, 2023, 9:18pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/62 "2023-11-29T21:18:21Z")
I think using `rustc --version` for the default version for MSRV resolution is going to work better. 1. It's not sufficient to use older dependencies to actually make projects compatible with an older Rust version. There are also lanugage features, libstd changes, edition, cargo features that depend on Rust version. Clippy can't handle it all — there are crates that dynamically detect rustc version and enable features based on that. Testing with `cargo +1.xx.x test` is the best bet, and defaulting to `rustc --version` will encourage that. 2. I'm worried about application developers missing dependency updates without realizing that `rust-version` in their `Cargo.toml` holds them back. This isn't just about CVEs, but also getting bugfixes, and the latest documentation on docs.rs matching what they use. I wouldn't want every interaction with a library maintainer to start with an obligatory "have you updated to the latest version of my library? Are you sure? Have you tried with `--ignore-rust-version`?". Defaulting to `rustc --version` will mostly work in these cases, since most users use `rustup update` regularly. ---
**Author:** ![epage](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/epage/32/3171_2.png) [@epage](https://internals.rust-lang.org/u/epage)\ **Post date:** [November 29, 2023, 9:31pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/63 "2023-11-29T21:31:35Z")
Note that I'm focusing conversations on the RFC at this point to make it easier for everyone to follow along ---
**Author:** ![josh](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/josh/32/5934_2.png) [@josh](https://internals.rust-lang.org/u/josh)\ **Post date:** [November 29, 2023, 10:01pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/64 "2023-11-29T22:01:34Z")
> [@kornel](#): > > I'm worried about application developers missing dependency updates without realizing that `rust-version` in their `Cargo.toml` holds them back. This isn't just about CVEs, but also getting bugfixes, and the latest documentation on docs.rs matching what they use. I wouldn't want every interaction with a library maintainer to start with an obligatory "have you updated to the latest version of my library? Are you sure? Have you tried with `--ignore-rust-version`?". Defaulting to `rustc --version` will mostly work in these cases, since most users use `rustup update` regularly. I think we should have a warning whenever the selected version is not the latest available compatible version. ---
**Author:** ![jmjoy](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/jmjoy/32/12891_2.png) [@jmjoy](https://internals.rust-lang.org/u/jmjoy)\ **Post date:** [January 12, 2024, 1:43am UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/65 "2024-01-12T01:43:28Z")
I had a very unpleasant experience: I work on old version of Rust, usually I develop my library with dependencies by: ```shell cargo +nightly -Z minimal-versions update ``` But when I publish my library by `cargo publish`, I got: ```rust Caused by: package `home v0.5.9` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.65.0 ``` Is there `cargo publish` update dependencies by `-Z minimal-versions`, or it's best to update the dependent version based on the `rust-version`. ---
**Author:** ![mathstuf](https://avatars.discourse-cdn.com/v4/letter/m/958977/32.png) [@mathstuf](https://internals.rust-lang.org/u/mathstuf)\ **Post date:** [January 12, 2024, 4:34am UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/66 "2024-01-12T04:34:14Z")
> [@jmjoy](#): > > Is there `cargo publish` update dependencies by `-Z minimal-versions`, or it's best to update the dependent version based on the `rust-version`. Does `cargo publish --no-verify` work for you? Perhaps `--frozen` or `--locked` would work? ---
**Author:** ![jmjoy](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/jmjoy/32/12891_2.png) [@jmjoy](https://internals.rust-lang.org/u/jmjoy)\ **Post date:** [January 12, 2024, 7:46am UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/67 "2024-01-12T07:46:36Z")
Thanks, I use `cargo +stable publish` to achieve it. ---
**Author:** ![epage](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/epage/32/3171_2.png) [@epage](https://internals.rust-lang.org/u/epage)\ **Post date:** [January 12, 2024, 2:36pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/68 "2024-01-12T14:36:47Z")
I'm assuming whats happening is that you don't commit your lockfile and so `cargo publish` is generating a new one. If you aren't aware, we've [changed our guidance on lockfiles](https://blog.rust-lang.org/2023/08/29/committing-lockfiles.html) and imo the way to solve this is to commit your lockfile. ---
**Author:** ![Nemo157](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/nemo157/32/11585_2.png) [@Nemo157](https://internals.rust-lang.org/u/Nemo157)\ **Post date:** [January 12, 2024, 3:43pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/69 "2024-01-12T15:43:19Z")
It's not necessarily only whether the `Cargo.lock` is committed. Cargo will only include it in the package if there is a binary crate (either a `[[bin]]` or an `[[example]]`), so for lib-only crates the `Cargo.lock` will never be used when verifying during a publish. (I think this was mentioned somewhere during the discussion about changing the guidance, but afaik hasn't been actually proposed to change). ---
**Author:** ![epage](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/epage/32/3171_2.png) [@epage](https://internals.rust-lang.org/u/epage)\ **Post date:** [January 16, 2024, 4:51pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/70 "2024-01-16T16:51:52Z")
We discussed this in today's team meeting and I captured that in an issue I created for this: [`cargo publish` of a `[lib]` fails when dependencies exist newer than my toolchain version · Issue #13306 · rust-lang/cargo · GitHub](https://github.com/rust-lang/cargo/issues/13306) ---
**Author:** ![steffahn](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/steffahn/32/13288_2.png) [@steffahn](https://internals.rust-lang.org/u/steffahn)\ **Post date:** [July 9, 2025, 4:52pm UTC](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871/71 "2025-07-09T16:52:52Z")
Closed on July 9, 2025, 4:52pm UTC This topic was automatically closed 540 days after the last reply. New replies are no longer allowed. [Previous page](https://internals.rust-lang.org/t/pre-rfc-msrv-aware-resolver/19871.md?page=3)