Do Not Pin Patch Versions

RUST-DO-NOT-PIN-PATCH-VERSIONS

Summary

Keep manifest requirements as wide as the crate honestly supports. Patch pins belong in Cargo.toml only when code depends on that patchs API, fix, or behavior.

Rule

Do not pin patch versions in Cargo.toml unless the patch is required.

Why

A patch-pinned dependency requirement in Cargo.toml raises the minimum version for every downstream resolver even when any compatible patch would work. Use the widest honest semver requirement and let lockfiles carry newer compatible releases.

Helps

Helps downstream users keep compatible dependency graphs flexible and avoids raising minimum versions just because local lockfiles are newer.

Limits

Pin or require a patch version when the crate uses an API, behavior fix, security fix, or compatibility change introduced in that patch.

Agent Instruction

Avoid patch-pinned `Cargo.toml` requirements unless the patch supplies an API, behavior, or fix the
crate actually needs.

Mechanisms

Express the lowest honest manifest requirement, let lockfiles carry newer compatible releases, and validate with minimal-version checks when dependency floors matter.