Fix it fast
Most likely: A normal path or git dependency has no version that registry consumers can resolve.
Confirm this is your error
Match the output and confirm you are troubleshooting the same failure.
error: all dependencies must have a version requirement specified when publishing.
dependency `internal-api` does not specify a version
error: all dependencies must have a version requirement specified when publishing.
dependency `shared` does not specify a version
Note: The published dependency will use the version from crates.io, the `path` specification will be removed from the dependency declaration.Check the cause
Run focused checks to identify what is failing in this environment.
cargo package --list
grep -n "path =|git =" Cargo.toml
cargo publish --dry-run --registry <name> -vvApply the safe fix
Use the smallest safe change that addresses the confirmed cause.
# Keep the local path and add the real published version.
# internal-api = { path = "../internal-api", version = "1.2" }Verify it works
Repeat the relevant checks and confirm the original error is gone.
cargo publish --dry-run --registry <name>Avoid unsafe shortcuts
Keep security and data protections in place while troubleshooting.
- Do not invent a version that is absent from the target registry.
- Do not use
--no-verifyto bypass an invalid published dependency declaration.
What This Error Means
Read this as a precise clue about which part of the workflow broke first. Once you know the failing layer, the fix path gets much shorter.
How to Fix It
The fastest fixes here come from checking the immediate failing layer before you change anything unrelated. Make one correction at a time and re-test from the same environment.
Published path dependency:keep the path for local development and add a compatible version that exists in the target registry.
Published git dependency:publish the dependency first and add its registry version, or keep the parent package private.
Wrong target registry:pass the intended --registry and make sure all normal dependencies are available there under Cargo rules.
Workspace release order:publish lower-level crates first and wait until their index entries are visible before packaging dependents.
Private-only crate:set an intentional package.publish restriction rather than deleting dependency information to force publication.
Why It Happens
A normal dependency uses only path, which works inside the repository but cannot identify a published release for consumers.
A git dependency has no registry version that Cargo can place in the normalized published manifest.
An internal crate has never been published to the target private registry.
Release automation selects a package whose sibling dependencies are still private workspace-only crates.
Verify the Fix
Run cargo publish --dry-run --registry <name> from the same checkout. Cargo should finish manifest normalization, archive creation, and verification without uploading.
Inspect the normalized Cargo.toml under target/package and confirm consumers will resolve the intended package name, version, and registry.
Identify the dependency that cannot be published
Run cargo package --list to confirm the intended package and inspect the named dependency in its original Cargo.toml.
Check whether the dependency has only path or git, or whether a template removed the version field during a workspace refactor.
Confirm that the dependency name and compatible version actually exist in the registry targeted by the eventual publish command.
Run cargo publish --dry-run --registry <name> -vv after redacting internal URLs and ensuring no token value appears in shared logs.
How Cargo normalizes dependencies for publication
This is the part worth understanding if the quick fix did not hold. It explains what Cargo is trying to do at the moment the error appears.
cargo package rewrites the manifest placed inside the crate archive. Path details are removed, so normal dependencies need a version that registry consumers can resolve.
The failure occurs during packaging verification before upload. A local workspace can build successfully while still being impossible for another developer to install from a registry.
Prevent It From Coming Back
To prevent this, add cargo publish --dry-run to release CI for every crate that can be published, document workspace publication order and wait for private-index visibility before publishing dependents, and require normal publishable dependencies to carry both local development paths and valid registry versions where appropriate.
Docs and source code
cargo package
Official packaging checks and normalized manifest behavior before a crate can be published. - Source
This command will create a distributable, compressed crate file.cargo publish
Official publish stages, dry-run behavior, registry selection, and authentication requirements. - Source
This command will create a distributable, compressed crate file and upload it to a registry.Specifying Dependencies
Official manifest syntax for registry, path, git, and workspace dependencies. - Source
Cargo supports several ways to specify the location of a dependency.