Consider release date on crates.io for minimumReleaseAge

[TitanNano]

What would you like Renovate to be able to do?

The stabilityDays configuration does currently not work for rust dependencies. This is caused by the fact that no release date is fetched from crates.io.

Renovate bot currently relies on the standard registry schema, which does not contain a release date. The crates.io API exposes a release date for all crate versions, though.

We would like to use the stabilityDays option with rust dependencies.

If you have any ideas on how this should be implemented, please tell us here.

Version info for crate.io can be fetched either for all versions via https://crates.io/api/v1/crates/<crate>/versions or for individual versions via https://crates.io/api/v1/crates/<crate>/<version>.

Is this a feature you are interested in implementing yourself?

No

[rarkins]

The crates.io API has some performance issues which leads to them heavily rate limiting certain endpoints. This might include the one you suggest. @Turbo87 can hopefully advise

[Turbo87]

currently on vacation but I can check once I'm back. the former might need pagination depending on our needs, the latter might work but has an N+1 requests issue.

[ahollmann]

This seems to be related: rust-lang/crates.io#5302

[rarkins]

Note: stabilityDays has been renamed to minimumReleaseAge

[nipunn1313]

hi - I ran into this issue recently. I found it rather confusing because minimumReleaseAge depends on this field being set by the datasource: "releaseTimestamp": "2023-07-28T14:25:18.635Z". Not all data sources support it (particularly crates.io as noted in this task).

I think at minimum, it should be made very clear when minimumReleaseAge is being ignored because the dep manager lacks support for the feature (perhaps on the dependency dashboard).

And I would love to see it built for cargo!
minimumReleaseAge is one of the killer features of renovate over alternatives for us. Appreciate the work.

[0xarvin]

@rarkins @Turbo87 looks like the N+1 issue with crates is resolved with rust-lang/crates.io#8037, is there anything else blocking this?

[HonkingGoose]

I think at minimum, it should be made very clear when minimumReleaseAge is being ignored because the dep manager lacks support for the feature (perhaps on the dependency dashboard).

See discussion:

• Tell user if `minimumReleaseAge` is non-functional (docs and PR body text) #30666

[renovate-release]

🎉 This issue has been resolved in version 38.119.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)
• 38.119.0

Your semantic-release bot 📦🚀