feat (publish): deprecate `--token` option #16046

omskscream · 2025-10-04T10:23:04Z

What does this PR try to resolve?

Closes #15274
This PR adds a warning when --token option is used with cargo publish command.
This PR removes --token from help and docs for publish command.

There's an --index option that still requires --token to be specified, but addressing that is not the part of this PR.

How to test and review this PR?

Please check changed test cases to see how behavior changes.

rustbot · 2025-10-04T10:23:09Z

r? @epage

rustbot has assigned @epage.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

…about env variables

weihanglo · 2025-10-04T14:07:48Z

src/bin/cargo/commands/publish.rs

Not sure if we also want to update our test

cargo/tests/testsuite/publish.rs

Line 208 in 029de48

p.cargo("publish --no-verify --token sekrit --registry dummy-registry")

I was under impression that this test checks something specific to the cmd option, so wasn't sure about changing it except for adding a warning message 🤔

Anyway, it is fine keeping as-is.

weihanglo · 2025-10-04T14:15:00Z

src/doc/src/commands/cargo-publish.md

-This command requires you to be authenticated with either the `--token` option
-or using [cargo-login(1)](cargo-login.html).
+This command requires you to be authenticated using [cargo-login(1)](cargo-login.html) 
+or [environment variables](../reference/environment-variables.html).


Probably instead of pointing to the entire env doc, we make the link a bit precise to relevant config fields. What do you think?

Suggested change

or [environment variables](../reference/environment-variables.html).

or environment variables of the [`registry.token`](../reference/config.html#registrytoken)

and [`registries.<name>.token`](../reference/config.html#registriesnametoken) config fields.

Though I am still wanting something similar to this happening: https://rust-lang.zulipchat.com/#narrow/channel/246057-t-cargo/topic/Anchors.20for.20each.20environment.20variable.20in.20The.20Cargo.20Book

Perhaps related:

Can be overridden with the --token command-line option.

This in both registry.token and registries.<name>.token doc might need to remove

Thanks for the edit, I missed the fact that config page has direct mentions of env variables with links 😥

As for

This in both registry.token and registries..token doc might need to remove

I would not do it in this PR, because --token is still used in yank and owner commands. Let's postpone it until the deprecation is done in all places.

That is fair. Thank you!

Created an issue tracking it: #16049

weihanglo · 2025-10-04T16:14:50Z

src/bin/cargo/commands/publish.rs

I overlooked in completion code we also want to hide --token

cargo/src/etc/_cargo

Line 254 in 029de48

'--token=[specify token to use when uploading]:token' \

cargo/src/etc/cargo.bashcomp.sh

Line 76 in 029de48

local opt__publish="$opt_common $opt_mani $opt_feat $opt_lock $opt_parallel --allow-dirty --dry-run --token --no-verify --index --registry --target --target-dir"

Fine with either dealing with it in this or a follow-up

Updated, thanks for reminder. I, as a Windows user, haven't even thought of autocomplete 😅

We have unstable native completion support also for powershell, if you're a user and wanna try: https://doc.rust-lang.org/cargo/reference/unstable.html#native-completions

Update cargo submodule 22 commits in 801d9b4981dd07e3aecdca1ab86834c13615737e..81c3f77a467359c8be6bc747dc93ec66a6e4ce11 2025-10-04 13:30:15 +0000 to 2025-10-10 18:41:02 +0000 - docs(changelog): literal host-tuple support (rust-lang/cargo#16033) - refactor: Define cargo script's target-dir using build-dir templating (rust-lang/cargo#16073) - feat(build-dir): Reorganize build-dir layout (rust-lang/cargo#15947) - refactor: unflatten `(String, Def)` to `ConfigValue` (rust-lang/cargo#16084) - fix(tree): Switch from `--depth public` to `--edges public` (rust-lang/cargo#16081) - docs(guide): Point out tools for reducing dependencies (rust-lang/cargo#16078) - Allow to rustfix unused_variables lint. (rust-lang/cargo#16082) - Fix test that assumes `CARGO_CFG_TARGET_FAMILY` is a single value (rust-lang/cargo#16079) - Fix regression that swallowed json diagnostic explanations (rust-lang/cargo#16075) - docs(ref): fix link to clippy incompatible_msrv lint (rust-lang/cargo#16077) - Convert a few more diagnostics to reports (rust-lang/cargo#16066) - fix(support): Add track_caller to know the actual failure (rust-lang/cargo#16069) - fix(add): Report a missing source error for workspace dependencies (rust-lang/cargo#16063) - fix(script): Default bin.name to package.name (rust-lang/cargo#16064) - refactor(gctx): ConfigValue getter cleanup (rust-lang/cargo#16067) - Fix unsafe_op_in_unsafe_fn for Windows (rust-lang/cargo#16058) - Consider public dependencies when choosing a version in cargo add (rust-lang/cargo#1… (rust-lang/cargo#15966) - docs: clarify panic-immediate-abort can be used in config (rust-lang/cargo#16054) - fix(timings): compute codegen start time to draw dep lines (rust-lang/cargo#16055) - chore: Added tracing span for build script execution (rust-lang/cargo#16053) - test: null-terminated path for reserved windows name detection (rust-lang/cargo#16052) - feat (publish): deprecate `--token` option (rust-lang/cargo#16046) r? ghost

rustbot assigned epage Oct 4, 2025

rustbot added A-cli Area: Command-line interface, option parsing, etc. A-cli-help Area: built-in command-line help A-documenting-cargo-itself Area: Cargo's documentation Command-publish S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Oct 4, 2025

omskscream added 2 commits October 4, 2025 13:47

feat (publish): deprecate --token option with warning

6efd504

doc (publish): remove deprecated --token option from man, add info …

30a29b4

…about env variables

omskscream force-pushed the publish/deprecate-token branch from b72c7a4 to 30a29b4 Compare October 4, 2025 10:47

weihanglo reviewed Oct 4, 2025

View reviewed changes

doc (publish): use precise links to token config docs

fbae250

weihanglo approved these changes Oct 4, 2025

View reviewed changes

weihanglo enabled auto-merge October 4, 2025 15:45

weihanglo mentioned this pull request Oct 4, 2025

Soft-deprecate the --token flag everywhere #16049

Open

weihanglo reviewed Oct 4, 2025

View reviewed changes

doc (publish): hide deprecated --token from autocomplete suggestions

d4892c9

auto-merge was automatically disabled October 4, 2025 16:36
Head branch was pushed to by a user without write access

rustbot added the A-completions Area: shell completions label Oct 4, 2025

weihanglo enabled auto-merge October 4, 2025 16:45

weihanglo added this pull request to the merge queue Oct 4, 2025

Merged via the queue into rust-lang:master with commit 8a8ef3e Oct 4, 2025
25 checks passed

rustbot removed the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Oct 4, 2025

weihanglo mentioned this pull request Oct 10, 2025

Update cargo submodule rust-lang/rust#147568

Merged

rustbot added this to the 1.92.0 milestone Oct 11, 2025

	or [environment variables](../reference/environment-variables.html).
	or environment variables of the [`registry.token`](../reference/config.html#registrytoken)
	and [`registries.<name>.token`](../reference/config.html#registriesnametoken) config fields.

feat (publish): deprecate --token option #16046

feat (publish): deprecate --token option #16046

Uh oh!

Conversation

omskscream commented Oct 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR try to resolve?

How to test and review this PR?

Uh oh!

rustbot commented Oct 4, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

feat (publish): deprecate `--token` option #16046

feat (publish): deprecate `--token` option #16046

omskscream commented Oct 4, 2025 •

edited

Loading