Cargo publish --dry-run doesn't warn on max upload size

[mandeep]

Problem

I ran cargo publish --dry-run to see if a project would publish okay. All seemed well except for a compatibility warning, which I expected.

I would expect that the dry run would also warn that the package size is 20.1MiB since it's greater than the 10MiB limit. I didn't receive a warning until I tried running cargo publish.

Output of cargo publish --dry-run:

    Updating crates.io index
   Packaging viewimg v0.11.0 (C:\Users\Mandeep\Github\viewimg)
    Updating crates.io index
    Packaged 23 files, 20.1MiB (16.6MiB compressed)
   Verifying viewimg v0.11.0 (C:\Users\Mandeep\Github\viewimg)
   Compiling viewimg v0.11.0 (C:\Users\Mandeep\Github\viewimg\target\package\viewimg-0.11.0)
    Finished `dev` profile [optimized + debuginfo] target(s) in 2.10s
warning: the following packages contain code that will be rejected by a future version of Rust: image2 v0.11.3
note: to see what the problems were, use the option `--future-incompat-report`, or run `cargo report future-incompatibilities --id 1`
   Uploading viewimg v0.11.0 (C:\Users\Mandeep\Github\viewimg)
warning: aborting upload due to dry run

Output of cargo publish:

Caused by:
  the remote server responded with an error (status 413 Payload Too Large): max upload size is: 10485760

Steps

Try to run cargo publish --dry-run on a package larger than the 10MiB limit. A warning will not appear that the package size is too large.

Possible Solution(s)

No response

Notes

No response

Version

cargo 1.95.0 (f2d3ce0bd 2026-03-21)
release: 1.95.0
commit-hash: f2d3ce0bd7f24a49f8f72d9000448f8838c4e850
commit-date: 2026-03-21
host: x86_64-pc-windows-msvc
libgit2: 1.9.2 (sys:0.20.4 vendored)
libcurl: 8.15.0-DEV (sys:0.4.83+curl-8.15.0 vendored ssl:Schannel)
os: Windows 10.0.26200 (Windows 11 Professional) [64-bit]

[epage]

We have two challenges with this

• The publish dry-run stops before talking to crates.io
• Upload limits have exceptions and so we could give an inaccurate warning if we did if source == crates.ui && size > 10 MB

This falls into similar problems as

• cargo publish --workspace should fail early if you don't have permission to publish everything #16181
• rate limit checks (see also When crates.io gives 429, cargo should back off and retry later #13530)
• Expand manifest validation for all settings #4377

[mandeep]

Ah I see. Thanks for the links to the other issues. I'll give them a read.

I posted this issue as I actually had to run cargo publish multiple times before I received the max upload size warning, so it was more annoying than the issue makes it appear.

Is there a current consensus on these sorts of things might be handled in the future?

[epage]

Likely some new API would need to be worked out between registries and Cargo to check different types of information. We'd need some way for this to not cause Cargo to fail on registries that don't support it.