Problem

When a build is performed with or without -Zpublic-dependency, exported_private_dependencies warnings may occur according to the state of the setting when crates were previously built and cached in target/, rather the current state.

Steps

Prepare a package with code that would contain an exported_private_dependencies warning, e.g.

// lib.rs
pub fn weird(_rng: &mut impl rand::Rng) {}

(rand::Rng is a re-export from rand_core, and rand doesn’t (can’t) currently declare rand_core as a public dependency.) Then, execute these steps to see the problem:

1. cargo clean
2. cargo -Zpublic-dependency check — get a warning, as expected
3. cargo check — get a warning, NOT as expected
4. cargo clean
5. cargo check — get no warning, as expected
6. cargo -Zpublic-dependency check — get no warning, NOT as expected

Possible Solution(s)

I’m not familiar with how Cargo works in this matter. Presumably --extern priv: options are passed to rustc when -Zpublic-dependency is enabled, and the presence of priv: isn’t getting tracked for invalidation but should be.

Notes

@rustbot label Z-public-dependency

Version

cargo 1.97.0-nightly (4f9b52075 2026-05-01)
release: 1.97.0-nightly
commit-hash: 4f9b52075316e9ced380c8fa492858048d5758b6
commit-date: 2026-05-01
host: aarch64-apple-darwin
libgit2: 1.9.2 (sys:0.20.4 vendored)
libcurl: 8.7.1 (sys:0.4.88+curl-8.20.0 system ssl:(SecureTransport) LibreSSL/3.3.6)
ssl: OpenSSL 3.6.2 7 Apr 2026
os: Mac OS 15.7.5 [64-bit]