CratesBump

A version-bump dataset for the Rust ecosystem — over two million consecutive crates.io release pairs labelled as major, minor or patch, plus the tool that builds it.

CratesBump on GitHub CratesBump paper (PDF)

📄 Paper (under review): CratesBump: A Version-Bump Dataset for the Rust Ecosystem — Muhammad Hassnain. The dataset and tool are public.

Semantic versioning tells a crate’s users what to expect from an upgrade: a patch release should be a safe drop-in, a minor release only adds things, and a major release may break code. Cargo relies on these promises to decide which upgrades to pull in automatically. In practice, maintainers pick the version number by hand, and nothing checks whether the release they published actually matches it.

CratesBump is a public dataset for studying that gap in the Rust ecosystem. It pairs every release of a crate with the release before it — 2,079,790 consecutive release pairs from 219,955 crates, every crate on crates.io with at least two releases before 14 September 2026 — and describes each pair with 41 features:

  • Code changes, from an AST diff (using syn) of the published source of the two releases;
  • Dependency, complexity and timing changes between the releases;
  • Repository activity from GitHub: commits, issues and pull requests.

Each pair carries two labels: the literal MAJOR.MINOR.PATCH reading of the version number, and Cargo’s own reading, under which a 0.y bump counts as breaking.

How CratesBump is built: a crates.io dump, the crate tarballs and GitHub feed a Rust extractor that pairs each release with its predecessor and computes 30 code and dependency features plus 11 repository-activity features; each pair gets a literal and a Cargo label and passes a consistency check, producing a dataset of 2,079,790 pairs from 219,955 crates; example uses include benchmarking on held-out repositories, a temporal split, feature-family ablation, pre-1.0 breaks reaching dependents, and an API-break audit.
How CratesBump is built (1–4) and used (5).

The repository also ships semver-extract, the Rust and Python tool that rebuilds the dataset from crates.io and the GitHub API, along with scripts that reproduce every result in the paper. The feature design adapts Abdalkareem, Chowdhury and Shihab’s study of npm releases (arXiv:2204.05929) to Rust.

The dataset can be used to train and benchmark models that predict the right version bump for a release, to measure how often pre-1.0 breaking changes reach a crate’s dependents, and to audit releases whose version number understates how much their public API changed.

The code is released under the MIT license and the dataset under CC BY 4.0.