Cratesio outage history

We are experiencing what looks like a coordinated DoS attack against our API servers. We are monitoring the situation and are assessing our reaction. Crate downloads and dependency resolution through the sparse/git index should not be affected.

We are continuing to investigate this issue.

We have deployed countermeasures and our servers are largely back to normal again. We keep monitoring the situation. If you encounter any issues please let us know!

This incident has been resolved. Big thanks to Fastly for providing their CDN services and their fast response time!

crates.io responses are unusually slow due to database issues, with occasional 500s due to database timeouts. We are investigating.

The read-only replica database used for many of our common queries is under heavy load. We are evaluating options to deal with this.

The primary source of the load appears to have been a scraper abusing our API. We have blocked the scraper and the replica database has returned to its normal heavily loaded state instead of being overloaded.

The reverse dependencies pages are temporarily unavailable. Other crates.io functionality should continue to function normally.

Reverse dependencies remain disabled, but the rest of crates.io is functioning normally.

This incident has been resolved.

Crates.io is currently under a suspected denial of service effecting the web frontend. The reverse dependency endpoint has been disabled. You will not be able to browse reverse dependencies on crates.io for the duration of the incident. All other operations, publishes and the index are operating normally.

All endpoints are now operational and available again.

The crates.io background worker is having a bad morning, and a backlog of Git index updates has accumulated. We have given the worker some coffee and it's catching up, but index updates for newly-published crates are running about an hour behind right now. The sparse index (used by default by all modern Rust versions) is unaffected.

The background worker has been told to get itself together. The queue is now trending downwards, but git index updates are still running an hour behind. We are continuing to monitor, but we expect this to resolve over the next few hours.

The indexes are now back to normal operations.

The crates.io background worker is having a bad morning, and a backlog of Git index updates has accumulated. We have given the worker some coffee and it's catching up, but index updates for newly-published crates are running about an hour behind right now. The sparse index (used by default by all modern Rust versions) is unaffected.

The background worker has caught up, and crate publishes are now updating normally in both indexes.

crates.io is currently experiencing degraded performance on any requests that hit the database (which is basically anything in the API except crate downloads). We are investigating.

The slowdown is definitely database related, and we are in contact with our upstream provider to see if we can track down what the root cause might be.

The 2025 version of "it's always DNS" might be "it's always AI scrapers pretending to be other things". Our database provider pointed out an expensive endpoint that was being hit just enough by a single IP to cause the incident, but not enough for our normal monitoring setup to detect it. We have blocked that IP and response times appear to be returning to normal. Continuing to monitor for a few minutes, but this looks good at the moment.

Everything continues to look stable, so we can consider this resolved.

Due to a large number of crate versions being published in the last few hours, the legacy Git crate index is currently approximately 245 crate versions (or about two hours) behind. The sparse index (which has been the default since Rust 1.70, released in June 2023) is unaffected.

The queue burndown has slowed due to an unusual number of crate publishes in the last hour, but it is slowly making progress and is now at 206 pending syncs. It could be anywhere from 2-4 hours from here until it catches up.

Now at 116 pending syncs. Probably 1½ hours before we're caught up, give or take.

57 pending syncs.

All published crates have been synced to the Git index, and there is now no backlog.

A backlog of CDN invalidations is causing a backlog of approximately 350 crate backlog for sparse index updates and CDN updates. We are monitoring as the queue is worked through.

The sparse index has synchronized and is now up-to-date. CDN updates are still processing.

The backlog has cleared and all queues are nominal.

This incident has been resolved.

Due to a large number of crate versions being published in the last few hours, the legacy Git crate index is currently approximately 280 crate versions (or about two hours) behind. The sparse index (which has been the default since Rust 1.70, released in June 2023) is unaffected.

The Git index sync job backlog is slowly burning down, and is anticipated to catch up in a few hours. We will continue to monitor the situation.

The Git index has caught up and is now up to date.

Since approximately 05:20 UTC, index entries in the Git and sparse crate indexes have not been published. We are investigating.

Background workers have been restarted.

Indexes are up to date, and we are monitoring the background workers to ensure they continue to pick up new jobs.

Crates published since the background workers were restarted are now appearing in the index, and the backlog of background jobs has been processed successfully.

We are in the process of upgrading our database servers. This will require a short amount of time in read-only mode and a couple of minutes with degraded performance while our follower database is catching up with the new leader.

We noticed a small issue with our database indexes after the upgrade, resulting in several crates not being found anymore. We've reindexed the relevant tables which appears to have fixed the problem. The new follower database is catching up an will soon be available to improve the API response times again.

Database server upgrade is complete and crates.io should be running at full capacity again now. Hopefully even a bit faster than before due to increased memory on the new database servers.

This incident has been resolved.

We are investigating the crates.io API and website being unreachable. Crate downloads should not be affected.

The application is recovering, but we are still investigating trying to find the root cause. The incident seems to be unrelated to the one earlier today.

The application is stable, marking the incident as resolved. We will continue investigating the root cause of this.

We are investigating the crates.io website and API being unavailable. Downloads from recent Cargo versions should be working, but older Cargo releases relying on the crates.io API are affected.

We have identified a problem with our read-only database replica and routed traffic away from it. We are monitoring the recovery, and we will continue investigating the cause of the problem.

Since the last update, crates.io fully recovered and we are serving traffic as usual. We're continuing to monitor the situation and we'll re-enable the read-only replica again soon.

This incident has been resolved.

The crates.io team will perform a database maintenance on 2024-03-15 from 12:00 to 12:15 UTC. We expect this to take less than 15 minutes to complete. During maintenance, crates.io will only be available in read-only mode: downloading crates and visiting the website will still work, but logging in, publishing crates, yanking crates, or changing owners will not work.

Scheduled maintenance on our database is starting. We expect this to take less than 15 minutes to complete. During maintenance, crates.io will only be available in read-only mode: downloading crates and visiting the website will still work, but logging in, publishing crates, yanking crates, or changing owners will not work.

Scheduled maintenance finished successfully.

Some crates.io endpoints are timing out at present, including the summary route that drives the crates.io home page. We are investigating.

(If this looks suspiciously similar to https://status.crates.io/incidents/t49v2pfpv0vl, the same issue reappeared on the summary endpoint literally within seconds of resolving that incident. C'est la vie.)

We believe this issue is being caused by excess database load related to a bug fix deployed earlier today around download counting. This bug fix has caused the normal background processing of per-crate download count totals to take significantly longer and require more resources than usual. We will shortly be temporarily disabling the summary endpoint to alleviate some of the load on the database.

The long running background job has completed, and response times for the summary endpoint have returned to normal. The next invocation of the relevant background job will be at 00:30 UTC (so in just under 20 minutes); we will be monitoring that closely to see if any problems resurface at that point.

We are continuing to monitor for any further issues.

crates.io has returned to normal service with the processing of the download count backlog from earlier and the completion of the long running background jobs. Investigations will continue during normal hours for the crates.io team to ascertain what is causing elevated database load.

Some crates.io endpoints are timing out at present, including the summary route that drives the crates.io home page. We are investigating. Crate downloads are unaffected.

Restarting the dynos has restored service, but we are still investigating the root cause of the issue, and continue to monitor crates.io performance.

crates.io continues to operate normally, and no further performance degradation or timeouts have been observed.

We are currently investigating this issue.

Download traffic has been temporarily redirected and the system is recovering. We are monitoring the situation.

Download traffic is being treated and counted regularly again. We are continuing to monitor for any further issues.

The incident has been resolved. Traffic and error rates are back to normal levels. The root cause has been identified and we are assessing solutions to avoid it from happening again in the future.

The crates.io team will perform a database maintenance on 2023-12-21 from 11:00 to 11:15 UTC. We expect this to take less than 15 minutes to complete. During maintenance, crates.io will only be available in read-only mode: downloading crates and visiting the website will still work, but logging in, publishing crates, yanking crates, or changing owners will not work.

Scheduled maintenance on our database is starting. We expect this to take less than 15 minutes to complete. During maintenance crates.io will only be available in read-only mode: downloading crates and visiting the website will still work, but logging in, publishing crates, yanking crates or changing owners will not work.

Scheduled maintenance finished successfully.

At 19:04 UTC a faulty deployment caused the crates.io API to not be reachable anymore. We immediately initiated a rollback to the previous deployment and the issue was resolved at 19:06 UTC. We are currently in the process of figuring out the root cause.