Rust 1.100 adds opt-in Cargo cooldowns for new package versions
Original title: Rust 1.100 Will Let Developers Block Fresh Cargo Packages to Reduce Malware Supply Chain Risks
Teams must set a minimum publish age; the default stays zero, so upgrading Rust alone changes nothing.
Rust 1.100, scheduled for November 12, 2026, will stabilize Cargo dependency cooldowns so projects can reject package versions younger than a configured age. The opt-in check fails resolution when no eligible version remains instead of accepting a newer release. Existing Cargo.lock entries stay valid. Git and path dependencies, and registries without publication timestamps, fall outside the check.
Unconfirmed: Stabilization is listed in draft notes for a November 12, 2026 release that has not shipped.
- A seven-day delay uses global-min-publish-age = "7 days" under [registry].
- resolver.incompatible-publish-age defaults to "deny".
- Socket said arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 lasted 86, 90, and 107 minutes.
- Those releases introduced proc-macro1, whose build script downloaded a payload.
- Urgent overrides use CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow.
- Malware
- proc-macro1
- Organizations
- Socket
From the original article
2 min read at gbhackers.com
Rust 1. 100, scheduled for November 12, 2026, will introduce stable support for Cargo dependency cooldowns, allowing developers to reject newly published package versions until they reach a configurable minimum age. The feature gives security researchers, maintainers, and registries time to identify malicious releases before automated updates spread them across development environments and CI pipelines access.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.