Rust 1.100 adds optional Cargo cooldowns for newly published crates
Original title: Rust 1.100 Introduces Cargo Security Cooldowns to Prevent Malicious Dependency Attacks
The cooldown stays off by default, is only in beta, and will not drop versions already pinned in Cargo.lock.
Rust 1.100, scheduled for November 12, 2026, will let Cargo ignore dependency releases younger than a configured minimum age. The control is in beta, not stable Rust, and the default wait is zero, so an upgrade alone does not enable it. Socket.dev tied the work to an August incident in which proc-macro1 and updates to arrayref, internment, and append-only-vec stayed on crates.io for 86 to 107 minutes while a build script fetched a payload.
Unconfirmed: Dwell times of 86, 90, and 107 minutes are attributed to Rust security responders cited by Socket, not independently verified here.
- Developers set global-min-publish-age, for example "7 days", under [registry] in .cargo/config.toml.
- If no release is old enough, resolution fails instead of taking the new crate.
- cargo install, Git dependencies, local paths, and registries without timestamps are excluded.
- A one-command bypass is CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow with cargo update --precise.
- Socket also described September fake job offers aimed at Rust crate owners.
Impact: Malicious build scripts ran during compilation of trusted crates
| Product | Affected |
|---|---|
| crates.io publishers proc-macro1 | — |
| crates.io publishers arrayref | — |
| crates.io publishers internment | — |
| crates.io publishers append-only-vec | — |
- 1.Set a non-zero global-min-publish-age before relying on Cargo 1.100 cooldowns.
- 2.Review lockfiles for proc-macro1, arrayref, internment, and append-only-vec from the August incident.
- Malware
- proc-macro1
- Organizations
- Socket.dev
From the original article
3 min read at cybersecuritynews.com
Rust 1. 100 will introduce optional security cooldowns in Cargo, giving developers a way to delay newly published dependencies before they enter projects. Scheduled for November 12, 2026, the release aims to give security teams and package maintainers time to spot malicious updates before automated builds pull them in.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.