Skip to content
NewA calmer, faster ZeroHour
StoryToolsinfo

Rust 1.100 to add optional Cargo publish-age cooldowns

2 sources · 2 articlesFirst reported Updated ()
What's new

October 21: Reports specify a zero default, failed resolution when nothing is old enough, lockfile preservation, excluded dependency types, and Socket’s 86–107 minute window.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Rust 1.100, due November 12, 2026, will let Cargo reject dependency versions younger than a configured age, off by default.

Rust 1.100, scheduled for November 12, 2026, will stabilize an opt-in Cargo check that rejects package versions younger than a configured minimum publish age. The default age remains zero, so upgrading alone does not enable the cooldown; the control is in beta and not yet on stable Rust. If no eligible version remains, resolution fails rather than accepting a newer release, while existing Cargo.lock pins stay valid. Git and path dependencies, cargo install, and registries without publication timestamps are excluded. Socket tied the work to an August incident in which proc-macro1 and updates to arrayref, internment, and append-only-vec remained on crates.io for 86 to 107 minutes while a build script fetched a payload.

Key facts
  • Rust 1.100 is scheduled for November 12, 2026; the control is still beta.
  • A seven-day wait uses global-min-publish-age = "7 days" under [registry].
  • resolver.incompatible-publish-age defaults to "deny" when no version is old enough.
  • Existing Cargo.lock entries stay valid; Git, path, and timestamp-less registries are excluded.
  • Socket said arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 lasted 86, 90, and 107 minutes.
  • Urgent override: CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow, including cargo update --precise.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 12, 2026Rust 1.100 scheduled to stabilize Cargo cooldowns · GBHackers

What each outlet adds

beyond the shared facts
  • GBHackersPer-crate lifetimes of 86, 90, and 107 minutes, and the deny default.
  • Cyber Security NewsSeptember fake job offers and a cargo update --precise bypass.
Products
RustCargo
Malware
proc-macro1
Organizations
Socket.devSocket

Coverage

oldest first · one row per article · UTC
  1. · 4d ago GBHackersFirst report

    Rust 1.100 adds opt-in Cargo cooldowns for new package versions

    Teams must set a minimum publish age; the default stays zero, so upgrading Rust alone changes nothing.

  2. · 4d ago Cyber Security News

    Rust 1.100 adds optional Cargo cooldowns for newly published crates

    The cooldown stays off by default, is only in beta, and will not drop versions already pinned in Cargo.lock.