Rust 1.100 Will Add Dependency Cooldowns to Cargo
Blog post from Socket
Rust 1.100, scheduled for November 12, 2026, will introduce an opt-in Cargo dependency cooldown that lets teams require newly published registry crates to reach a configurable minimum age before they can be selected during dependency resolution. Prompted by ongoing supply-chain risks, including August compromises involving malicious Rust crates that remained available for less than two hours, the feature is intended to give security researchers, maintainers, and registries more time to identify harmful releases before they spread through projects and CI systems. Teams can configure a waiting period such as seven days in Cargo’s settings, and Cargo will reject versions that are too new rather than merely prefer older ones, helping prevent attackers from forcing malicious updates by yanking legitimate releases. Existing lockfile versions remain usable, while developers can temporarily override the policy for urgent updates. The cooldown does not cover cargo install, Git dependencies, local paths, or registries lacking publication timestamps, and it cannot protect against malicious releases that remain undetected beyond the waiting period.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.