Rust 1.100 Adds Cargo Dependency Cooldowns to Block Fresh Malware Packages

Developers using the Rust programming language will gain a new tool to slow down the adoption of fresh package versions when Rust 1.100 releases on November 12, 2026. According to GBHackers, this version introduces stable support for Cargo dependency cooldowns, allowing teams to reject packages that have been published for less than a specified amount of time.

This update aims to reduce supply chain malware risks by creating a buffer period. The feature gives security researchers and registry maintainers time to identify malicious releases before automated updates spread them across development environments and CI pipelines. GBHackers reports that Rust’s draft release notes explicitly list this stabilization, marking a shift in how dependency resolution can be managed for security.

Context and Background

The security rationale for this feature became clear during the August compromise of the arrayref, internment, and append-only-vec crates. Malicious versions of these packages introduced a proc-macro crate whose build script downloaded a malicious payload. GBHackers notes that these short exposure windows illustrate the problem: dependency resolution can deliver attacker-controlled code before investigators complete verification and registry takedowns.

Attackers also yanked legitimate arrayref releases, a tactic that complicates simple age-based filtering. Merely preferring older packages would leave a dangerous fallback if safe versions disappear from consideration, potentially forcing a resolver to accept a malicious newcomer. Cargo instead rejects versions below the configured age and fails when no eligible version satisfies dependency requirements, ensuring safety over convenience.

Who Is Affected

Teams building with Rust are the primary audience for this change, but the protection is entirely opt-in. GBHackers states that Cargo’s default minimum publish age remains zero, meaning upgrading to Rust 1.100 alone will not delay dependency adoption. Developers must actively configure an age threshold to activate the safeguard. This design extends enforcement beyond dependency-update bots, requiring manual intervention in configuration files.

Our take on the response

The decision to make this feature opt-in suggests a balance between security and development velocity. By requiring teams to add global-min-publish-age settings in their config files, Rust places the responsibility on organizations to assess their risk tolerance. GBHackers explains that Cargo supports various duration units, allowing flexibility. This approach prevents breaking existing workflows while offering a robust defense against time-sensitive supply chain attacks.

For customers and users

Organizations should review their software supply chain policies to determine if a waiting period for new dependencies aligns with their security goals. Teams usually benefit from establishing clear guidelines on how quickly new package versions are accepted into production environments. Users should check whether their build systems automatically pull the latest releases without human review. It is also wise to monitor official channels for announcements regarding compromised packages, as follow-up scams often target users seeking immediate fixes or workarounds after a breach.

What to do and how to stay safe: Rust

• Review your Cargo configuration files to determine if you want to enable a minimum publish age threshold.
• Monitor your dependency updates for any unexpected behavior or new packages that appear shortly after publication.
• Ensure your CI/CD pipelines are configured to respect local configuration settings rather than bypassing them for speed.
• Stay informed about security announcements from the Rust maintainers regarding supply chain incidents.

Step-by-step guide: Incident Response Plans: How to Stop Damage When Attacks Happen

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Rust 1.100 automatically block new packages?

No, the feature is opt-in. The default minimum publish age remains zero, so upgrading alone will not delay dependency adoption.

How do developers enable the cooldown feature?

Developers can enable it by adding global-min-publish-age settings in the .cargo/config.toml file, specifying durations like days or weeks.

What problem does this feature solve?

It provides time for researchers to identify malicious releases before automated updates spread them, addressing risks seen in recent crate compromises.