Rust 1.100, scheduled for November 12, 2026, will introduce stable support for Cargo dependency cooldowns, allowing developers to reject newly published package versions until they reach a configurable minimum age.
The feature gives security researchers, maintainers, and registries time to identify malicious releases before automated updates spread them across development environments and CI pipelines access. Rust’s draft release notes explicitly list the stabilization.
The protection is opt-in. Cargo’s default minimum publish age remains zero, meaning upgrading Rust alone will not delay dependency adoption.
Teams must configure an age threshold to activate the safeguard, which filters dependency selection rather than scanning packages for malicious code.
The security rationale became tangible during August’s compromise of arrayref, internment, and append-only-vec.
Malicious versions introduced proc-macro1, a crate whose build script downloaded a malicious payload.
Those short exposure windows illustrate the problem: dependency resolution can deliver attacker-controlled code before investigators complete verification and registry takedowns.
A configured waiting period could prevent newly resolving projects from selecting such releases during that interval, provided the affected versions were not already locked.
Attackers also yanked legitimate arrayref releases, a tactic directly relevant to Cargo’s enforcement model.
Merely preferring older packages would leave a dangerous fallback: if safe versions disappear from consideration, a resolver might accept the malicious newcomer.
Cargo instead rejects versions below the configured age and fails when no eligible version satisfies dependency requirements.
Rust 1.100 Strengthens Cargo
Developers can enable a seven-day delay by adding global-min-publish-age = "7 days" beneath [registry] in .cargo/config.toml.
Cargo supports duration units including seconds, minutes, hours, days, weeks, and months. The resolver.incompatible-publish-age setting defaults to "deny", so an additional resolver entry is normally unnecessary.
During resolution, Cargo excludes releases younger than the threshold while retaining older versions that meet the project’s constraints.
Its diagnostics identify skipped newer releases and explain resolution failures. Registry-specific settings allow organizations to apply different waiting periods to different package sources.
The design extends enforcement beyond dependency-update bots. As the feature’s RFC explains, external automation cannot consistently govern local manifest edits, direct Cargo updates, or implicit lockfile changes.
Native resolver enforcement brings those workflows under the same configured policy.
Socket Researchers said that, Rust security responders removed arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 after they remained available for 86, 90, and 107 minutes, respectively.
Existing Cargo.lock entries remain valid even when their versions are younger than the threshold. Enabling the feature therefore does not retroactively remove a recently adopted malicious dependency.
This exception preserves recorded resolutions but makes lockfile review essential to understanding actual coverage.
For urgent fixes, developers can temporarily bypass enforcement with CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p some-crate --precise 1.2.3.
The override also permits newly resolved transitive dependencies; subsequent resolutions retain versions recorded in the lockfile.
Coverage depends on registry publication timestamps. Git dependencies access, local path dependencies, and registries lacking that metadata fall outside the check. Legitimate fixes also face the waiting period unless explicitly overridden.
Cooldowns buy response time, not proof of safety. Malicious releases that evade detection can simply age past the threshold.
The RFC consequently warns against relying on this mechanism as a standalone defense against compromised dependencies in production workflows.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
