Rust 1.100 adds optional dependency delays to help teams catch malicious code before it enters their builds.
Key points
- Rust 1.100 introduces opt-in dependency cooldowns to Cargo, scheduled for release on November 12.
- The feature allows teams to set a minimum publish age for dependencies, delaying adoption of new releases.
- Recent attacks showed malicious crates remained on the registry for under two hours before removal.
Rust 1.100 will include optional dependency cooldowns in Cargo, allowing developers to delay the adoption of newly published packages. This feature gives security scanners and maintainers time to detect malicious releases before they spread to more projects.
What happened
Rust 1.100, scheduled for November 12, will add stable support for configurable minimum publish ages in Cargo. The stabilization pull request merged on August 28, and the feature is currently available in beta but not yet in stable Rust. Teams must manually enable this setting, as the default minimum publish age remains zero.
According to Socket, attackers recently published compromised versions of arrayref, internment, and append-only-vec. These crates depended on proc-macro1, a malicious package whose build script downloaded a payload. The Rust Security Response Team reported that these releases were available on crates.io for 86, 90, and 107 minutes respectively before removal.
Why it matters
Dependency selection is a security decision, not just routine maintenance. When Cargo resolves packages, it can execute build scripts during compilation. This allows malicious code to run on developer machines or in continuous integration systems before the application code is even used. A short delay gives defenders time to identify and remove harmful releases.
The fix
- Set global-min-publish-age to a duration like "7 days" in .cargo/config.toml under the [registry] section.
- Cargo will exclude releases younger than this threshold when selecting dependency versions.
- If no eligible older version satisfies requirements, resolution fails instead of accepting the new release.
- Cargo reports when the cooldown is active and identifies newer versions it passed over.
Why it matters
Teams usually rely on automated updates to keep dependencies current. However, this speed can expose systems to newly published malicious code before researchers have time to investigate. Configuring a waiting period ensures that fresh releases do not immediately enter the build process. It is important to verify that your configuration enforces a hard block on new packages rather than merely preferring older ones. This prevents attackers from forcing adoption by removing legitimate versions.
What to do and how to stay safe: Rust
- Check your Cargo configuration files for any existing registry settings that might affect dependency resolution.
- Review your continuous integration pipelines to ensure they do not bypass local configuration settings during builds.
- Monitor security advisories from Rust maintainers for updates on supply chain threats and recommended mitigation strategies.
- Once the vendor provides an update, test the cooldown feature in a non-production environment before enabling it broadly.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does upgrading to Rust 1.100 automatically enable dependency cooldowns?
No, the default minimum publish age remains zero, so teams must manually configure the setting to enable protection.
What happens if Cargo cannot find an older version of a dependency that meets the requirements?
Dependency resolution fails rather than accepting the new release, preventing the build from proceeding with potentially malicious code.
Can developers override the cooldown for urgent fixes?
Yes, the resolver preserves versions already recorded in Cargo.lock, so enabling a cooldown does not retroactively reject existing dependencies.
