Rust 1.100 stabilizes Cargo cooldowns to enforce minimum dependency age and mitigate supply chain risks
The upcoming Rust release introduces configurable delays for new package adoption, helping teams mitigate risks from malicious crate injections.
Key points
- Rust 1.100, due 12 November, stabilises opt-in dependency cooldowns in Cargo.
- The feature allows teams to enforce a minimum age for published dependencies.
- Default settings remain at zero; organisations must configure protection manually.
Cargo, the package manager for the Rust programming language, will gain configurable dependency cooldowns in version 1.100. This feature, scheduled for release on 12 November, allows development teams to enforce a minimum publish age for dependencies. It provides security scanners and maintainers additional time to detect malicious crate releases before they are adopted by downstream projects.
Root cause
The development of this feature predates recent supply chain incidents. Work began on 18 May, with nightly support arriving on 21 June. The stabilization pull request merged on 28 August. Socket researchers documented how attackers exploited short windows between publication and removal to inject malware. Compromised versions of arrayref, internment, and append-only-vec depended on a malicious proc-macro1 crate that downloaded payloads during build scripts.
Attack path
Attackers published compromised crates that spread through trusted dependencies. The malicious proc-macro1 crate executed code during compilation, bypassing application-level checks. According to the Rust Security Response Team, these releases remained on crates.io for between 86 and 107 minutes before removal. Automated updates could pull this code into developer machines and continuous integration systems before investigators identified the threat.
Affected versions
- Rust 1.100 will include stable support for the feature.
- The functionality is currently available in beta and nightly builds.
- Earlier stable versions of Rust do not support configurable publish age limits.
Mitigation
- Set global-min-publish-age in .cargo/config.toml to enforce a waiting period.
- Use duration formats such as days, weeks, or months for the configuration.
- Monitor Cargo diagnostics for resolution failures due to age restrictions.
- Review locked versions in Cargo.lock to ensure they meet security policies.
What it means for organisations
Operations teams should assess whether automated dependency updates align with current security review cycles. Engineering leads need to determine if manual approval gates are necessary for new package versions. Security officers must evaluate if existing scanners can detect malicious code within the configured cooldown window. Internal communications should clarify that enabling this feature is optional and requires explicit configuration. Teams should verify that build pipelines handle resolution failures gracefully without blocking critical development workflows or deployment schedules unexpectedly.
Background: Supply chain attacks
Supply chain attacks in cyber security exploit the trust you place in third-party software components. Attackers inject malicious code into legitimate updates or build pipelines. You receive the payload as if it were benign. Defending requires verifying code origins, isolating build environments and treating all external inputs as hostile.
Read the full guide: Supply chain attacks in cyber security: how they work and how to stop them
What to do and how to stay safe: Rust
- Configure a minimum publish age in your Cargo configuration files to delay adoption of new dependencies.
- Audit current dependency update processes to identify where automated pulls might bypass security reviews.
- Monitor official Rust security advisories for guidance on configuring resolver settings for age restrictions.
- Ensure development environments are updated to beta or stable releases that support these cooldown features.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does Rust 1.100 automatically block new dependencies?
No, the feature is opt-in and requires manual configuration in .cargo/config.toml.
What happens if no eligible version meets the age requirement?
Dependency resolution fails deliberately to prevent falling back to potentially malicious new releases.
Can developers override the cooldown for urgent fixes?
Yes, versions already recorded in Cargo.lock are preserved even if they are younger than the limit.
