Rust Cargo Adds Opt-In Dependency Cooldowns to Reduce Supply-Chain Attack Exposure

Rust 1.100, scheduled for release on November 12, 2026, will introduce optional Cargo security cooldowns that exclude newly published dependency releases until they reach a configured minimum age. Already available in beta, the feature defaults to a zero waiting period, so development teams must explicitly enable it. During dependency resolution, Cargo can select older eligible versions or fail resolution if none qualify, giving defenders time to identify and remove malicious releases before adoption.

The protection addresses attacks such as an August supply-chain compromise involving malicious releases of arrayref, internment, and append-only-vec, which introduced proc-macro1, whose build script downloaded a payload during compilation. Cooldowns reduce exposure to rapidly detected malicious packages but do not inspect code, prevent maintainer-account compromise, or replace existing lockfile entries; coverage also varies by dependency source and installation method. Teams adopting the feature should configure an explicit waiting period and retain dependency scanning, lockfile review, and build security controls.