Rust is rolling out a new defense against supply chain attacks with the upcoming 1.100 release: optional **security cooldowns** in Cargo. Scheduled for November 12, 2026, this feature gives teams the power to delay newly published crates—allowing more time to catch malicious updates before automated workflows pull them in. The cooldown tool is already available in beta and awaits inclusion in stable Rust. Unless configured, however, the default still accepts fresh releases immediately.
Why Cooldowns Are Being Added
The change was triggered by a high-impact incident in August involving malicious code sneaking into dependencies. A crate called proc-macro1was behind the compromised updates of arrayref, internment, and append-only-vec, bringing in harmful payloads via its build script—even though no visible code changes were made.
Those compromised releases were live on crates.io for 86, 90, and 107 minutes respectively. Despite removal within two hours, automated systems and CI pipelines could already have integrated them. That gap exposed a weakness: defenders didn’t have enough time to catch problems before code shipped.
How the Cooldown System Works
Developers can set a minimum age policy for published crates using `global-min-publish-age` in `.cargo/config.toml` under the `[registry]` section. For instance, specifying `”7 days”` sets a week-long waiting period for any new versions. The period can be expressed in seconds, minutes, hours, days, weeks, or months.
When resolving dependencies, Cargo will ignore any release younger than the set threshold. If no acceptable version meets a project’s requirements, dependency resolution fails rather than automatically accepting a fresh release. This is designed to prevent attacks where malicious versions appear momentarily and push out safer ones.
Some releases won’t be affected: versions already locked in `Cargo.lock` remain usable even if they fall below the cooldown threshold. The feature also excludes Git dependencies, local paths, and registries without publication timestamps. For emergencies, there’s a bypass: using an environment variable (`CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow`) lets developers force a specific update.
Remaining Risks Beyond Timing
A cooldown doesn’t equal full security. It adds breathing room but doesn’t analyze code for malicious behavior. Past incidents showed damage from crates that behaved normally while hiding harmful actions.
Also concerning is compromised maintainer accounts. Even with delays, attackers can still publish criminal code if they gain access. One campaign in September targeted Rust maintainers with fake job offers and video calls, aiming to trick them into installing malware. Delaying updates won’t stop this kind of threat.
So far this safety measure has been in motion for months—nightly Cargo gained support in June. Stability was merged in August, and draft release notes now list security cooldowns as part of Rust 1.100.
In many ways this change rules dependency selection officially into the security domain, not just maintenance. Teams choosing not to opt in will still be exposed to risk, especially when malicious packages are published briefly then removed.
This shift matters because it reflects growing pressure to secure supply chains across all major programming ecosystems—and Rust is no exception. Watch to see how the community adopts cooldowns, whether ecosystem tools adapt to this practice, and how such policies might evolve to include more automated vetting or reputation systems.
