As cited
Copy frozen at (site build).
vulnerabilities
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100, scheduled for November 12, will stabilize a configurable minimum publish age feature that lets Cargo delay adoption of newly released dependencies. Teams can set a waiting period, such as seven days, to give researchers and maintainers time to detect malicious releases before they spread through dependency chains. The feature remains optional with a default of zero days, requiring teams to explicitly enable it in their configuration.
Why it matters: Rust developers and supply chain security teams should enable this feature to reduce exposure to compromised dependencies like the malicious crates (arrayref, internment, append-only-vec) that circulated in August 2026 for 86 to 107 minutes before removal.
- Source published
- First seen by Cybersecurity Tracker