Rust 1.100 to Introduce Cargo Dependency Cooldowns
The upcoming software release adds a security feature that blocks new package versions until they reach a minimum age.
Updated on Oct. 21, 2026 in Software
Live Poll
Do you trust automated security features to protect software development pipelines from malware?
Rust 1.100 is scheduled for release on November 12, 2026, featuring stable support for Cargo dependency cooldowns. This tool allows developers to automatically reject new package versions until they reach a configurable minimum age.
Why it matters
The new cooldown feature provides maintainers, registries, and security researchers with a buffer period to detect malicious releases. This window helps prevent the accidental adoption of compromised code before it propagates across the ecosystem.
The Rust 1.100 update brings stable support for dependency cooldowns to the Cargo package manager. Developers can configure a specific minimum age requirement to automatically block updates to newly published package versions.
The details
By configuring a minimum age requirement, developers can ensure that incoming package versions have existed for a set duration before they are accepted into a project. This mechanism serves as a defensive layer against supply chain attacks that rely on the immediate automated ingestion of new code.
Timeline
November 12, 2026: Official release of Rust 1.100.
The Tech Race
This update builds upon the existing architecture of the Cargo package manager to address growing concerns regarding software supply chain security. By implementing native time-based blocking, Rust is transitioning toward a more cautious automated update model to counter sophisticated malicious release strategies.
Developers will need to adjust their project configurations to set appropriate minimum age requirements for their dependencies. This change helps users reduce the risk of automatically pulling malicious code into their software builds.
The takeaway
Developers should prepare to audit their dependency management strategies ahead of the version 1.100 release. Implementing age-based cooldowns is a practical step to harden project security against the rapid propagation of newly introduced malicious packages.
What happens next
Rust 1.100 is scheduled for general release to the developer community on November 12, 2026.
Further reading
Learn more about the latest updates in the Software section.
Source note: This article includes information reported by IT Security News - cybersecurity, infosecurity news.
Live Poll
Do you trust automated security features to protect software development pipelines from malware?
