Rust has reached a milestone: Rust 1.100, scheduled for release on November 12, 2026. The headline feature for teams shipping production code is a security one – stable Cargo dependency cooldowns. With a single config line you can tell Cargo to ignore crate versions that were published too recently, which blocks most “publish-and-pounce” supply-chain attacks.

Why Dependency Cooldowns Matter

Malicious package releases are usually caught quickly – but not before some builds pull them in. Socket researchers highlighted malicious crate releases in August 2026 (including versions of arrayref, internment and append-only-vec) that were live for only 86 to 107 minutes before removal. If your CI ran cargo update in that window, you were exposed.

A cooldown simply says: “don’t use any version younger than N days.” Most attacks are detected and yanked long before that.

How to Enable a Cargo Dependency Cooldown

Add a minimum publish age in .cargo/config.toml (project-level or in ~/.cargo/config.toml for your whole machine):

# .cargo/config.toml
[registry]
global-min-publish-age = "7 days"

Units from seconds up to months are supported, so you can use values like "48 hours" or "2 weeks".

How It Behaves

• The default minimum age is zero, so the feature is opt-in.
• When a version is too new, resolver.incompatible-publish-age defaults to "deny" and Cargo picks an older compatible version instead.
• Existing entries in Cargo.lock stay valid – the check applies when resolving new versions.
• Git dependencies, path dependencies and registries that don’t provide publish timestamps are not checked.

Overriding for an Urgent Security Fix

Sometimes you need a fresh release – for example, a patch for a critical CVE. Override the policy for one command:

CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow \
  cargo update -p some-crate --precise 1.2.3

Document these overrides in your PR so reviewers know why a brand-new version was accepted.

Recommended Setup for Teams

# Commit this to your repo so CI and developers share the same policy
[registry]
global-min-publish-age = "7 days"

• Commit Cargo.lock for binaries and services.
• Run cargo update on a schedule (e.g., weekly via Dependabot or Renovate) rather than on every build.
• Combine cooldowns with cargo audit or cargo deny for known-vulnerability checks.

cargo install cargo-audit
cargo audit

What About the Never Type?

Rust developers have also been celebrating the long-awaited stabilization of the never type (!), which landed in Rust 1.99 – with std::convert::Infallible becoming an alias for !. Together with dependency cooldowns, it makes this autumn one of the most significant release periods for the language in years.

Same Idea in Other Ecosystems

Dependency cooldowns are becoming a best practice across languages. tools such as pnpm (minimumReleaseAge), Python’s uv (exclude-newer) and Renovate (minimumReleaseAge) offer similar controls – consider applying the same policy to your JavaScript and Python projects too.

Conclusion

A Cargo dependency cooldown is one of the cheapest supply-chain defences you can deploy: one line of config, no new tools, and it neutralises attacks that rely on being installed within hours of publication. Upgrade to Rust 1.100, add global-min-publish-age, and make it part of your team’s standard template.