Rust 1.100 Introduces Cargo Security Cooldowns to Mitigate Malicious Dependency Attacks
Rust 1.100's new Cargo security cooldown feature allows developers to set a minimum age for new dependencies, providing a crucial window to vet packages and prevent supply-chain compromises.
The upcoming Rust 1.100 release, slated for November 12, 2026, will introduce an optional security cooldown feature for Cargo, the Rust package manager. This new functionality aims to significantly bolster supply-chain security by allowing developers to enforce a minimum age for new dependencies before they are automatically integrated into projects. The primary goal is to provide security teams and package maintainers with a critical window to identify and vet newly published packages, thereby preventing malicious updates from infiltrating development pipelines.
The feature was developed in response to recent supply-chain incidents, such as the compromise involving the arrayref, internment, and append-only-vec crates. In this attack, a malicious crate (proc-macro1) was published and quickly exploited. Its build script downloaded a payload, demonstrating how a seemingly trusted dependency can introduce malware into developer systems without obvious alterations to the application's core code. The compromised releases in that incident remained on the crates.io registry for mere minutes before removal, highlighting the speed at which automated build systems could incorporate such threats.
While the cooldown feature was in development before the arrayref incident, the attack underscored its necessity. The tracking issue for the feature was opened in May, with nightly Cargo gaining support in June and the stabilization change merging in August. The feature is currently available in beta but requires explicit configuration by users to become active. By default, the waiting period remains zero, meaning existing projects will not automatically benefit from this enhanced security measure.
To enable the security cooldown, developers can configure their .cargo/config.toml file by adding global-min-publish-age = "7 days" under the [registry] section. Cargo supports various time units for this setting, including seconds, minutes, hours, days, weeks, or months. Once configured, Cargo will exclude any dependency releases younger than the specified age during the dependency resolution process. If no suitable older version meets the project's requirements, the dependency resolution will fail, preventing the inclusion of potentially unvetted new releases.
This mechanism is designed to prevent a specific attack vector where malicious packages are published and then quickly withdrawn, forcing automated systems to adopt the malicious version. Cargo also provides transparency by reporting skipped releases and their ages, aiding developers in understanding why certain updates might be blocked. This approach differs from tools like GitHub's Dependabot cooldown, which typically delays routine version updates; Cargo's cooldown is integrated directly into the dependency selection process itself.
It's important to note that the cooldown feature does not scan code for malicious content or guarantee the safety of packages. It primarily buys time for human review. Furthermore, Cargo preserves versions already recorded in a Cargo.lock file, meaning enabling cooldowns will not automatically remove a malicious release that has already been locked into a project. The feature also excludes certain dependency sources like Git dependencies, local paths, and registries without publication timestamps.
For urgent situations requiring the use of a newer, potentially un-aged package, developers can bypass the cooldown for a specific command using environment variables, such as CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p some-crate --precise 1.2.3. This bypass is temporary for the command execution and does not alter the global cooldown settings.
The introduction of Cargo security cooldowns represents a proactive step by the Rust ecosystem to address the persistent threat of supply-chain attacks. By empowering developers with tools to control the vetting process of new dependencies, Rust aims to enhance the overall security posture of its rapidly growing software ecosystem.