Rust 1.100 Will Add Dependency Cooldowns to Cargo

What it is

Rust 1.100, scheduled for 12 November 2026, stabilizes a minimum publish age for Cargo. The stabilization PR merged on 28 August, and the setting is already on beta. Cargo's default stays at zero, so teams must turn it on.

How it works

Cargo excludes any release younger than the threshold during version selection. An older version is still chosen if it meets the project's other requirements. If no eligible version works, resolution fails.

The failure is deliberate. The feature's RFC describes an attack where someone publishes a malicious update and yanks the safe versions. A policy that only prefers older releases would fall back to the malicious one. Attackers yanked legitimate arrayref versions in the August compromise.

Cargo reports when the cooldown is active and lists the newer versions it skipped, with their age. On failure, its diagnostics explain how to adjust the version requirement or override the check.

Versions already in Cargo.lock are kept even if they are younger than the threshold. Enabling a cooldown does not retroactively reject a fresh release already locked.

What to do

Set a seven-day cooldown in .cargo/config.toml:

[registry]
global-min-publish-age = "7 days"

Durations can use seconds, minutes, hours, days, weeks or months. The resolver's incompatible-publish-age setting defaults to "deny", so no [resolver] entry is needed unless other configuration changed it.

For an urgent fix, bypass the check for one invocation and pin the version:

CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p some-crate --precise 1.2.3

This disables the age check for that run, including transitive dependencies it must resolve. Once the versions are in the lockfile, later builds use them under the normal policy.

Caveats

• The cooldown does not apply to cargo install.
• It relies on registry publication timestamps, so Git and path dependencies are outside its scope, as are registries that do not provide that metadata.
• Legitimate fixes wait too, unless a developer makes an exception.
• Malicious code that escapes detection can outlast the cooldown.

The case for it: the August releases of arrayref, internment and append-only-vec (which pulled in the malicious proc-macro1) were on crates.io for 86, 90 and 107 minutes, according to the Rust Security Response Team. A cooldown of even a day would have outlasted all three windows.