Rust 1.100 Will Add Dependency Cooldowns to Cargo

Rust 1.100 will introduce an opt-in feature in Cargo that allows developers to implement dependency cooldowns, setting a minimum publish age for new crates before they can be adopted. This mechanism is designed to provide security researchers and maintainers with time to detect malicious package releases before they are pulled into larger projects, referencing prior incidents where compromised packages spread rapidly through dependencies. Currently, the feature defaults to no delay, requiring developers to actively enable this safeguard within their configuration files, such as by setting `global-min-publish-age` in `.cargo/config.toml`.
The functionality permits teams to configure specific waiting periods, with Cargo excluding releases younger than the threshold; however, resolution failure is deliberate to prevent bypassing the check by reverting to malicious older versions if an incompatible new release exists. While this feature does not apply to `cargo install` or local dependencies, developers retain a manual override using environment variables for urgent fixes, preserving existing versions recorded in Cargo.lock during updates. The introduction of this control aims to shift defense strategy from purely reactive patching toward proactive temporal risk mitigation within the software supply chain ecosystem.

Rust 1.100 is scheduled for November 12 and will add opt-in dependency cooldowns to Cargo.
The minimum publish age setting can be configured in `.cargo/config.toml` under `[registry]`.
Cargo’s default minimum publish age remains zero unless explicitly changed.
Teams must manually switch this feature on; it is currently available on beta but not stable Rust.
Malicious crate releases of arrayref, internment, and append-only-vec were reported in August across crates.io.
The cooling-off mechanism allows Cargo to exclude releases younger than the configured threshold during dependency selection.
An urgent fix can temporarily bypass the age check using `CARGORESOLVERINCOMPATIBLEPUBLISHAGE=allow`.
The cooldown does not apply to `cargo install` or dependencies managed via Git/local paths without registry metadata.
Work on this feature began with a tracking issue opened on May 18 and reached nightly Cargo on June 21.

<STEELMAN>The implementation of dependency cooldowns in Rust's build tool represents a significant, defensive architectural evolution targeting the velocity gap between malicious distribution and investigative response times within the software supply chain. As documented by security researchers following past compromises, immediate adoption of newly published crates can allow zero-day payloads to propagate across diverse projects before defenders can issue alerts or removals. By institutionalizing a temporal buffer—a "cooling-off period"—the ecosystem forces a necessary deceleration, creating artificial latency beneficial for defensive analysis.</STEELMAN>
<PATTERN SCAN>Patterns detected: none</PATTERN SCAN>
<ROOT CAUSE>The underlying paradigm driving this development is the realization that digital speed (automated dependency resolution) exceeds human investigative cadence. The assumption being challenged is the implied trust in instantaneous vetting at the point of publication; instead, the focus shifts to managed temporal risk acceptance.</ROOT CAUSE>
<IMPLICATIONS>This change shifts a small element of control from purely automated reliance onto developer configuration choices. Those who adopt and configure this feature gain proactive defense against rapid supply chain infection. Conversely, those relying on default settings continue to expose projects to risk unless the tooling is explicitly upgraded, creating a differential security posture based on implementation diligence.</IMPLICATIONS>
<BRIDGE QUESTIONS>How will this friction—the deliberate delay of updates—affect the velocity and agility goals of high-throughput development teams? What non-registry dependent mechanisms might become necessary if Git or internal artifacts cannot be subjected to the same age checks?</BRIDGE QUESTIONS>
<COUNTERSTRIKE SCAN>A coordinated influence campaign aiming to undermine this feature might frame it as "stifling innovation" or "creating unnecessary roadblocks," arguing that safety measures should never impede the speed of open-source contribution. The current content resists this by providing precise, documented security rationale derived from specific attack vectors.</COUNTERSTRIKE SCAN>