Rust 1.100 to add Cargo dependency cooldowns after August crates.io supply chain compromise of arrayref, internment and append-only-vec
Rust 1.100, scheduled for November 12, 2026, will stabilize Cargo dependency cooldowns. Developers can reject newly published crate versions until they reach a configurable minimum age. The aim is to give researchers, maintainers and registries time to detect malicious releases before automated updates spread them across development envir…