/
← Voltar ao feed
medium technology software development

Rust 1.100 to add Cargo dependency cooldowns after August crates.io supply chain compromise of arrayref, internment and append-only-vec

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 03:17 · coletado há 9 horas

Rust 1.100, scheduled for November 12, 2026, will stabilize Cargo dependency cooldowns. Developers can reject newly published crate versions until they reach a configurable minimum age. The aim is to give researchers, maintainers and registries time to detect malicious releases before automated updates spread them across development environments and CI pipelines. The feature is opt-in and the default minimum publish age stays at zero. It was motivated by August's compromise of the arrayref, internment and append-only-vec crates, whose malicious versions pulled in proc-macro1, a crate with a build script that downloaded a malicious payload.

Technical Details

  • The cooldown is enabled with global-min-publish-age = "7 days" under [registry] in .cargo/config.toml. Supported units are seconds, minutes, hours, days, weeks and months. Registry-specific settings allow different waiting periods per package source.
  • resolver.incompatible-publish-age defaults to deny. Cargo excludes releases younger than the threshold, fails resolution if no eligible version satisfies the requirements, and reports the skipped releases in its diagnostics.
  • Strict rejection matters because attackers also yanked legitimate arrayref releases. A resolver that merely preferred older versions could fall back to the malicious newcomer.
  • According to Socket researchers, Rust security responders removed arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 after they had been available for 86, 90 and 107 minutes respectively.
  • Limitations:
    • Existing Cargo.lock entries remain valid even if younger than the threshold, so the feature does not retroactively remove an already adopted malicious dependency.
    • Git dependencies, local path dependencies and registries without publication timestamps are not covered.
    • Legitimate fixes also face the delay unless overridden.
    • Malicious releases that evade detection can simply age past the threshold. The RFC warns against relying on cooldowns as a standalone defense.

Remediation

  • After upgrading to Rust 1.100, set a minimum publish age (for example 7 days) in the Cargo configuration, since upgrading alone does not enable it.
  • Review Cargo.lock to understand actual coverage and to check for recently adopted versions.
  • For urgent fixes, bypass the check temporarily with CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p some-crate --precise 1.2.3.
  • Combine cooldowns with other dependency controls rather than treating them as proof of safety.

Linha do tempo

  1. gbhackers.com ↗ · pub. 21/10/2026 03:17 · coletado 21/10 05:00 primeiro registro

    Rust 1.100 to add Cargo dependency cooldowns after August crates.io supply chain compromise of arrayref, internment and append-only-vec

    ler a análise desta fonte

    Rust 1.100, scheduled for November 12, 2026, will stabilize Cargo dependency cooldowns. Developers can reject newly published crate versions until they reach a configurable minimum age. The aim is to give researchers, maintainers and registries time to detect malicious releases before automated updates spread them across development environments and CI pipelines. The feature is opt-in and the default minimum publish age stays at zero. It was motivated by August's compromise of the arrayref, internment and append-only-vec crates, whose malicious versions pulled in proc-macro1, a crate with a build script that downloaded a malicious payload.

    Technical Details

    • The cooldown is enabled with global-min-publish-age = "7 days" under [registry] in .cargo/config.toml. Supported units are seconds, minutes, hours, days, weeks and months. Registry-specific settings allow different waiting periods per package source.
    • resolver.incompatible-publish-age defaults to deny. Cargo excludes releases younger than the threshold, fails resolution if no eligible version satisfies the requirements, and reports the skipped releases in its diagnostics.
    • Strict rejection matters because attackers also yanked legitimate arrayref releases. A resolver that merely preferred older versions could fall back to the malicious newcomer.
    • According to Socket researchers, Rust security responders removed arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 after they had been available for 86, 90 and 107 minutes respectively.
    • Limitations:
      • Existing Cargo.lock entries remain valid even if younger than the threshold, so the feature does not retroactively remove an already adopted malicious dependency.
      • Git dependencies, local path dependencies and registries without publication timestamps are not covered.
      • Legitimate fixes also face the delay unless overridden.
      • Malicious releases that evade detection can simply age past the threshold. The RFC warns against relying on cooldowns as a standalone defense.

    Remediation

    • After upgrading to Rust 1.100, set a minimum publish age (for example 7 days) in the Cargo configuration, since upgrading alone does not enable it.
    • Review Cargo.lock to understand actual coverage and to check for recently adopted versions.
    • For urgent fixes, bypass the check temporarily with CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p some-crate --precise 1.2.3.
    • Combine cooldowns with other dependency controls rather than treating them as proof of safety.