(socket.dev) Rust 1.100 Introduces Dependency Cooldowns in Cargo to Mitigate Supply Chain Attacks In brief - This article discusses the introduction of opt-in dependency cooldowns in Rust 1.100, designed to mitigate supply chain attacks by delaying the adoption of newly published crates. Technically - This article describes the implementation of the `global-min-publish-age` setting in `.cargo/config.toml`, which allows developers to define a minimum age (e.g., "7 days") for dependencies before they are considered eligible by the Cargo resolver. The resolver is configured by default to "deny" versions that do not meet this age threshold, causing resolution to fail rather than falling back to a malicious new release if older versions are yanked. While the cooldown does not apply to `cargo install`, Git, or local path dependencies, it can be bypassed for urgent updates using the `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow` environment variable for specific precise updates. Source: https://socket.dev/blog/rust-cargo-cooldowns #Cybersecurity