@thomask@social.octet-stream.net
Post #3037371
2026-05-24 21:28 UTC
Awesome, the min-publish-age #rustlang RFC was merged last week, for protecting yourself against freshly published malware updates. Always thought this was a very sensible idea. https://rust-lang.github.io/rfcs//3923-cargo-min-publish-age.html
Replies (2)
-
@AMDmi3@fosstodon.org 2026-05-24 21:43
@thomask@social.octet-stream.net seconded, I closely watch this rfc too. For now it's a huge pain to do this manually, like with dependabot+cooldown (which doesn't update transitive depends anyway), or cargo update in a branch then merge it in a week. Still this feels like a band aid, while a real solution would be something like a distributed code audit system. IIRC cargo-vet does something like that, but I haven't tried it yet.
-
@CosmicHorror@fosstodon.org 2026-05-25 00:07
@thomask@social.octet-stream.net oh neat! i was just looking into tooling for this earlier today