# Rust Adds Cargo Dependency Age Control

Rust 1.100 is scheduled to add an optional Cargo “Minimum Publish Age” control that prevents newly published dependency versions from being selected during version resolution, reducing exposure to short-lived malicious packages. The feature is not enabled by default. Government contractors using Rust can evaluate whether to configure a minimum age—such as the article’s seven-day example—and define a controlled exception process for urgent updates.

- The setting may help software teams reduce supply-chain risk from newly published dependencies in Rust builds.
- Contractors can assess how a minimum-age policy would fit their build configuration and release needs; it is an optional control, not a stated government-wide requirement.
- Teams considering the control should account for urgent updates in their exception process so dependency protections do not unnecessarily delay critical fixes.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 22, 2026

### Sources
- [
    Too-new packages must stay out: Rust protects the supply chain | heise online
](https://www.heise.de/en/news/Too-new-packages-must-stay-out-Rust-protects-the-supply-chain-11496351.html) - heise online