Rust 1.100 adds dependency cooldowns and stabilises the never type

Rust 1.100 is released, the Rust release team's blog post said. Two of the new features are about the supply chain of Rust code. One is a cooldown on new dependency versions. The other is a cargo lint for dependencies a project no longer uses. The release also stabilises the never type after a ten-year wait. The Hacker News thread on the blog post had 465 points. The thread on the release tag had 308.

Dependency cooldowns

A supply-chain attack on an open-source registry tends to work in a tight window. Someone publishes a poisoned version of a package. Projects that update right away pick it up. A few hours or days later, someone notices, and the version is pulled. Cargo now has a setting that skips any version published inside a window you choose.

The config lives in .cargo/config.toml, under [registry] global-min-publish-age = "3 days". Three days is the example in the blog post. Any longer or shorter value works. A version younger than the window is treated as if it were not there. The team says the feature gives the community time to notice a bad release. Your build then picks the earlier, safer version.

Lint for unused dependencies

Cargo's second supply-chain feature is a warning when a crate in your Cargo.toml is declared but never used. The warnings are set in a new [lints.cargo] table. A dead dependency is still a surface for a later attack. Removing it is a small security win. It also makes the build a little faster.

The never type !

The never type reached stable after five earlier attempts over a decade, the blog says. The symbol is !. It is the type of a value that cannot exist. It is used for computations that never return. Rust had ! already, but only as a return type. From 1.100, you can name it anywhere a type goes. The post adds that Infallible is now an alias for !.

Allocator API, DropGuard and conjure_zst

The Allocator trait is stable. Vec and Box can take a custom allocator. The team says this is the foundation for wider allocator support in future releases.

core::mem::DropGuard is a new helper. It runs a closure when it is dropped, so a transaction can roll back on any exit path. A dismiss() method cancels the closure once the work has committed.

std::mem::conjure_zst replaces the ad-hoc transmute pattern for creating a zero-sized type.

One line of config, one class of attack blocked

The never type is the headline for the Rust community. But the dependency cooldown is the piece a team building software should read first. Supply-chain attacks against JavaScript and Python registries have hit real projects this year. A cooldown in the build tool is a defence that costs almost nothing. The setting is one line in a config file. An older Rust does not have it. So the first step for anyone running a Rust service is to move to 1.100 and add the line.

Source

• Announcing Rust 1.100.0, Rust Blog
• Rust 1.100.0 release tag, GitHub