28
Supply chain attack on arrayref
(blog.rust-lang.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Aug 2026
28 points (93.8% liked)
Rust
8248 readers
2 users here now
Welcome to the Rust community! This is a place to discuss about the Rust programming language.
Wormhole
Credits
- The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)
founded 3 years ago
MODERATORS
Reminder to have minimum ages for update releases to help avoid these exact kinds of attacks. I do like 3 days which is probably overkill.
How do you set that up?
I'm not a rust user but it looks like the feature is in their unstable branch https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#min-publish-ag. Also looks like someone made a crate to do that called cargo-cooldown. These supply chain attacks have been more frequent only recently so a lot of ecosystems are still working on implementing this kind of feature.
Configure your updater and use exact or semi-exact versions.