Image: Wikimedia Commons / Karen Rustad Tölva, CC0. Illustrative image: Ferris, the Rust community mascot. (The official Rust logo is black-on-transparent and does not render visibly on this blog's dark theme, so the mascot stands in for it here.)
UPDATE — 13 November 2026: Rust 1.100.0 is out. The Rust team published the official announcement on 12 November 2026, and rustup update stable now delivers version 1.100.0. Everything below is confirmed against the shipped release — the feature list in this article is the final one.
TL;DR: Rust 1.100.0 explained: the stable release shipped on Thursday, 12 November 2026, with opt-in Cargo dependency cooldowns that delay brand-new crates, a fully stable never type (!), and the long-awaited custom Allocator API. Update now with rustup update stable — but test first, because this release can break some builds.
Key Highlights
- Rust 1.100.0 was released on Thursday, 12 November 2026. The official announcement is live on the Rust blog, and
rustup update stabledelivers it now. - Cargo gains opt-in dependency cooldowns: set a minimum publish age, such as 7 days, and the resolver skips crate versions younger than that.
- The never type
!is now fully stable, andInfalliblebecomes an alias for!. - The custom Allocator API (
std::alloc::Allocator,Box::new_in,Vec::new_in) stabilises after years in development. - 32-bit Windows loses host tools: toolchains can no longer be installed on 32-bit Windows hosts — cross-compile from 64-bit instead.
- Also new in the shipped release:
DropGuardfor run-a-closure-on-exit helpers,conjure_zstfor zero-sized types, and Cargo warnings for unused dependencies. - Breakage warning: never-type inference changes and generalised
Boximplementations may cause new errors in edge cases, so test your projects against 1.100.0 before updating.
Rust 1.100.0 explained: what is new in the release
Rust ships a new stable version every six weeks, and 1.100.0 is the next one in line. The previous stable, Rust 1.99.0, arrived on 1 October 2026, followed by a 1.99.1 hotfix on 15 October for a miscompiled FFI bool return — a bug we covered in our Rust 1.99.1 FFI bool bug fix explainer. Version 1.100.0 is a bigger release than most: it stabilises three headline features at once, and it carries more breaking-change risk than a typical six-weekly update.
The release shipped on schedule: the Rust team published the official announcement on 12 November 2026, confirming the never type, the Allocator API, Cargo cooldowns and the rest of the feature list below. The pre-release build had gone out for testing on 10 November; the stable release is the same feature set, now available to every Rust developer.
The release matters beyond Rust developers. Rust keeps showing up in places that used to belong to C and C++ — Discord rebuilt its desktop app in Rust, GitHub rewrote the Copilot runtime in it, and the Linux kernel keeps absorbing Rust code. Our GitHub Copilot runtime Rust rewrite explainer has the scale of that shift. A release that changes how dependencies are vetted, therefore, ripples into a lot of production software.
Cargo dependency cooldowns: a waiting period for new crates
The headline feature is a supply-chain security control. Cargo, Rust's package manager, can now be told to ignore dependency versions until they reach a minimum age. The setting lives in .cargo/config.toml:
[registry] global-min-publish-age = "7 days"
With that set, the resolver skips any crate version published less than seven days ago and picks an older version that satisfies your requirements instead. If no version old enough fits, resolution fails rather than silently pulling the new release. Versions already recorded in Cargo.lock are kept even if they are younger than the threshold, so existing builds do not suddenly change.
Three details matter. First, the default is zero — upgrading to Rust 1.100.0 alone buys no protection at all; teams must switch the cooldown on themselves. Second, the resolver's incompatible-publish-age policy defaults to deny, so the waiting period is enforced rather than bypassed. Third, for an urgent fix you can override the check for one command:
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p some-crate --precise 1.2.3
The idea is a grace period, not a guarantee. A waiting period gives scanners, maintainers and other users time to spot a malicious release before it spreads — but passing the wait does not certify a crate as safe, and the check does not cover cargo install, Git or local path dependencies, or registries that do not publish timestamps. The feature is defined in RFC 3923 and its stabilisation was merged on 28 August after nightly testing since June.
The context is real: in August 2026, attackers published tampered versions of three Rust libraries — arrayref, internment and append-only-vec — and Socket.dev, which documented the incident, has been the clearest independent voice for the cooldown feature. A seven-day delay would have given the community a week to flag those releases before automated builds pulled them in.
Image: Wikimedia Commons / Vulphere, Apache License 2.0. Illustrative image: rustc building a crate with Cargo.
The never type (!) is finally stable
The second headline is the never type, written !. It is the type of code that never returns a value — an endless loop, a call to panic!(), or a process exit. Until now, ! could only be used in limited positions. In Rust 1.100.0 it becomes a fully stable type you can use anywhere a type goes, including as a generic argument — so Result<T, !> now cleanly expresses "this operation cannot fail". The standard library gains matching pieces such as impl AsRef<T> for ! and impl AsMut<T> for !, and Infallible, the error type for operations that cannot fail, becomes an alias for !.
Most developers will never write ! directly, and that is fine — the benefit lands through libraries and error handling that get simpler and more precise. But the change has a sharp edge: the never-type fallback was changed to ! in editions before 2024 (2015, 2018 and 2021 — edition 2024 already used it), so in rare cases the compiler may now infer ! where it previously inferred something else. That is one of the two reasons this release carries a breakage warning, covered below.
Custom allocators land after years in the making
The third headline is the custom Allocator API. std::alloc::Allocator, std::alloc::Global and std::alloc::System are now stable, along with the methods that use them: Box::new_in, Box::from_raw_in, Vec::new_in, Vec::with_capacity_in and their counterparts, plus Box::allocator and Vec::allocator to ask a collection which allocator it uses.
In plain terms, Rust code can now choose where its memory comes from. A game engine can allocate from an arena, an embedded device can use a fixed pool, and a database can track allocations per query — all without dropping to unsafe workarounds or a fork of the standard library. Most application developers will never touch this API directly; library authors will, and the benefit will reach everyone through faster, more predictable crates. It has been one of the most requested stabilisations in the language, in development for years, and it is the quietest big change in 1.100.0.
What else is new in Rust 1.100.0
Beyond the three headlines, the release notes list a long tail of smaller changes. The table below picks the ones most likely to affect working developers.
| Change | What it does | Who should care |
|---|---|---|
| Cargo linting system | Cargo warnings become controllable lints under [lints.cargo], including a built-in cargo::unused_dependencies check | Every Rust project |
cargo install lockfile | Uses the lockfile inside the .crate tarball by default; --locked becomes a no-op | CLI tool users |
| New build directory layout | Intermediate build artifacts move; tools that inspect the build directory should use Cargo's JSON messages instead | Tooling authors |
| Small std conveniences | bool::toggle, str::trim_prefix / trim_suffix, slice and Path variants, Vec::from_fn | All developers |
wasm32-wasip3 to Tier 2 | WebAssembly System Interface preview 3 gets stronger platform support | Wasm developers |
| New Tier 3 target | powerpc64-sony-ps3 added — yes, the PlayStation 3 | Retro and hobby developers |
| Unicode 18.0.0, WASI SDK 33 to 34 | Updated Unicode data and WASI SDK version | Library authors |
-Cprofile-sample-use stabilised | Profile-guided optimisation flag becomes stable | Performance-focused teams |
Two platform changes deserve a call-out. The i686-pc-windows-msvc target drops from Tier 1 with host tools to Tier 1 without them, and i686-pc-windows-gnu makes the same move within Tier 2. After 1.100.0, toolchains can no longer be installed on 32-bit Windows hosts; developers who still ship 32-bit Windows binaries must cross-compile from a supported host, such as a 64-bit Windows toolchain. Prebuilt standard library builds will still be distributed, and the MSVC target will still be tested in CI. The Rust team gives practical reasons: 32-bit-only x86 desktop CPUs have not been sold for over 15 years, general 32-bit Windows support ended in October 2025, and building these toolchains had produced crashing compiler binaries and out-of-memory failures. Other 32-bit platforms are not affected.
The breakage warning: test before you update
Rust releases are usually boring to upgrade — that is the point of the six-week train. Version 1.100.0 is the exception, and the community has been saying so for a month. The never-type inference change, the Box implementations generalised to arbitrary allocators, closures capturing variables more precisely in if let, and box patterns no longer being syntactically allowed can each produce new errors in previously compiling code. Community testing against the beta — including the automated crater builds of the crates.io ecosystem — pointed to more breakage than usual, and the advice is consistent: test your projects against 1.100.0 before updating your stable toolchain.
The practical move is simple: test first, then update. Run your test suite against 1.100.0 in CI or on a branch, fix anything the new inference rules flag, and only then move your stable toolchain forward. If a dependency breaks, pin it and report the issue upstream — the Rust team has already shipped fixes for crates the beta period caught.
What Rust 1.100.0 means for developers in India
India's Rust community is heavily weighted toward backend services, DevOps tooling and systems work — exactly the code that benefits from dependency cooldowns. If your team ships a Rust service in production, the cooldown is the one setting in this release worth a discussion this week: a seven-day minimum publish age on production services costs almost nothing (legitimate updates wait a week unless you override them) and closes the exact hole the August crate tampering exploited. Set it in your shared Cargo configuration, agree who can approve the override for urgent fixes, and note that cargo install and Git dependencies fall outside it.
The 32-bit Windows change is unlikely to bite Indian developers — 32-bit-only hardware has not been sold for over a decade — but anyone maintaining builds for old Windows machines should check their CI images now. And the broader context is worth noting: our TIOBE Index November 2026 post recorded Go knocking Rust out of the top 10 last month, so a release this substantial is also a reminder that Rust's development pace has not slowed.
Should you update to Rust 1.100.0 now?
✅ Verdict: Update now — after testing first. The cooldowns, the never type and the Allocator API are all worth having, and none of them changes your code by itself. But this is not a blind rustup update: run your tests against 1.100.0, check for never-type inference errors, and switch the cooldown on deliberately — upgrading alone does not enable it.
Updating is straightforward now that the release is out:
rustup update stable rustc --version
The second command should report 1.100.0. If it still shows 1.99.x, the release has not reached your mirror yet — wait a few hours and try again.
FAQs
When is Rust 1.100.0 released?
Rust 1.100.0 was released on Thursday, 12 November 2026, and the official announcement is live on the Rust blog. Update with rustup update stable, then check with rustc --version — it should report 1.100.0.
What are Cargo dependency cooldowns in Rust 1.100.0?
Dependency cooldowns are an opt-in minimum publish age for crates. Setting global-min-publish-age = "7 days" under [registry] in .cargo/config.toml makes Cargo skip crate versions published less than seven days ago. The default is zero, so upgrading alone does not enable the protection.
How do I update to Rust 1.100.0?
Run rustup update stable, then check with rustc --version — it should report 1.100.0. Test your projects against 1.100.0 first, because this release can cause new type-inference errors in edge cases.
Does Rust 1.100.0 break existing code?
Most code will compile unchanged, but this release carries more breakage risk than usual. The never-type fallback change, Box implementations generalised to arbitrary allocators, and stricter closure captures can each produce new errors. Community testing pointed to the risk a month ahead of release, so test before updating.
Takeaway
Rust 1.100.0 is a security-first release disguised as a routine one: the cooldowns give every Rust team a practical defence against tampered crates, the never type and the Allocator API close two long-running language gaps, and the only price is a careful upgrade. Test first, update now, and switch the cooldown on — it does not enable itself.
Run rustup update stable now and try the seven-day cooldown on one production service. If you want the full change list, the official announcement is the first link below — and if you missed the last hotfix, our Rust 1.99.1 FFI bug fix explainer covers what 1.99.1 fixed and why it mattered.
Sources
- Announcing Rust 1.100.0 — Rust Blog, 12 November 2026 (official release announcement)
- Rust Release Notes — Version 1.100.0 (2026-11-12) — official release notes, read in full
- Rust 1.100.0 pre-release testing — Rust Internals, 10 November 2026 (the release shipped on schedule on 12 November)
- Demoting i686 Windows targets to std-only — Rust Blog, 2 October 2026
- RFC 3923: Cargo minimum publish age — Rust RFCs
- Rust 1.100 Will Add Dependency Cooldowns to Cargo — Socket.dev
- Rust 1.100 Introduces Cargo Security Cooldowns to Prevent Malicious Dependency Attacks — Cybersecurity News
Comments
Post a Comment