Rust 1.100 Stabilizes the Never Type After Ten Years, and Cargo Gets a Dependency Cooldown

Rust 1.100 is out, Phoronix reports, and the big headline is the never type, !, which is finally stable after ten years and five failed tries. It marks code that never produces a value, so anything after it is unreachable.

Also in this release:

• Core parts of the Allocator API are stable.
• Cargo can report unused dependencies and has fewer cache collisions.
• Cargo has a new min-publish-age setting, a cooldown that skips crates published in the last few days. Malicious packages usually get caught within hours, so waiting three to five days stops a lot of them.

My take

The never type is a nice win for the language nerds, but the cooldown is what I’d turn on today. Given this week’s GitHub CI stealer, letting new packages sit a few days before you pull them in is cheap insurance. I’d like to see npm and pip make this the default.

God Bless, and Happy hacking!

References & Further Reading

• Rust 1.100 released with the ‘never’ type finally stable (Phoronix)