The discussion highlights significant new features in Rust 1.100, such as the stabilized never type and unused dependency warnings, while sparking a substantive debate over whether the language's lack of a stable ABI is a necessary trade-off for its generic system or an impediment to library distribution. Participants clash between those viewing the current source-only model as sufficient and those arguing that a native stable ABI is essential for practical binary interoperability.
66 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4rust-lang
cargo
Rust2014–2026
rust-lang / cargo
cargo
The Rust package manager
100Distinct people
151Mentions
1Explicit recommenders
15.7KGitHub stars
What to know before exploring
What it is
The Rust package manager
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I love Rust, but it's particularly frustrating to me how it (nearly) forces you to use a single centralized package repository. Shameless plug for an issue:…
gspr used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- rust-lang/rust · linked in 8 of the same discussions
- netflix/lipstick · linked in 2 of the same discussions
- rust-lang/rfcs · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
Mentions over time
HN mentions by year151 dated mentions
Observed mentions: 2014-03-19 04:01:54 UTC to 2026-10-01 11:59:02 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 13 | 0 | 13 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 11 | 0 | 11 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 14 | 0 | 14 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 11 | 0 | 11 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 19 | 1 | 18 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 12 | 2 | 10 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 10 | 1 | 9 |
What Hacker News says
151 sourcesANaniceperson·Oct 1, 2026
you may still need + to forward the job server to other builder
https://github.com/rust-lang/cargo/issues/14407
In Recursive `make` and `-j`Supply chain risks are essentially a solved problem.
1. Set a minimum age on dependencies: https://github.com/rust-lang/cargo/issues/15973
2. Scan all dependency code with AI
Even if you don't do #2 yourself as long as anyone does in the age window you've set, you're protected. In the age of AI the "you can't read all dependency code" argument doesn't work anymore.
On top of the above modern age argument, let's compare the amount of vulnerabilities found in shipped Rust software due to supply chain attacks (0 to my knowledge) against memory safety vulnerabilities (the majority of all vulnerabilities).
There have been successful supply chain attacks against Rust developers due to build.rs but those were quickly dealt with, and should be a thing of the past once min-age hits stable (next release).
In We have a year to fix security everywhereIt's a pity that progress has been so slow.
https://github.com/rust-lang/cargo/issues/17009
In Malicious Rust crate Arrayref runs a build-time payloadCargo has been working on min-publish-age, and the PR to stabilize the feature is in its final comment period and currently expected to land in Rust 1.100: https://github.com/rust-lang/cargo/pull/17335#issuecomment-5...
In Malicious Rust crate Arrayref runs a build-time payload> This crate isn't one of them.
still caught in hours though, so just as a general rule: never install anything newer than 7 days old packages
cargo feature for this is still unstable infuriatingly:
https://github.com/rust-lang/cargo/issues/17009
In Malicious Rust crate Arrayref runs a build-time payload> pnpm has a cooldown period for new dependencies
Cargo has `min-publish-age` in nightly, and it's currently heading towards stabilization: https://github.com/rust-lang/cargo/pull/17335
In Malicious Rust crate Arrayref runs a build-time payloadUnfortunately Cargo doesn’t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them).
There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681
In Malicious Rust crate Arrayref runs a build-time payloadMy impression is that it's the NodeJS, Go and Rust communities that don't care about XDG.
This 11 year old, open issue is very symptomatic of this IMHO: https://github.com/rust-lang/cargo/issues/1734
In Pi's Minimalism Is Its AdvantageThe proposal's at https://hackmd.io/@rust-cargo-team/SJT-p_rL2; progress is tracked at https://github.com/rust-lang/cargo/issues/12633.
In How Our Rust-to-Zig Rewrite Is GoingShow HN: An incremental build cache for Rust on GHA
Hi HN,
I'm Kyle, the creator of Clipper, a container registry with 7x faster builds via lazy pulls and cache mount exports. In the process of implementing cache mount exports I ended up with a FUSE mounted filesystem backed by a remote content defined store. I went looking for fun things to do with it and found that there's not really a good way to keep Rust incremental build state around on ephemeral runners, so here we are.
Rust generally uses https://github.com/mozilla/sccache for caching, but sccache disables itself when incremental compilation is enabled (https://github.com/mozilla/sccache/issues/236) and it isn't on Mozilla's roadmap to fix.
It unfortunately doesn't really work on stable Rust (which uses mtime to decide when files have changed, rather than file contents), but maybe once https://github.com/rust-lang/cargo/issues/1413
Read the rest
6 is stable it will be useful to someone.
> It may have been nice to expose some reasonable defaults for code coverage measurements too.
Would love built in coverage support but investigation is needed on the design (https://github.com/rust-lang/cargo/issues/13040) and we likely need to redo how we handle doctests (https://blog.rust-lang.org/inside-rust/2025/10/01/this-devel...).
In Rust the ProcessPulling over my reddit comment
> Providing a mechanism to manually disable individual default features when specifying a dependency
We want this on the Cargo team; somebody just needs to do the design work, see https://github.com/rust-lang/cargo/issues/3126
Note that there is a related problem of feature evolution. Can you take existing functionality and move it behind a feature? No because that would be a breaking change for `default-features = false`. On the surface, it sounds like disabling default features works around that and we can remove `default-features = false` in an Edition but that is in the dependents edition and doesn't control the dependencies edition. We need something else to go with this.
> Providing a less verbose way for libraries to expose the features of their direct dependencies to other packages that depend on
Read the rest
them directly
> Providing a way to disable features from transitive dependencies
I'm tying these two together because I wonder how well the same solution would work for this: maybe not everything should be a feature but a ["global"](https://internals.rust-lang.org/t/pre-rfc-mutually-excusive-...). Our idea for solving mutually exclusive features is to provide a key-value pair that a package defines and sets a default on and then the final application can override it. Maybe we'll eventually allow toolkits / sdks to also override but that can run into unification issues and is a lower priority.
Otherwise, I think we'd need to dig into exact use cases to make sure we have a good understanding of what kinds of features in what situations that libraries need to re-export before figuring out what design is appropriate for making large scale feature management manageable.
> "Zero-config" features that allow enabling/disabling code in a library without the author having to manually define it
We have `hints.mostly-unused` (https://doc.rust-lang.org/cargo/reference/unstable.html#prof...) which defers parts of the compilation process for most of a package until we know whether it is needed. Currently, it is a mixed bag. Explicit features still provide noticeable benefits. It is mostly for packages like `windows-sys` and `aws-sdk`.
> Build times
> I'm surprised I didn't see any advice about skipping proc macros or Serde for faster compile times.
A more comprehensive document on build times is at https://corrode.dev/blog/tips-for-faster-rust-compile-times/
We're integrating parts of it into Cargo's official documentation at https://doc.rust-lang.org/nightly/cargo/guide/build-performa...
We're coordinating the work on that at https://github.com/rust-lang/cargo/issues/16119
> > If you use dev builds but don’t often use a debugger, consider disabling debuginfo. This can improve dev build times significantly, by as much as 20-40%.
We're wondering if we should split iterative development from debugging to pull in these improvements (and maybe more). This is being explored at https://github.com/rust-lang/cargo/issues/15931
In The Rust Performance Book (2020)lib crates have been checking in their Cargo.lock for a while now.
https://github.com/rust-lang/cargo/pull/12382
In Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromisedWhat do you mean? At the bottom of the page, the latest update is a pull request that was opened 10 days ago: https://github.com/rust-lang/cargo/pull/15684
In Error handling in RustShowing the 15 most recent of 151 sources. Enable JavaScript to search and browse every indexed mention.