The discussion highlights significant new features in Rust 1.100, such as the stabilized never type and unused dependency warnings, while sparking a substantive debate over whether the language's lack of a stable ABI is a necessary trade-off for its generic system or an impediment to library distribution. Participants clash between those viewing the current source-only model as sufficient and those arguing that a native stable ABI is essential for practical binary interoperability.
66 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4rust-lang
cargo
Rust2014–2026
rust-lang / cargo
cargo
The Rust package manager
100Distinct people
151Mentions
1Explicit recommenders
15.7KGitHub stars
What to know before exploring
What it is
The Rust package manager
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I love Rust, but it's particularly frustrating to me how it (nearly) forces you to use a single centralized package repository. Shameless plug for an issue:…
gspr used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- rust-lang/rust · linked in 8 of the same discussions
- netflix/lipstick · linked in 2 of the same discussions
- rust-lang/rfcs · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 4:01:40 AM UTC.
Mentions over time
HN mentions by year151 dated mentions
Observed mentions: 2014-03-19 04:01:54 UTC to 2026-10-01 11:59:02 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 13 | 0 | 13 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 11 | 0 | 11 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 14 | 0 | 14 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 11 | 0 | 11 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 19 | 1 | 18 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 12 | 2 | 10 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 10 | 1 | 9 |
What Hacker News says
10 sourcesANaniceperson·Oct 1, 2026
you may still need + to forward the job server to other builder
https://github.com/rust-lang/cargo/issues/14407
In Recursive `make` and `-j`Supply chain risks are essentially a solved problem.
1. Set a minimum age on dependencies: https://github.com/rust-lang/cargo/issues/15973
2. Scan all dependency code with AI
Even if you don't do #2 yourself as long as anyone does in the age window you've set, you're protected. In the age of AI the "you can't read all dependency code" argument doesn't work anymore.
On top of the above modern age argument, let's compare the amount of vulnerabilities found in shipped Rust software due to supply chain attacks (0 to my knowledge) against memory safety vulnerabilities (the majority of all vulnerabilities).
There have been successful supply chain attacks against Rust developers due to build.rs but those were quickly dealt with, and should be a thing of the past once min-age hits stable (next release).
In We have a year to fix security everywhereIt's a pity that progress has been so slow.
https://github.com/rust-lang/cargo/issues/17009
In Malicious Rust crate Arrayref runs a build-time payloadCargo has been working on min-publish-age, and the PR to stabilize the feature is in its final comment period and currently expected to land in Rust 1.100: https://github.com/rust-lang/cargo/pull/17335#issuecomment-5...
In Malicious Rust crate Arrayref runs a build-time payload> This crate isn't one of them.
still caught in hours though, so just as a general rule: never install anything newer than 7 days old packages
cargo feature for this is still unstable infuriatingly:
https://github.com/rust-lang/cargo/issues/17009
In Malicious Rust crate Arrayref runs a build-time payload> pnpm has a cooldown period for new dependencies
Cargo has `min-publish-age` in nightly, and it's currently heading towards stabilization: https://github.com/rust-lang/cargo/pull/17335
In Malicious Rust crate Arrayref runs a build-time payloadUnfortunately Cargo doesn’t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them).
There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681
In Malicious Rust crate Arrayref runs a build-time payloadMy impression is that it's the NodeJS, Go and Rust communities that don't care about XDG.
This 11 year old, open issue is very symptomatic of this IMHO: https://github.com/rust-lang/cargo/issues/1734
In Pi's Minimalism Is Its AdvantageThe proposal's at https://hackmd.io/@rust-cargo-team/SJT-p_rL2; progress is tracked at https://github.com/rust-lang/cargo/issues/12633.
In How Our Rust-to-Zig Rewrite Is GoingShow HN: An incremental build cache for Rust on GHA
Hi HN,
I'm Kyle, the creator of Clipper, a container registry with 7x faster builds via lazy pulls and cache mount exports. In the process of implementing cache mount exports I ended up with a FUSE mounted filesystem backed by a remote content defined store. I went looking for fun things to do with it and found that there's not really a good way to keep Rust incremental build state around on ephemeral runners, so here we are.
Rust generally uses https://github.com/mozilla/sccache for caching, but sccache disables itself when incremental compilation is enabled (https://github.com/mozilla/sccache/issues/236) and it isn't on Mozilla's roadmap to fix.
It unfortunately doesn't really work on stable Rust (which uses mtime to decide when files have changed, rather than file contents), but maybe once https://github.com/rust-lang/cargo/issues/1413
Read the rest
6 is stable it will be useful to someone.