Rust 1.100.0 shipped on November 12, 2026, and most of the coverage has focused on the headline: the never type (!) is finally stable after a decade of attempts. That matters to language nerds. For the people who actually run Rust in production, the more consequential changes are quieter, and a couple of them can break a build that has nothing to do with your code.
Here is what changed, who should care, and a short checklist to run before you bump the toolchain in CI.
The short version
- The never type is stable. You can now write types like
Result<T, !>, andstd::convert::Infalliblebecomes an alias for!. - Never-type fallback changed. In the 2015, 2018 and 2021 editions, the fallback moves from
()to!. This is the one language change with real breakage potential. - Custom allocators are stable for
VecandBoxvia theAllocatortrait, along with APIs likeVec::new_inandBox::new_in. - Cargo can now wait before adopting new crate versions. A new
global-min-publish-agesetting holds back freshly published releases. - Cargo warns about unused dependencies and has a new build-directory layout that may break scripts poking around in
target/. - The version number itself has three digits, which trips up any script that compares versions as text.
The full list lives in the official release announcement and the detailed changelog.
The sleeper feature: dependency cooldowns in Cargo
If you only adopt one thing from this release, make it the minimum publish age. Add this to .cargo/config.toml:
[registry]
global-min-publish-age = "3 days"
With that set, the resolver ignores crate versions published less than three days ago, unless they are already pinned in Cargo.lock. If you need a brand-new release urgently, the environment variable CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow overrides it for a single run.
Why this matters more than the never type: many recent package-registry compromises have followed the same pattern. An attacker hijacks a maintainer account, pushes a poisoned version, and it gets pulled into thousands of builds within hours, long before anyone spots it. The 2025 Shai-Hulud worm on npm was the loudest example. A cooldown window turns those hours into days, which is usually enough time for the registry or the security community to yank the bad version.
The JavaScript world got there first. pnpm added a minimumReleaseAge setting in 2025, and pnpm 11, released in April 2026, switched on a one-day cooldown by default. Cargo now has the same lever. Two caveats from the release notes are worth knowing:
cargo installignores the minimum publish age. If you install tools in CI, pin exact versions (cargo install foo@1.2.3).- Versions whose registry index entry lacks a publish timestamp are never held back. Alternative registries may not provide one yet, so check before assuming you are covered.
Our take: three days is a sensible starting point for application teams. Library authors who need to test against the newest dependencies can keep a separate CI job with the override set.
What can actually break
Never-type fallback in older editions
When the compiler cannot infer the type of an expression that never returns (a panic!, a return, an infinite loop), it used to pick () in pre-2024 editions. It now picks !. The Rust team says this should be largely unnoticeable, and future-compatibility warnings have been firing for a while. The code most at risk is generic: calling a function that returns a type parameter and discarding the result, or unsafe code that relied on the fallback type. You may also see new unreachable-code warnings. If your workspace is already on the 2024 edition, nothing changes, because 2024 already used !.
Cargo’s new build-dir layout
Intermediate build artifacts now live in a different layout. The release notes are blunt that the build directory was never a stable interface and that tools should read Cargo’s JSON messages instead. If you have a CI cache step, a coverage tool or a packaging script that hard-codes paths inside target/, this is the change most likely to bite.
Smaller compatibility notes
boxpatterns are no longer syntactically allowed.- Closures capture more precisely inside
if let, which can surface new borrow errors. - On ARM targets,
-Ctarget-featureor-Ctarget-cpuvalues that change the ABI are now hard errors. cargo installnow uses the lockfile shipped in the crate by default, making--lockeda no-op.
The bug nobody wrote release notes for: “1.100” looks older than “1.99”
This is the first Rust release with a three-digit minor version, and that exposes a classic mistake. Compare version strings as plain text and “1.100.0” sorts before “1.99.0”, because the character “1” comes before “9”. Parse them as decimals and 1.100 equals 1.1. Either way, a minimum-version check concludes your shiny new compiler is ancient.
We checked the behaviour ourselves:
| Method | Says 1.100 is newer than 1.99? |
|---|---|
Plain sort on strings |
No |
Python string comparison ("1.100.0" < "1.99.0") |
No |
Python float("1.100") vs float("1.99") |
No |
sort -V (GNU version sort) |
Yes |
Python tuple of ints ((1, 100, 0)) |
Yes |
Where to look: shell scripts that gate on rustc --version, Makefiles, build.rs scripts that check the compiler, and homegrown MSRV checks. Cargo’s own rust-version field handles this correctly, so the risk is in custom tooling. How common it is in the wild is unclear. A third-party breakage tracker flagged the issue but reported finding few affected scripts in public code. The fix takes minutes, so it is worth a grep either way.
Who should care, and how much
| You are… | Priority | What to do |
|---|---|---|
| Shipping a Rust service or CLI | High | Turn on the publish-age cooldown; check CI caching for build-dir assumptions |
| Maintaining a library on edition 2021 or older | Medium | Build with 1.100 and watch for fallback-related errors and new unreachable warnings |
| Writing embedded or systems code | Medium | Try the stable Allocator API; check ARM target-feature flags |
| Running DevOps tooling that wraps rustc | High | Grep for version comparisons and fix any string or float logic |
| Learning Rust or on edition 2024 | Low | Update and enjoy bool::toggle and str::trim_prefix |
Pre-upgrade checklist
- Run
rustup update stableon a branch, not on main. - Run
cargo buildandcargo testacross the workspace. Fix any never-type fallback errors first. - Read the new
cargo::unused_dependencieswarnings. Removing dead crates shrinks your attack surface and build times. Note that it skips dev-dependencies. - Search CI scripts for hard-coded
target/paths and switch them to Cargo’s JSON output where possible. - Grep for
rustc --versionand similar checks in scripts and fix any text-based version comparison. - Add
global-min-publish-ageto your Cargo config and pin versions in anycargo installCI steps. - Only then bump the toolchain in
rust-toolchain.tomlfor everyone.
The bigger picture
Rust’s release train is predictable by design: a new stable every six weeks, almost never anything dramatic. That is exactly why 1.100 deserves a closer look than usual. The never type is a long-awaited language milestone, but the dependency cooldown is the change that reflects where software risk sits in 2026: in the supply chain, not just in memory safety bugs. Rust built its reputation on the second problem. With this release, it is starting to take the first one seriously.
If you are still deciding whether Rust belongs in your stack, our guide on choosing the right programming language for a project and our look at the most popular programming languages in 2026 are good next reads. For the pipeline side, see the rise of DevSecOps in CI/CD workflows.
