Cargo has an RFC in progress and the registry-side infrastructure for cooldowns is stabilized in Cargo 1.94 (releasing March 5, 2026). Their approach sidesteps the exemption list problem entirely: instead of exempting packages from cooldowns, you explicitly opt in to a new version with cargo update foo --precise 1.5.10, which records the choice in your lockfile. No exclude list to remember to clean up later. In the meantime there’s also cargo-cooldown, a third-party wrapper that enforces a configurable cooldown window on developer machines as a proof-of-concept. Go has an open proposal for go get and go mod tidy, Composer has two open issues, and NuGet has an open issue though .NET projects using Dependabot already get cooldowns on the update bot side since Dependabot expanded NuGet support in July 2025.
Последние новости，详情可参考新收录的资料
Version 1.5.0 introduces the following:，更多细节参见新收录的资料
There is a narrow exception: a small set of mandatory rules covering body parsing failures and size limit violations will block even in Detection mode. But those are plumbing behaviours, not security controls. They don’t protect against anything in the OWASP Top 10. The exception exists; it just doesn’t matter for any real attack surface.
Кубок Англии|1/8 финала