Running any Cargo commands on untrusted projects poses significant security risks, as these commands can execute arbitrary code through various attack vectors, particularly via configuration files. Users are advised to treat all Cargo commands with caution, similar to how they would treat `cargo run`, and to avoid running them on unknown codebases. Workarounds exist but are not foolproof, emphasizing the importance of not executing Cargo commands in untrusted environments.

Rust 1.90.0 has been released, introducing the LLD linker as the default for improved linking performance and native support for workspace publishing in Cargo. Additionally, the x86_64-apple-darwin target has been demoted to Tier 2 due to changes in macOS support, and several APIs have been stabilized for const contexts.

Rust 1.88.0 has been released, introducing features such as let chains for conditional statements, naked functions for more control over assembly, and boolean literals for configuration predicates. Additionally, Cargo will now automatically clean its cache to manage disk usage, and several APIs have been stabilized for use in const contexts. Contributors to the release were acknowledged for their efforts.