From Rust Blog · 10 stories
Malicious `proc-macro1` crate leads to supply chain attack on `arrayref` and other Rust crates
The Rust Security Response Team identified and removed several malicious crates, including `proc-macro1`, which was used in a supply chain attack to compromise popular crates like `arrayref`, `internment`, and `append-only-vec`. This incident highlights the vulnerability of software supply chains to malicious package injections and necessitates developers to verify their dependencies.
Rust Enables Polonius Alpha Borrow Checker on Nightly Builds
The Rust team has enabled the Polonius Alpha borrow checker on nightly builds, preparing for stabilization in the coming months. This new iteration allows more code to compile by enabling flow-sensitive borrow checking of lifetime outlives relationships, addressing limitations of the current NLL borrow checker.
Rust 1.96.1 and 1.97.1 Released with Critical Fixes and Stability Improvements
The Rust team has released versions 1.96.1 and 1.97.1, focusing on critical security and stability updates. Rust 1.96.1 addresses security vulnerabilities in libssh2, while 1.97.1 resolves a miscompilation issue stemming from an LLVM optimization. These versions aim to increase the reliability and security of Rust applications.
Crates.io Adds Code Viewer and Decouples Accounts from GitHub
Crates.io has introduced a new Code tab for browsing published crate versions and is untangling account identities from GitHub. This update simplifies dependency audits and paves the way for broader login options, improving overall usability.
Rust Foundation Launches Maintainers Fund to Support Developers
The Rust Foundation has launched the Rust Foundation Maintainers Fund (RFMF) to financially support Rust maintainers. The fund aims to ensure proper support for maintainers of critical Rust projects, enabling them to focus on key development activities.
Rust Security Team Addresses Cargo Vulnerabilities (CVE-2026-5222 & CVE-2026-5223)
The Rust Security Response Team has identified two vulnerabilities in Cargo, impacting third-party registries. CVE-2026-5222 is a low-severity issue allowing potential credential exposure, while CVE-2026-5223 is a medium-severity issue that could allow malicious code to overwrite other crates. Rust 1.96.0, releasing May 28, 2026, will address these issues.
Rust Project concludes 2025H2 Goals with updates on 41 objectives
The Rust Project has completed its 2025H2 period, accomplishing 41 Project Goals, including 13 Flagship Goals. Updates indicate ongoing work will continue into 2026, reflecting the project's commitment to enhancing the Rust programming language.
Rust 1.97 raises baseline for NVPTX compilation target impacting older CUDA drivers
Rust 1.97, scheduled for July 9, 2026, will raise the baseline PTX ISA version and GPU architecture for the nvptx64-nvidia-cuda target. This change makes older GPU architectures and CUDA drivers incompatible with the new Rust version, but affects mostly outdated technology no longer supported by NVIDIA.
Insights from Learning Rust: Experiences and Resources
A recent study highlighted various paths learners take to acquire Rust programming skills and the resources they utilize. Recommendations from experienced developers cover a range of official documentation and community-generated materials, demonstrating diverse learning preferences.
Rust Project Announces 13 Accepted GSoC 2026 Projects Amid Increased Submissions
The Rust Project announced 13 accepted projects for Google Summer of Code (GSoC) 2026, chosen from 96 proposals, reflecting growing interest in open-source contributions. The Rust Project also joins Outreachy for May 2026 to support underrepresented groups in tech. The increase in interest highlights the challenges of managing AI-generated submissions in open-source projects.