rust-official-blog

<p>Rust's WebAssembly targets are soon going to experience a change which has a risk of breaking existing projects, and this post is intended to notify users of this upcoming change, explain what it is, and how to handle it. Specifically, all WebAssembly targets in Rust have been linked using the <code>--allow-undefined</code> flag to <code>wasm-ld</code>, and this flag is being removed.</p> <h2 id="what-is-allow-undefined"><a class="anchor" href="#what-is-allow-undefined" aria-hidden="true"></a> What is <code>--allow-undefined</code>?</h2> <p>WebAssembly binaries in Rust today are all created by linking with <code>wasm-ld</code>. This serves a similar purpose to <code>ld</code>, <code>lld</code>, and <code>mold</code>, for example; it takes separately compiled crates/object files and creates one final binary. Since the first introduction of WebAssembly targets in Rust, the <code>--allow-undefined</code> flag has been passed to <code>wasm-ld</code>. This flag is documented as:</p> <pre…

<h1 id="building-fewer-targets-by-default"><a class="anchor" href="#building-fewer-targets-by-default" aria-hidden="true"></a> Building fewer targets by default</h1> <p>On <strong>2026-05-01</strong>, docs.rs will make a <strong>breaking</strong> change to its build behavior.</p> <p>Today, if a crate does not define a <code>targets</code> list in its <a rel="external" href="https://docs.rs/about/metadata">docs.rs metadata</a>, docs.rs builds documentation for a default list of five targets.</p> <p>Starting on <strong>2026-05-01</strong>, docs.rs will instead build documentation for only the default target unless additional targets are requested explicitly.</p> <p>This is the next step in a change we first introduced in 2020, when docs.rs added support for opting into fewer build targets. Most crates do not compile different code for different targets, so building fewer targets by default is a better fit for most releases. It also reduces build times and saves resources on docs.rs.</p> …

<p>The Rust team is happy to announce a new version of Rust, 1.95.0. Rust is a programming language empowering everyone to build reliable and efficient software.</p> <p>If you have a previous version of Rust installed via <code>rustup</code>, you can get 1.95.0 with:</p> <pre class="giallo z-code"><code data-lang="shellsession"><span class="giallo-l"><span>$</span><span> rustup update stable</span></span></code></pre> <p>If you don't have it already, you can <a rel="external" href="https://www.rust-lang.org/install.html">get <code>rustup</code></a> from the appropriate page on our website, and check out the <a rel="external" href="https://doc.rust-lang.org/stable/releases.html#version-1950-2026-04-16">detailed release notes for 1.95.0</a>.</p> <p>If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel (<code>rustup default beta</code>) or the nightly channel (<code>rustup default nightly</code>). Please <a rel="external" href…

<p>As <a rel="external" href="https://blog.rust-lang.org/2026/02/19/Rust-participates-in-GSoC-2026/">previously announced</a>, the Rust Project is participating in <a rel="external" href="https://summerofcode.withgoogle.com">Google Summer of Code (GSoC)</a> 2026. GSoC is a global program organized by Google that is designed to bring new contributors to the world of open source.</p> <p>A few months ago, we published a list of <a rel="external" href="https://github.com/rust-lang/google-summer-of-code">GSoC project ideas</a>, and started discussing these projects with potential GSoC applicants on our <a rel="external" href="https://rust-lang.zulipchat.com/#narrow/stream/421156-gsoc">Zulip</a>. We had many interesting discussions with the potential contributors, and even saw some of them making non-trivial contributions to various Rust Project repositories before GSoC officially started!</p> <p>The applicants prepared and submitted their project proposals by the end of March. This year, we…

<p>The <code>nvptx64-nvidia-cuda</code> target is a compilation target for NVIDIA GPUs. When using this target, the final output is <a rel="external" href="https://docs.nvidia.com/cuda/parallel-thread-execution/index.html">PTX</a>. Two version choices shape that output:</p> <ul> <li>a GPU architecture (for example, <code>sm_70</code>, <code>sm_80</code>, …), which determines which GPUs can run the PTX, and</li> <li>a PTX ISA version, which determines which CUDA driver versions can load (and JIT-compile) the PTX.</li> </ul> <p>In Rust 1.97 (scheduled for release on July 9, 2026), the baseline PTX ISA version and GPU architecture for <code>nvptx64-nvidia-cuda</code> will be <a rel="external" href="https://github.com/rust-lang/compiler-team/issues/965">increased</a>. These changes affect both the Rust compiler (<code>rustc</code>) and related host tooling, and they make it impossible to generate PTX artifacts compatible with older GPUs and older CUDA drivers.</p> <p>The new minimum suppor…

<p>The Rust Project has been building up a good history of participating in various open-source mentorship programs, including <a rel="external" href="https://blog.rust-lang.org/2026/04/30/gsoc-2026-selected-projects/">Google Summer of Code</a> for three years (including this year) and <a rel="external" href="https://blog.rust-lang.org/2024/05/07/OSPP-2024/">previously OSPP</a>. We're happy to announce that this year we are also participating in <a rel="external" href="https://www.outreachy.org/">Outreachy</a> starting in the May 2026 cohort.</p> <p>Each of these mentorship programs has different criteria for eligibility depending on who they target and the motivations of the program. Outreachy provides internships in open source, to people from any background who face underrepresentation, systemic bias, or discrimination in the technical industry where they are living. You can learn more about the Outreachy program <a rel="external" href="https://www.outreachy.org/">on their website</…

<p>The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the <a rel="external" href="https://doc.rust-lang.org/cargo/reference/registries.html#registry-protocols">sparse index protocol</a>. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry.</p> <p>This vulnerability is tracked as CVE-2026-5222. The severity of the vulnerability is <strong>low</strong>, due to the extremely niche requirements needed to achieve the attack.</p> <h2 id="overview"><a class="anchor" href="#overview" aria-hidden="true"></a> Overview</h2> <p>Originally Cargo only supported storing a registry's index within git repositories. Most git hosting solutions allow accessing a git repository with or without the <code>.git</code> suffix, so Cargo mirrored this behavior when normalizing…

<p>The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.</p> <p>This vulnerability is tracked as CVE-2026-5223. The severity of the vulnerability is <strong>medium</strong> for users of third-party registries. Users of crates.io are <strong>not affected</strong>, as crates.io forbids uploading crates containing any symlink.</p> <h2 id="overview"><a class="anchor" href="#overview" aria-hidden="true"></a> Overview</h2> <p>When building a crate, Cargo extracts its source code in a local cache (stored within <code>~/.cargo</code>), reusing it for any future build. Cargo includes protections to prevent any file from being extracted outside of the crate's own cache directory.</p> <p>It was discovered that it's possible to craft a malicious tarball able to extract files one level below the crate's own ca…

<p>The Rust team is happy to announce a new version of Rust, 1.96.0. Rust is a programming language empowering everyone to build reliable and efficient software.</p> <p>If you have a previous version of Rust installed via <code>rustup</code>, you can get 1.96.0 with:</p> <pre class="giallo z-code"><code data-lang="shellsession"><span class="giallo-l"><span>$</span><span> rustup update stable</span></span></code></pre> <p>If you don't have it already, you can <a rel="external" href="https://www.rust-lang.org/install.html">get <code>rustup</code></a> from the appropriate page on our website, and check out the <a rel="external" href="https://doc.rust-lang.org/stable/releases.html#version-1960-2026-05-28">detailed release notes for 1.96.0</a>.</p> <p>If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel (<code>rustup default beta</code>) or the nightly channel (<code>rustup default nightly</code>). Please <a rel="external" href…

<blockquote> <p>If you want to financially support the development of Rust, please consider <a rel="external" href="https://github.com/sponsors/rustfoundation">donating</a> to the Rust Foundation Maintainers Fund.</p> </blockquote> <p>A few months ago, the Rust Foundation announced the <a rel="external" href="https://rustfoundation.org/media/announcing-the-rust-foundation-maintainers-fund/">Rust Foundation Maintainers Fund</a> (RFMF). Since then, the Rust Project has been closely cooperating with the Rust Foundation to determine how exactly this fund will be used to support Rust maintainers. This resulted in the acceptance of <a rel="external" href="https://rust-lang.github.io/rfcs/3931-rfmf-rust-foundation-maintainer-fund.html">RFC #3931</a>, which established the <a rel="external" href="https://rust-lang.org/governance/teams/launching-pad/#team-funding">Funding team</a> and the <a rel="external" href="https://rust-lang.github.io/rfcs/3931-rfmf-rust-foundation-maintainer-fund.html#exp…

<p>The 2025H2 Project Goal period has now concluded. Over these months, the Rust Project pursued <a rel="external" href="https://rust-lang.github.io/rust-project-goals/2025h2/goals.html">41 Project Goals</a>, 13 of which were designated as <a rel="external" href="https://rust-lang.github.io/rust-project-goals/2025h2/goals.html#flagship-goals">Flagship Goals</a>. This post contains curated updates on our progress since the <a rel="external" href="https://blog.rust-lang.org/2026/01/05/project-goals-2025-december-update/">last post</a> and the final status for each of the goals (many of which continue as part of the 2026 period). Full details for any particular goal are available in its <a rel="external" href="https://github.com/rust-lang/rust-project-goals/issues?q=is%3Aissue%20label%3Aex-2025h2">tracking issue</a>.</p> <p>Thanks to everyone who contributed! &lt;3</p> <h2 id="table-of-contents"><a class="anchor" href="#table-of-contents" aria-hidden="true"></a> Table of contents</h2> <ul…