rust-lang/rust
Empowering everyone to build reliable and efficient software.
How rust is put together
This is the main source repository for the Rust programming language, containing the rustc compiler, the standard library (core/alloc/std), rustdoc, and a suite of development tools (clippy, miri, rustfmt, tidy, compiletest). It is written almost entirely in Rust, organized as multiple Cargo workspaces: the top-level workspace for tools and compiler crates, a separate `library/` workspace for the standard library, plus excluded workspaces for alternative backends (rustc_codegen_cranelift, rustc_codegen_gcc). The build is orchestrated by a custom Python/Rust bootstrap system (`src/bootstrap`, invoked via `configure`/`x`) that downloads a stage0 snapshot compiler, builds LLVM, and bootstraps the compiler through stages. Data flow follows a classic compiler pipeline: lexing/parsing (rustc_lexer, rustc_parse) to AST, lowering to HIR (rustc_ast_lowering), type checking and borrow checking (rustc_hir_typeck, rustc_borrowck), MIR construction/optimization (rustc_mir_*, rustc_const_eval), and code generation via LLVM (rustc_codegen_llvm) or experimental Cranelift/GCC backends.
Languages
Frameworks
Infrastructure
Major components
compiler/ (rustc_* crates)
The rustc compiler implementation split into ~60 focused crates covering parsing, lowering, HIR, type checking, borrow checking, MIR, trait solving, and code generation.
library/
The Rust standard library: core, alloc, std, proc_macro, test, panic runtimes, compiler-builtins, and portable-simd, built as its own Cargo workspace into the sysroot.
src/bootstrap
The build orchestration system that configures options (via configure.py / bootstrap.example.toml), downloads stage0, builds LLVM, and drives staged compilation of the whole tree.
src/librustdoc
Rustdoc documentation generator: parses CLI/render configuration, generates HTML or JSON docs, runs doctests, and scrapes examples.
src/tools/clippy, miri, rustfmt
Bundled developer tools: the Clippy linter, the Miri interpreter, and the rustfmt formatter, each maintained as workspace members under src/tools.
src/tools/tidy & compiletest
Repository hygiene enforcement (tidy checks formatting/licensing/alphabetical ordering) and the compiletest harness that runs the compiler's extensive test suites.
compiler/rustc_codegen_cranelift & rustc_codegen_gcc
Experimental alternative codegen backends maintained as excluded sub-workspaces with their own toolchains and scripts.
Distribution & release tooling
Tools like build-manifest, rust-installer, bump-stage0, and opt-dist that produce, sign-verify (sha2), and package release artifacts.
A large week of rollups saw the never type stabilization land alongside major rustdoc cleanup, removal of box patterns from the compiler, and numerous build-system fixes.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A large week of rollups saw the never type stabilization land alongside major rustdoc cleanup, removal of box patterns from the compiler, and numerous build-system fixes.
Week of 2026-08-17
This busy week focused on Clippy updates, better error messages for function-signature mismatches, and improvements to error recovery when parsing code.
Week of 2026-08-10
A smaller week centered on making funnel-shift operations safer by default, build-system LTO tuning, and infrastructure moves to cloud runners.
Week of 2026-08-03
Work this week targeted lint coverage, diagnostic quality, and foundational refactors of the compiler's type-checking machinery.
Week of 2026-07-27
A quiet week focused on soft-float ABI compatibility checks and groundwork for the new generic-visitable trait infrastructure.
Over the past month the Rust compiler project has been busy with a mix of internal cleanups and user-facing improvements. Highlights include progress toward stabilizing the long-awaited never type, removal of legacy box-pattern support in favor of deref patterns, significant rustdoc improvements around links and passes, and ongoing build-system (bootstrap) refinements. The team also continued hardening platform support, tightening diagnostics, and updating dependencies.
Week by week
2026-08-24A large week of rollups saw the never type stabilization land alongside major rustdoc cleanup, removal of box patterns from the compiler, and numerous build-system fixes.latest6 changes
Feature
Never type stabilization
A pull request to stabilize the never type (!) moved forward, a milestone for code that signals functions which never return.
Refactor
Box pattern removal
The old Box pattern-matching syntax was fully removed from the compiler, with Clippy migrated to use newer deref patterns instead.
Refactor
Rustdoc passes cleanup
Rustdoc removed the --passes=list option, simplifying how documentation tooling runs its analysis steps.
Fix
Rustdoc link checking improved
Redundant explicit links are now validated against the URLs rustdoc actually generates, catching more documentation mistakes.
Fix
Bootstrap LTO fix for ARM64
The build system stopped applying link-time optimization to C dependencies on aarch64 machines, fixing broken builds there.
Chore
Dependency and book updates
Routine maintenance included updated books, a lockfile-update warning system, and clearer naming for target-feature queries in the compiler.
2026-08-17This busy week focused on Clippy updates, better error messages for function-signature mismatches, and improvements to error recovery when parsing code.6 changes
Feature
Better ABI mismatch errors
Miri, the interpreter used to check unsafe code, now gives clearer error messages when a function's calling convention doesn't match its declaration.
Fix
Clippy subtree update
Clippy was refreshed with upstream changes, including a fix for an internal crash (ICE) involving large futures under the new trait solver.
Fix
Error recovery for tuple types
The parser can now recover more gracefully from mistyped tuple-type annotations, producing friendlier diagnostics.
Refactor
Build system renames
The core bootstrap build object was renamed from Build to Session, and several build paths were made explicit for clarity.
Chore
Constant evaluation test coverage
Runtime-constant classification tests were extended to cover 128-bit floats, improving confidence in floating-point constant handling.
Fix
UEFI TCP fix
A networking fix landed for UEFI targets, improving TCP support on that embedded/boot platform.
2026-08-10A smaller week centered on making funnel-shift operations safer by default, build-system LTO tuning, and infrastructure moves to cloud runners.6 changes
Fix
Funnel shift panic behavior
Funnel-shift operations in core now only panic when overflow checks are enabled, avoiding surprising crashes in optimized builds.
Refactor
LTO-aware dependency retention
The build system now keeps rustc's C dependencies consistent with the configured link-time optimization mode, reducing build issues.
Chore
CI move to EC2
An alternate Linux build job was migrated to AWS EC2 runners as part of ongoing infrastructure modernization.
Feature
16-bit target proc_macro support
The proc_macro library gained support for very small 16-bit targets, broadening where procedural macros can be built.
Fix
Unreachable code removal
Dead code was cleaned out of the compiler internals as part of routine tidying.
Chore
Dependency bumps
The cc build-tool dependency was bumped to 1.4.3 across the standard library and LLVM bindings.
2026-08-03Work this week targeted lint coverage, diagnostic quality, and foundational refactors of the compiler's type-checking machinery.6 changes
Fix
Drop lint expansion
The undropped_manually_drops lint was extended to catch misuse of drop_in_place as well, catching more manual-memory bugs.
Docs
Clearer dyn-compatibility errors
Error messages about why a trait can't be used as a dyn object gained extra context for associated functions without receivers.
Fix
Closure semicolon suggestion fix
The compiler now only suggests removing a closure's semicolon when it actually relates to the closure's return-type bounds.
Refactor
Generic visitability derive
A new #[generic_type_visitable] derive was implemented in the compiler, replacing ad-hoc type transformation machinery.
Feature
Directory operations added
New directory-manipulation operations were added, expanding file-system capabilities.
Fix
Target feature safety change
Using -Ctarget-feature is no longer treated as inherently unsafe, reflecting its improved safety story.
2026-07-27A quiet week focused on soft-float ABI compatibility checks and groundwork for the new generic-visitable trait infrastructure.6 changes
Fix
AVX2/soft-float incompatibility
The compiler now flags AVX2 (and likely all SSE) instructions as incompatible with the soft-float ABI, preventing invalid combinations.
Refactor
GenericTypeVisitable made unsafe
The new GenericTypeVisitable trait was marked unsafe, setting stricter contracts for its implementers.
Refactor
Visitable derive activated
The #[derive(GenericTypeVisitable)] macro became functional inside the compiler rather than a no-op placeholder.
Fix
Extended dropping-copy lints
Lints against accidentally dropping references or Copy types were expanded to also cover drop_in_place calls.
Fix
Cast padding fix
The pad_i32 field of PassMode::cast was corrected to be a proper integer type.
Chore
Miri lint allowances
Miri tests were adjusted to permit the dropping_copy_types lint where intentional, keeping the test suite green.
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (5 advisories) across 140 scanned dependencies.
brace-expansion 1.1.14
3 advisories. Fixed in 5.0.7.
How it can be abusedAn attacker could feed a crafted pattern string to anything that uses brace-expansion to expand globs, causing the process to hang or run out of memory and crash. In this repository the package has no meaningful role since the codebase is Rust tooling that does not use this JavaScript package, so real exposure here is essentially limited to any bundled JavaScript dev tooling that happens to depend on it.
- highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
- highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
- highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
js-yaml 4.1.1
2 advisories. Fixed in 3.15.0.
How it can be abusedAn attacker could feed a crafted YAML file to any tooling here that parses YAML with js-yaml, and the merge-key handling would burn CPU quadratically, slowing down or freezing builds and CI jobs that process it. Only developers or services running JavaScript-based tools in this repository are affected; the Rust compiler and standard library code itself do not use this package.
- highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
- highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required