← All reportsPublic report

rust-lang/rust

Empowering everyone to build reliable and efficient software.

116k stars Rust View on GitHubprofiled 11d ago
Try GitZoid
400PRs this week
75Contributors
140Deps scanned
2Issues found
01 · Repo overview

How rust is put together

This is the main source repository for the Rust programming language, containing the rustc compiler, the standard library (core/alloc/std), rustdoc, and a suite of development tools (clippy, miri, rustfmt, tidy, compiletest). It is written almost entirely in Rust, organized as multiple Cargo workspaces: the top-level workspace for tools and compiler crates, a separate `library/` workspace for the standard library, plus excluded workspaces for alternative backends (rustc_codegen_cranelift, rustc_codegen_gcc). The build is orchestrated by a custom Python/Rust bootstrap system (`src/bootstrap`, invoked via `configure`/`x`) that downloads a stage0 snapshot compiler, builds LLVM, and bootstraps the compiler through stages. Data flow follows a classic compiler pipeline: lexing/parsing (rustc_lexer, rustc_parse) to AST, lowering to HIR (rustc_ast_lowering), type checking and borrow checking (rustc_hir_typeck, rustc_borrowck), MIR construction/optimization (rustc_mir_*, rustc_const_eval), and code generation via LLVM (rustc_codegen_llvm) or experimental Cranelift/GCC backends.

Languages

RustPythonJavaScriptTypeScript

Frameworks

Cargo workspaces (custom multi-workspace layout)LLVM backend integration (rustc_codegen_llvm / rustc_llvm)tracing (instrumentation macros seen in compiler sources)

Infrastructure

Custom bootstrap build system (src/bootstrap, configure.py, x.py-style workflow)Stage0 snapshot compiler download with SHA-256 verification (src/tools/bump-stage0)CI-oriented tooling (build-manifest, opt-dist, remote-test-client/server, tier-check)Cross-platform target support (musl roots, Android NDK, QEMU rootfs, WASI targets)

Major components

compiler/ (rustc_* crates)

The rustc compiler implementation split into ~60 focused crates covering parsing, lowering, HIR, type checking, borrow checking, MIR, trait solving, and code generation.

library/

The Rust standard library: core, alloc, std, proc_macro, test, panic runtimes, compiler-builtins, and portable-simd, built as its own Cargo workspace into the sysroot.

src/bootstrap

The build orchestration system that configures options (via configure.py / bootstrap.example.toml), downloads stage0, builds LLVM, and drives staged compilation of the whole tree.

src/librustdoc

Rustdoc documentation generator: parses CLI/render configuration, generates HTML or JSON docs, runs doctests, and scrapes examples.

src/tools/clippy, miri, rustfmt

Bundled developer tools: the Clippy linter, the Miri interpreter, and the rustfmt formatter, each maintained as workspace members under src/tools.

src/tools/tidy & compiletest

Repository hygiene enforcement (tidy checks formatting/licensing/alphabetical ordering) and the compiletest harness that runs the compiler's extensive test suites.

compiler/rustc_codegen_cranelift & rustc_codegen_gcc

Experimental alternative codegen backends maintained as excluded sub-workspaces with their own toolchains and scripts.

Distribution & release tooling

Tools like build-manifest, rust-installer, bump-stage0, and opt-dist that produce, sign-verify (sha2), and package release artifacts.

Over the past month the Rust compiler project has been busy with a mix of internal cleanups and user-facing improvements. Highlights include progress toward stabilizing the long-awaited never type, removal of legacy box-pattern support in favor of deref patterns, significant rustdoc improvements around links and passes, and ongoing build-system (bootstrap) refinements. The team also continued hardening platform support, tightening diagnostics, and updating dependencies.

Week by week

2026-08-24A large week of rollups saw the never type stabilization land alongside major rustdoc cleanup, removal of box patterns from the compiler, and numerous build-system fixes.latest6 changes

Feature

Never type stabilization

A pull request to stabilize the never type (!) moved forward, a milestone for code that signals functions which never return.

Refactor

Box pattern removal

The old Box pattern-matching syntax was fully removed from the compiler, with Clippy migrated to use newer deref patterns instead.

Refactor

Rustdoc passes cleanup

Rustdoc removed the --passes=list option, simplifying how documentation tooling runs its analysis steps.

Fix

Rustdoc link checking improved

Redundant explicit links are now validated against the URLs rustdoc actually generates, catching more documentation mistakes.

Fix

Bootstrap LTO fix for ARM64

The build system stopped applying link-time optimization to C dependencies on aarch64 machines, fixing broken builds there.

Chore

Dependency and book updates

Routine maintenance included updated books, a lockfile-update warning system, and clearer naming for target-feature queries in the compiler.

2026-08-17This busy week focused on Clippy updates, better error messages for function-signature mismatches, and improvements to error recovery when parsing code.6 changes

Feature

Better ABI mismatch errors

Miri, the interpreter used to check unsafe code, now gives clearer error messages when a function's calling convention doesn't match its declaration.

Fix

Clippy subtree update

Clippy was refreshed with upstream changes, including a fix for an internal crash (ICE) involving large futures under the new trait solver.

Fix

Error recovery for tuple types

The parser can now recover more gracefully from mistyped tuple-type annotations, producing friendlier diagnostics.

Refactor

Build system renames

The core bootstrap build object was renamed from Build to Session, and several build paths were made explicit for clarity.

Chore

Constant evaluation test coverage

Runtime-constant classification tests were extended to cover 128-bit floats, improving confidence in floating-point constant handling.

Fix

UEFI TCP fix

A networking fix landed for UEFI targets, improving TCP support on that embedded/boot platform.

2026-08-10A smaller week centered on making funnel-shift operations safer by default, build-system LTO tuning, and infrastructure moves to cloud runners.6 changes

Fix

Funnel shift panic behavior

Funnel-shift operations in core now only panic when overflow checks are enabled, avoiding surprising crashes in optimized builds.

Refactor

LTO-aware dependency retention

The build system now keeps rustc's C dependencies consistent with the configured link-time optimization mode, reducing build issues.

Chore

CI move to EC2

An alternate Linux build job was migrated to AWS EC2 runners as part of ongoing infrastructure modernization.

Feature

16-bit target proc_macro support

The proc_macro library gained support for very small 16-bit targets, broadening where procedural macros can be built.

Fix

Unreachable code removal

Dead code was cleaned out of the compiler internals as part of routine tidying.

Chore

Dependency bumps

The cc build-tool dependency was bumped to 1.4.3 across the standard library and LLVM bindings.

2026-08-03Work this week targeted lint coverage, diagnostic quality, and foundational refactors of the compiler's type-checking machinery.6 changes

Fix

Drop lint expansion

The undropped_manually_drops lint was extended to catch misuse of drop_in_place as well, catching more manual-memory bugs.

Docs

Clearer dyn-compatibility errors

Error messages about why a trait can't be used as a dyn object gained extra context for associated functions without receivers.

Fix

Closure semicolon suggestion fix

The compiler now only suggests removing a closure's semicolon when it actually relates to the closure's return-type bounds.

Refactor

Generic visitability derive

A new #[generic_type_visitable] derive was implemented in the compiler, replacing ad-hoc type transformation machinery.

Feature

Directory operations added

New directory-manipulation operations were added, expanding file-system capabilities.

Fix

Target feature safety change

Using -Ctarget-feature is no longer treated as inherently unsafe, reflecting its improved safety story.

2026-07-27A quiet week focused on soft-float ABI compatibility checks and groundwork for the new generic-visitable trait infrastructure.6 changes

Fix

AVX2/soft-float incompatibility

The compiler now flags AVX2 (and likely all SSE) instructions as incompatible with the soft-float ABI, preventing invalid combinations.

Refactor

GenericTypeVisitable made unsafe

The new GenericTypeVisitable trait was marked unsafe, setting stricter contracts for its implementers.

Refactor

Visitable derive activated

The #[derive(GenericTypeVisitable)] macro became functional inside the compiler rather than a no-op placeholder.

Fix

Extended dropping-copy lints

Lints against accidentally dropping references or Copy types were expanded to also cover drop_in_place calls.

Fix

Cast padding fix

The pad_i32 field of PassMode::cast was corrected to be a proper integer type.

Chore

Miri lint allowances

Miri tests were adjusted to permit the dropping_copy_types lint where intentional, keeping the test suite green.

03 · Security check

Dependencies and code review

140 dependencies scanned

Dependency advisories

Security Watch

2 vulnerable packages (5 advisories) across 140 scanned dependencies.

warninghigh · npmfixed in 5.0.7

brace-expansion 1.1.14

3 advisories. Fixed in 5.0.7.

How it can be abusedAn attacker could feed a crafted pattern string to anything that uses brace-expansion to expand globs, causing the process to hang or run out of memory and crash. In this repository the package has no meaningful role since the codebase is Rust tooling that does not use this JavaScript package, so real exposure here is essentially limited to any bundled JavaScript dev tooling that happens to depend on it.

  • highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
  • highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
  • highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
warninghigh · npmfixed in 3.15.0

js-yaml 4.1.1

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker could feed a crafted YAML file to any tooling here that parses YAML with js-yaml, and the merge-key handling would burn CPU quadratically, slowing down or freezing builds and CI jobs that process it. Only developers or services running JavaScript-based tools in this repository are affected; the Rust compiler and standard library code itself do not use this package.

  • highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
  • highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required