<p><strong>TLDR:</strong> Rust 1.96.0 is out with Copy-compatible Range types, pattern-matching assertion macros, and patches for two Cargo security vulnerabilities — one affecting every Cargo version since 1.68. Bevy 0.18 shipped within its 3-month release window with 174 contributors, and the render graph is already being replaced with standard ECS schedules in 0.19. Niko Matsakis published a cluster of deep technical posts on borrow checker internals and Rust governance. Trail of Bits forged a zero-knowledge proof against Google’s Rust-based SP1 zkVM by exploiting unsafe memory bugs.</p>
<hr>
<h2>Rust 1.96.0 ships Copy Range types and patches two Cargo CVEs</h2>
<p>Rust 1.96.0 adds three Copy-compatible Range types in core::range that implement IntoIterator instead of Iterator directly, sidestepping the mid-iteration aliasing problem that blocked Copy on the existing ops types. Two new macros — assert_matches! and debug_assert_matches! — give better diagnostics than hand-rolled match+panic. More urgently, the release patches CVE-2026-5222 (low severity), where Cargo’s URL normalization incorrectly stripped .git suffixes on sparse index registries, potentially leaking auth tokens to a wrong registry. Every Cargo version from 1.68 through 1.95 is affected; the only fix is upgrading. CVE-2026-5223 (medium severity) covers a tarball symlink extraction issue that could overwrite cached source from other crates — <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a> users are unaffected since symlinks are already forbidden there. <a href="https://app.daily.dev/feed-by-ids?id=B8QYTlEFo&amp;id=cHl9wdBBC&amp;id=CGcMgo8M7" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Bevy 0.18 ships, render graph replaced with ECS schedules in 0.19</h2>
<p>Bevy 0.18 landed with 174 contributors and 659 pull requests, including procedural atmosphere, volumetric fog, new UI widgets, variable font support, and glTF extension handling. The 0.19 branch already has a significant architectural change merged: the custom render graph (Node/ViewNode traits, subgraphs, connection points) is gone, replaced by standard Bevy ECS schedules. Core3D is now a schedule where systems use before/after ordering, which simplifies custom post-processing, compute shaders, and render phases considerably. The metrics dashboard at <a href="http://metrics.bevy.org" target="_blank" rel="noopener nofollow">metrics.bevy.org</a> now tracks build times, binary size, and stress test performance publicly. <a href="https://app.daily.dev/feed-by-ids?id=xWXa36hc1&amp;id=9H0LAjTwY&amp;id=ikzk2tJ7U&amp;id=8JA753Rxs" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Trail of Bits forged a ZK proof against Google’s SP1 zkVM using unsafe Rust bugs</h2>
<p>Trail of Bits exploited two vulnerabilities in Google’s Rust-based SP1 zkVM prover to forge a zero-knowledge proof claiming better quantum circuit performance than Google’s original results. An out-of-bounds jump table access in unsafe Rust bypassed the Toffoli gate counter, and register aliasing allowed non-reversible classical logic inside what should be a quantum circuit. Combined with novel algorithmic work, the forged proof showed 8.3M operations, 1,164 qubits, and 0 Toffoli gates — beating Google’s metrics on all dimensions. Google patched the vulnerabilities and their scientific claims remain valid, but the incident is a concrete example of unsafe Rust memory bugs undermining cryptographic guarantees. <a href="https://app.daily.dev/posts/Ho8WGrAxO" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Niko Matsakis publishes deep dives on NLL, alias-based borrow checking, and Rust governance</h2>
<p>A batch of posts from Niko Matsakis covers the technical and organizational sides of Rust. On the technical side: detailed explorations of non-lexical lifetimes using location-aware outlives relations, an alias-based reformulation of the borrow checker using Datalog rules over loan sets (a prototype passes the full NLL test suite), and the emerging design for async fn in dyn-safe traits. On the governance side: a proposal for project goals with named owners and quarterly accountability, reflections on the RFC process encouraging solution-space mapping over proposal defense, and a post on unbounded RFC queues and the case for capacity-aware acceptance. These aren’t new announcements but represent active design work shaping where Rust’s type system and process are heading. <a href="https://app.daily.dev/feed-by-ids?id=z4xWRgRGK&amp;id=ZApB0N5LW&amp;id=qY9XgE4om&amp;id=eFQuP6Hwz&amp;id=EUaeT3XpT&amp;id=9wf6gAfhP&amp;id=YvuEStDRn" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Rust Coreutils 0.9 released with security hardening and zero-copy I/O:</strong> Following a third-party audit funded by Canonical, Rust Coreutils 0.9 ships security fixes, reduced unsafe code, and zero-copy I/O gains for splice/tee/pipe commands; Canonical is targeting full adoption in Ubuntu 26.10. <a href="https://app.daily.dev/posts/IV8uBsqyq" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KRAID: new Rust shader compiler for Arm Mali v9 GPUs:</strong> Faith Ekstrand of Collabora announced KRAID, a Rust-written shader compiler targeting Arm Mali v9 Valhalla and newer architectures for the open-source Panfrost/PanVK Mesa driver; it has passed its first dEQP compliance test and is expected to merge into mainline Mesa behind the -Dpanfrost-rust build option. <a href="https://app.daily.dev/posts/lbQgb3uje" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>bijou64: canonical varint encoding decodes 2–10x faster than LEB128:</strong> bijou64 is a variable-length integer encoding designed for CRDT sync that guarantees exactly one valid byte representation per integer, eliminating canonicality-check bugs; benchmarks on ARM M2 Pro and x86 Zen 5 show 2–10x decode speedup over LEB128, and the crate is published on <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a> with a Wasm/JS wrapper. <a href="https://app.daily.dev/posts/ZXAYBGiY5" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TokioConf 2027 announced for April 26-27 in Portland:</strong> TokioConf 2026 recordings are now on YouTube, and TokioConf 2027 is set for April 26-27, 2027 in Portland, OR; the 2026 conference produced a proposed spawn_compute API for Tokio. <a href="https://app.daily.dev/posts/eVrIMteGG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>rust-analyzer v0.3.2913 ships module incrementality performance improvement:</strong> The 2026-05-25 release includes a performance fix for module incrementality plus bug fixes for flycheck feature filtering, float-to-uint const eval saturation, and enum variant auto-import. <a href="https://app.daily.dev/posts/V9WipEmtf" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Rust language updates, async patterns, and systems programming.

Rust Digest

Rust 1.96.0 ships Copy-compatible Range types, pattern-matching assertion macros, and patches for two Cargo CVEs (CVE-2026-5222 and CVE-2026-5223), the first affecting all Cargo versions since 1.68. Bevy 0.18 landed with 174 contributors and 659 PRs; Bevy 0.19 is already replacing the custom render graph with standard ECS schedules. Trail of Bits forged a zero-knowledge proof against Google's SP1 zkVM by exploiting unsafe Rust memory bugs — an out-of-bounds jump table access and register aliasing — demonstrating how unsafe code can undermine cryptographic guarantees. Niko Matsakis published deep dives on NLL, alias-based borrow checking via Datalog, async fn in dyn traits, and Rust governance reforms. Also notable: Rust Coreutils 0.9 with security hardening, the KRAID shader compiler for Arm Mali v9, the bijou64 varint encoding crate, TokioConf 2027 announced, and rust-analyzer performance improvements.

Rust 1.96 ships two Cargo CVEs, Bevy 0.18 lands on schedule