--- title: "Rust 1.96 ships two Cargo CVEs, Bevy 0.18 lands on schedule" url: https://daily.dev/posts/rust-1-96-ships-two-cargo-cves-bevy-0-18-lands-on-schedule-tkpkvuzme source_url: https://daily.dev/posts/rust-1-96-ships-two-cargo-cves-bevy-0-18-lands-on-schedule-tkpkvuzme type: freeform source: "Rust Digest" published: 2026-06-01T04:20:47.331Z updated: 2026-06-01T04:21:04.806Z tags: ["security", "rust", "zero-knowledge-proofs"] reading_time: 5 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rust 1.96 ships two Cargo CVEs, Bevy 0.18 lands on schedule **[Rust Digest](https://daily.dev/sources/rust_digest)** · 5 min read · 1 upvotes · 0 comments ## Summary Rust 1.96.0 ships Copy-compatible Range types, pattern-matching assertion macros, and patches for two Cargo CVEs (CVE-2026-5222 and CVE-2026-5223), the first affecting all Cargo versions since 1.68. Bevy 0.18 landed with 174 contributors and 659 PRs; Bevy 0.19 is already replacing the custom render graph with standard ECS schedules. Trail of Bits forged a zero-knowledge proof against Google's SP1 zkVM by exploiting unsafe Rust memory bugs — an out-of-bounds jump table access and register aliasing — demonstrating how unsafe code can undermine cryptographic guarantees. Niko Matsakis published deep dives on NLL, alias-based borrow checking via Datalog, async fn in dyn traits, and Rust governance reforms. Also notable: Rust Coreutils 0.9 with security hardening, the KRAID shader compiler for Arm Mali v9, the bijou64 varint encoding crate, TokioConf 2027 announced, and rust-analyzer performance improvements. ## Content **TLDR:** Rust 1.96.0 is out with Copy-compatible Range types, pattern-matching assertion macros, and patches for two Cargo security vulnerabilities — one affecting every Cargo version since 1.68. Bevy 0.18 shipped within its 3-month release window with 174 contributors, and the render graph is already being replaced with standard ECS schedules in 0.19. Niko Matsakis published a cluster of deep technical posts on borrow checker internals and Rust governance. Trail of Bits forged a zero-knowledge proof against Google's Rust-based SP1 zkVM by exploiting unsafe memory bugs. --- ## Rust 1.96.0 ships Copy Range types and patches two Cargo CVEs Rust 1.96.0 adds three Copy-compatible Range types in core::range that implement IntoIterator instead of Iterator directly, sidestepping the mid-iteration aliasing problem that blocked Copy on the existing ops types. Two new macros — assert_matches! and debug_assert_matches! — give better diagnostics than hand-rolled match+panic. More urgently, the release patches CVE-2026-5222 (low severity), where Cargo's URL normalization incorrectly stripped .git suffixes on sparse index registries, potentially leaking auth tokens to a wrong registry. Every Cargo version from 1.68 through 1.95 is affected; the only fix is upgrading. CVE-2026-5223 (medium severity) covers a tarball symlink extraction issue that could overwrite cached source from other crates — crates.io users are unaffected since symlinks are already forbidden there. [Read more](https://app.daily.dev/feed-by-ids?id=B8QYTlEFo&id=cHl9wdBBC&id=CGcMgo8M7) ## Bevy 0.18 ships, render graph replaced with ECS schedules in 0.19 Bevy 0.18 landed with 174 contributors and 659 pull requests, including procedural atmosphere, volumetric fog, new UI widgets, variable font support, and glTF extension handling. The 0.19 branch already has a significant architectural change merged: the custom render graph (Node/ViewNode traits, subgraphs, connection points) is gone, replaced by standard Bevy ECS schedules. Core3D is now a schedule where systems use before/after ordering, which simplifies custom post-processing, compute shaders, and render phases considerably. The metrics dashboard at metrics.bevy.org now tracks build times, binary size, and stress test performance publicly. [Read more](https://app.daily.dev/feed-by-ids?id=xWXa36hc1&id=9H0LAjTwY&id=ikzk2tJ7U&id=8JA753Rxs) ## Trail of Bits forged a ZK proof against Google's SP1 zkVM using unsafe Rust bugs Trail of Bits exploited two vulnerabilities in Google's Rust-based SP1 zkVM prover to forge a zero-knowledge proof claiming better quantum circuit performance than Google's original results. An out-of-bounds jump table access in unsafe Rust bypassed the Toffoli gate counter, and register aliasing allowed non-reversible classical logic inside what should be a quantum circuit. Combined with novel algorithmic work, the forged proof showed 8.3M operations, 1,164 qubits, and 0 Toffoli gates — beating Google's metrics on all dimensions. Google patched the vulnerabilities and their scientific claims remain valid, but the incident is a concrete example of unsafe Rust memory bugs undermining cryptographic guarantees. [Read more](https://app.daily.dev/posts/Ho8WGrAxO) ## Niko Matsakis publishes deep dives on NLL, alias-based borrow checking, and Rust governance A batch of posts from Niko Matsakis covers the technical and organizational sides of Rust. On the technical side: detailed explorations of non-lexical lifetimes using location-aware outlives relations, an alias-based reformulation of the borrow checker using Datalog rules over loan sets (a prototype passes the full NLL test suite), and the emerging design for async fn in dyn-safe traits. On the governance side: a proposal for project goals with named owners and quarterly accountability, reflections on the RFC process encouraging solution-space mapping over proposal defense, and a post on unbounded RFC queues and the case for capacity-aware acceptance. These aren't new announcements but represent active design work shaping where Rust's type system and process are heading. [Read more](https://app.daily.dev/feed-by-ids?id=z4xWRgRGK&id=ZApB0N5LW&id=qY9XgE4om&id=eFQuP6Hwz&id=EUaeT3XpT&id=9wf6gAfhP&id=YvuEStDRn) --- ## Also notable - **Rust Coreutils 0.9 released with security hardening and zero-copy I/O:** Following a third-party audit funded by Canonical, Rust Coreutils 0.9 ships security fixes, reduced unsafe code, and zero-copy I/O gains for splice/tee/pipe commands; Canonical is targeting full adoption in Ubuntu 26.10. [Read more](https://app.daily.dev/posts/IV8uBsqyq) - **KRAID: new Rust shader compiler for Arm Mali v9 GPUs:** Faith Ekstrand of Collabora announced KRAID, a Rust-written shader compiler targeting Arm Mali v9 Valhalla and newer architectures for the open-source Panfrost/PanVK Mesa driver; it has passed its first dEQP compliance test and is expected to merge into mainline Mesa behind the -Dpanfrost-rust build option. [Read more](https://app.daily.dev/posts/lbQgb3uje) - **bijou64: canonical varint encoding decodes 2–10x faster than LEB128:** bijou64 is a variable-length integer encoding designed for CRDT sync that guarantees exactly one valid byte representation per integer, eliminating canonicality-check bugs; benchmarks on ARM M2 Pro and x86 Zen 5 show 2–10x decode speedup over LEB128, and the crate is published on crates.io with a Wasm/JS wrapper. [Read more](https://app.daily.dev/posts/ZXAYBGiY5) - **TokioConf 2027 announced for April 26-27 in Portland:** TokioConf 2026 recordings are now on YouTube, and TokioConf 2027 is set for April 26-27, 2027 in Portland, OR; the 2026 conference produced a proposed spawn_compute API for Tokio. [Read more](https://app.daily.dev/posts/eVrIMteGG) - **rust-analyzer v0.3.2913 ships module incrementality performance improvement:** The 2026-05-25 release includes a performance fix for module incrementality plus bug fixes for flycheck feature filtering, float-to-uint const eval saturation, and enum variant auto-import. [Read more](https://app.daily.dev/posts/V9WipEmtf) --- Tags: [#security](https://daily.dev/tags/security), [#rust](https://daily.dev/tags/rust), [#zero-knowledge-proofs](https://daily.dev/tags/zero-knowledge-proofs) [View this post on daily.dev](https://daily.dev/posts/rust-1-96-ships-two-cargo-cves-bevy-0-18-lands-on-schedule-tkpkvuzme)