<p><strong>TLDR:</strong> A real security advisory hit Cargo this week — a malicious crate could change permissions on arbitrary filesystem directories during extraction. The n0 team shipped noq, a hard fork of Quinn built around multipath QUIC and production NAT traversal. Google’s Sashiko AI review tool expanded to the rust-for-linux mailing list. And Niko Matsakis posted a concrete, minimal proposal for view types that could actually ship as a lang experiment.</p>
<hr>
<h2>CVE-2026-33056: Cargo’s tar extraction flaw</h2>
<p>The Rust Security Response Team disclosed a vulnerability in the third-party <code>tar</code> crate used by Cargo: a malicious crate can change permissions on arbitrary filesystem directories during extraction. For <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a> users, a server-side mitigation went out March 13th and an audit found no existing crates exploiting it. A patched Rust 1.94.1 is scheduled for March 26th, but that won’t help users on older Cargo versions pointing at alternate registries — if that’s you, contact your registry vendor now.</p>
<h2>noq: Quinn fork with multipath QUIC and NAT traversal</h2>
<p>The n0 team announced noq, a hard fork of Quinn that’s been powering iroh since v0.96. The motivation was structural: multipath QUIC support and production-grade NAT traversal hole-punching required changes deep enough that upstreaming them would have been unreasonable to ask of Quinn maintainers. noq adds full QUIC Multipath spec support, QUIC Address Discovery (replacing STUN), extended QLog debugging, and a WeakConnectionHandle API. It’s been tested against picoquic for interoperability. Worth watching if you’re building peer-to-peer or relay-heavy networking in Rust.</p>
<h2>View types proposal: borrow checker ergonomics, finally</h2>
<p>Niko Matsakis posted a concrete MVP proposal for view types — a way to annotate which struct fields a method accesses, like <code>&amp;mut self {statistics}</code>. The borrow checker would split a single loan into per-field loans, resolving the common case where calling a helper inside a loop conflicts with an existing borrow on a different field. No runtime cost, no inference required yet. The post argues this is implementable now and should ship as a lang experiment. If you’ve ever fought the borrow checker over self-referential method calls, this is the one to read.</p>
<h2>Sashiko: AI kernel review hits rust-for-linux</h2>
<p>Google’s Sashiko — a Rust tool that monitors kernel mailing lists and auto-reviews patches using Gemini Pro 3.1 — expanded coverage to the rust-for-linux list this week. In testing against 1,000 upstream kernel bugs all missed by human reviewers, it caught 53%. It’s positioned as a maintainer assistant, not a patch submitter, which has kept it considerably less controversial than AI contribution tools tend to be. Currently running without Rust-specific prompts; Miguel Ojeda and others are working on tailored prompts and potential Coccinelle-for-Rust integration.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Meilisearch memory leak post-mortem:</strong> Mixing allocators — LMDB on system malloc, Meilisearch on mimalloc v2 — caused pages to be allocated and freed without being reusable across the boundary; switching to unified jemalloc or mimalloc v3 resolved RSS growth, with mimalloc v3 yielding ~13% performance gains in benchmarks.</li>
<li><strong>Meilisearch LMDB patch for 3x vector insert speed:</strong> Patching LMDB to support nested read transactions on uncommitted writes replaced full database scans in their HNSW store with lazy per-node fetches via thread-local rayon readers, taking insert throughput from ~6/sec to ~20/sec.</li>
<li><strong>WASM-JS boundary overhead case study:</strong> A team rewrote their Rust/WASM DSL parser in TypeScript after discovering the bottleneck was boundary crossings, not computation — serde-wasm-bindgen made things 30% slower, while the TypeScript rewrite was 2.2-4.6x faster per call.</li>
<li><strong>dial9: flight recorder for Tokio:</strong> New runtime telemetry tool captures individual polls, parks, wakes, and Linux kernel events with under 5% overhead; helped identify kernel scheduling delays of 10ms+ and fd_table lock contention causing 100ms+ polls during startup on an AWS service.</li>
<li><strong>Grafeo graph database:</strong> Embeddable graph database with a pure Rust core claiming fastest LDBC Social Network Benchmark results; supports GQL, Cypher, Gremlin, SPARQL, HNSW vector search, ACID with MVCC, and WebAssembly bindings.</li>
<li><strong>Tansu: Kafka-compatible broker in Rust:</strong> Stateless, leaderless brokers using 20MB RAM with pluggable S3/SQLite/Postgres backends, ~10ms restart time, and direct writes to Iceberg/Delta Lake via sink topics; SSL, ACLs, and S3 compaction still incomplete.</li>
<li><strong>RE# regex engine:</strong> Two-pass bidirectional algorithm achieving true linear-time all-leftmost-longest matches, fixing the O(n²) degradation in RE2, Go’s regexp, and Rust’s regex crate when looping over a DFA; no capture groups yet.</li>
<li><strong>Monty Python interpreter in Rust:</strong> Samuel Colvin (Pydantic) built a sandboxed Python interpreter that cold-starts in 6µs, serializes interpreter state to a database for durable workflows, and deliberately omits classes and third-party packages; primary use case is LLM-generated code in agentic pipelines.</li>
<li><strong>SIMD CSV parser deep dive:</strong> Detailed walkthrough of vectorized character classification via dual nibble lookup tables on ARM NEON, bitmask compression, and prefix XOR via carryless multiplication to handle quoted fields — a clean applied SIMD tutorial.</li>
<li><strong>Oscilloscope to Wireshark in Rust:</strong> Oxide Computer engineer wrote a Rust tool to parse Tektronix .wfm files, recover clock, decode 8b/10b, demultiplex QSGMII streams, and write .pcap output; full pipeline runs in ~410ms.</li>
<li><strong>Rust challenges survey:</strong> Compilation times are the universal pain point across all experience levels; async complexity persists for experts due to ecosystem fragmentation and runtime lock-in; embedded no-std gaps and safety-critical certification remain domain-specific blockers.</li>
<li><strong>QCon London lifetime talk:</strong> TrueLayer’s Ethan Brierley reframed lifetimes as sets of loans rather than code regions, drawing from the experimental Polonius borrow checker model, and walked through variance and higher-ranked lifetimes via serde’s Deserialize.</li>
<li><strong>rust-analyzer v0.3.2828:</strong> Bug fixes for multi-byte UTF-8 identifiers in NameGenerator, duplicate associated type shorthand resolution, and a recursive file watcher fix.</li>
<li><strong>pgtui:</strong> Postgres TUI client in Rust built with ratatui and sqlx; supports browsing, filtering, inserting, editing, and multi-column primary key tables across multiple connections.</li>
<li><strong>RustSec governance dispute:</strong> Cryptographer Nadim Kobeissi alleges he was silently banned from RustSec after filing advisories on hpke-rs; Filippo Valsorda disputes the severity characterization; the conflict has escalated to the Rust Leadership Council and Foundation.</li>
</ul>


Rust language updates, async patterns, and systems programming.

Rust Digest

A Rust ecosystem roundup covering several notable developments: a CVE in Cargo's tar extraction allowing arbitrary directory permission changes (patched in Rust 1.94.1); noq, a hard fork of Quinn adding multipath QUIC and production NAT traversal for peer-to-peer networking; Niko Matsakis's concrete view types proposal to improve borrow checker ergonomics via per-field loans; and Google's Sashiko AI kernel review tool expanding to the rust-for-linux mailing list. Also covered: a Meilisearch memory leak postmortem involving mixed allocators, a WASM-JS boundary overhead case study, a new Tokio flight recorder tool, a Kafka-compatible broker in Rust, a sandboxed Python interpreter by the Pydantic author, a RustSec governance dispute, and more.

Cargo tar vulnerability lands, noq forks Quinn for multipath QUIC