<p><strong>TLDR:</strong> Google landed a Rust DNS parser in the Pixel 10 modem firmware — the first memory-safe code in a Pixel baseband. Redox OS went the other direction on AI, banning all LLM-generated contributions outright. RustConf 2026 registration opened with a Montreal date and an expanded schedule. The supply chain conversation got louder this week, with two separate posts digging into <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a> risks and what developers can actually do about it.</p>
<hr>
<h2>Google puts Rust in the Pixel 10 baseband</h2>
<p>Google’s Pixel team integrated the hickory-proto crate as a memory-safe DNS parser in the Pixel 10 modem firmware, replacing unsafe C code that had a known CVE (CVE-2024-27227). Getting there required adding no_std support to the crate, wiring up a custom allocator and panic handler via FFI, and resolving weak symbol conflicts from compiler_builtins in the Pigweed/GN build system. It’s a narrow foothold, but the post frames it explicitly as groundwork for broader Rust adoption in modem firmware — which is one of the harder environments to get memory-safe code into.</p>
<h2>Redox OS bans AI-generated contributions</h2>
<p>Redox OS published a hard policy: any PR identified as LLM-generated gets closed immediately and the contributor banned. No exceptions, no discussion. They join Fedora, Gentoo, the Rust project itself, and LLVM in taking this stance. The March 2026 progress report alongside the policy announcement covers real work: the COSMIC desktop running on Redox, a new Deficit Weighted Round Robin scheduler, improved Intel GPU memory mapping, and LZMA2 package compression yielding 3-5x smaller package sizes.</p>
<h2>Supply chain risk: two takes, same week</h2>
<p>Two posts landed this week on Rust supply chain security, and they’re worth reading together. One focuses on attack vectors — compromised credentials, typosquatting, malicious proc macros that execute at editor open time, and backdoored <a href="http://build.rs" target="_blank" rel="noopener nofollow">build.rs</a> files. The headline number: 17% of the 999 most popular crates contain code that doesn’t match their source repositories. The other post pushes back on the idea that <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a> owes users security guarantees, arguing the Rust Foundation runs largely on volunteer labor and the responsibility for auditing sits with the people pulling in dependencies. Both recommend the same practical tools: lockfiles, cargo-vet, cargo-audit, and actually reading source before you ship it.</p>
<h2>RustConf 2026 opens registration</h2>
<p>RustConf 2026 is September 8-11 in Montreal, with an online option. The schedule adds a Community Lightning Talks track and Project Updates sessions. Jon Seager is keynoting on Rust adoption in Ubuntu, including Rust-based rewrites of coreutils and sudo. The closing session pairs Rust Foundation CEO Rebecca Rumbul with Python Software Foundation ED Deb Nicholson on open source governance and cross-ecosystem interoperability — which is either a sign of how mainstream Rust has gotten or a very long panel setup.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Rust Coreutils 0.8</strong> ships a ~45% speedup for dd, faster startup across utilities, expanded WASI support with an online playground, and now passes 94.74% of the GNU test suite.</li>
<li><strong>Surelock crate</strong> provides compile-time deadlock freedom using LockSet for same-level atomic acquisition and Level&lt;N&gt;/LockAfter trait bounds for strictly ascending cross-level ordering — no_std compatible, works on targets without native CAS.</li>
<li><strong>Miracle-WM 0.9</strong> adds a WebAssembly plugin system and a Rust API for plugin development to the Mir-based Wayland compositor, plus configuration hot-reload and cursor theme support.</li>
<li><strong>Rust Foundation Interop Initiative</strong> has moved from research to implementation, engaging a contractor to advance Rust/C++ interoperability tooling after concluding that waiting for memory-safe C++ standardization (potentially 2029+) isn’t practical.</li>
<li><strong>WebAssembly breaking change</strong> lands in Rust 1.96 (2026-05-28): the --allow-undefined flag to wasm-ld is being removed, aligning WASM behavior with native targets where undefined symbols are linker errors.</li>
<li><strong>Rust for CPython</strong> build system now compiles CPython with Rust across all CI platforms; target shifted from Python 3.15 to 3.16, with PEP submission planned for July.</li>
<li><strong>Little Snitch for Linux</strong> released, written in Rust with eBPF for traffic interception; requires kernel 6.12+ with BTF support (Ubuntu 25.04+), packages available for x86-64, ARM64, and RISCV64.</li>
<li><strong>Rastair</strong> (bioinformatics variant/methylation caller) post covers practical Rust performance work: Rayon with ordered channels, SmallVec, SmolStr, mimalloc, and a fork of rust-htslib to eliminate unnecessary CString allocations.</li>
<li><strong>tree-sitter-language-pack</strong> bundles 305+ parsers with native bindings for Rust, Python, Node.js, Go, Java, and WASM, exposing a unified process() API for structured code intelligence extraction.</li>
<li><strong>rust-analyzer 0.3.2854</strong> ships a universal VSIX for platforms without pre-built binaries, macro expansion in #[doc] attributes, type hints at end of line, and 20+ bug fixes.</li>
<li><strong>Appwrite Rust SDK</strong> is now on <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a>, providing async, type-safe access to Appwrite server APIs using Tokio.</li>
<li><strong>Waveshare ESP32-S3 smartwatch firmware</strong> rewritten in no_std Rust, cutting binary size from 1.2 MB to 579 kB and replacing polling with a fully event-driven architecture.</li>
</ul>


Rust language updates, async patterns, and systems programming.

Rust Digest

A Rust-focused weekly roundup covering Google's integration of a Rust DNS parser (hickory-proto) into Pixel 10 modem firmware as the first memory-safe code in a Pixel baseband, replacing a C component with a known CVE. Redox OS announced a hard ban on LLM-generated contributions. Two supply chain security posts highlight crates.io risks including compromised credentials, malicious proc macros, and the finding that 17% of top crates don't match their source repos. RustConf 2026 is set for Montreal in September. Also covered: Rust Coreutils 0.8 with 45% dd speedup, a compile-time deadlock-freedom crate, Rust/C++ interop initiative moving to implementation, a WebAssembly breaking change in Rust 1.96, and a dozen other ecosystem updates.

Google ships Rust into Pixel baseband, Redox bans LLM contributions