Rust Programming News | Prism Hobbies

Cargo Workspaces Best Practices for Scaling Rust Projects Confidently

Poorly managed Cargo workspaces silently cause version drift, rebuild bloat, and CI chaos; here's the exact layout and config to fix that before it scales against you.

Sam Ortega•6 min read•03:15 PM

Read Full Article →

More News

Updates

Malicious cargo-env-parser Crate Targets Rust Developers Across All Major Platforms

Malware researcher R136a1 found TeamPCP's fingerprints inside cargo-env-parser v1.0.19, a crate used to parse environment variables, with cross-platform malware dropping on all three major OSes.

Jamie Taylor2m read

Releases

Tokio Team Launches Toasty, an Async ORM Built for Rust Productivity

Carl Lerche spent two-plus years building Toasty; the Tokio team's async ORM hit crates.io with SQL and DynamoDB support baked in.

Nina Kowalski3m read

Analysis

Rust Concurrency Best Practices: Never Await While Holding a Mutex

Rust's compiler won't catch async mutex deadlocks. A former Cloudflare engineer's battle-tested checklist shows what to fix before they find you in production.

Nina Kowalski6m read

Updates

docs.rs Switches to Single Default Build Target on May 1 to Cut Costs

docs.rs is dropping its five-target default on May 1, building only for x86_64-unknown-linux-gnu unless crate authors explicitly opt in via Cargo.toml.

Sam Ortega2m read

Analysis

Cache-line contention makes RwLock five times slower than Mutex

Redstone's author found that on commercial hardware an RwLock made a read-heavy Tensor Cache about 5× slower than a Mutex due to cache-line ping-pong and atomic contention.

Sam Ortega3m read

Updates

Salvo list_html XSS vulnerabilities CVE-2026-22256 and CVE-2026-22257 fixed in 0.88.1

Salvo patched reflected XSS in its directory listing (list_html); CVE-2026-22256 and an Isomer-listed CVE-2026-22257 are fixed in salvo 0.88.1 - update recommended.

Jamie Taylor2m read

Analysis

GreptimeDB Achieves PostgreSQL Compatibility Using Rust, pgwire, and DataFusion

GreptimeDB's engineers detailed how pgwire, a Rust library its own team authored, lets psql, JDBC, and libpq clients connect to a non-Postgres database with zero C extensions.

Sam Ortega3m read

News

Rust Developer argues GC Addition Would Undermine Lifetimes and Memory Safety

A community debate over adding GC to Rust intensified after a 2025 OOPSLA paper proposed "Alloy," with skeptics arguing GC would hollow out the very lifetimes that make Rust's safety guarantees meaningful.

Nina Kowalski3m read

Releases

Rust 1.94.0 stable released, stabilizes language features and Cargo tooling

Rust 1.94.0 stabilizes <[T]>::array_windows to yield fixed-size `&[T; N]`, adds Cargo include in .cargo/config.toml, and upgrades Cargo to parse TOML 1.1.

Nina Kowalski3m read

News

RustSec, crates.io remove typosquatting tracings, tracing_checks stealing API keys, installing backdoors

Two typosquat crates, tracings and tracing_checks, stole Polymarket API keys and dropped a Linux backdoor and a hidden Windows executable; crates.io and RustSec removed them under advisories RUSTSEC-2026-0027 and RUSTSEC-2026-0028.

Sam Ortega3m read

Analysis

Yoshua Wuyts outlines effects, substructural and refinement types for Rust

Yoshua Wuyts published a long essay on March 5, 2026, arguing Rust should invest in richer effect types, substructural rules like `!Forget`/`!Move`, and refinement types to extend safety and ergonomics.

Nina Kowalski3m read

Updates

Ladybird Browser Adopts Rust to Replace C++ with AI Help

Ladybird's 2026-02-23 post says the project will adopt Rust as C++'s successor, and Andreas Kling used Claude Code and Codex to produce about 25,000 lines of Rust for LibJS.

Jamie Taylor3m read

Updates

Misspecified asm! operand types in opt-in ARMv8 backend caused unsoundness

keccak disclosed a low-severity unsoundness today in its opt-in ARMv8 assembly backend after an asm! block misspecified operand types for operands used as pointers and then mutated.

Jamie Taylor2m read

Updates

Canonical Joins Rust Foundation as Gold Member, Pledging $150K Annually

Ubuntu publisher Canonical committed $150K/year to the Rust Foundation as a Gold Member, with crates.io security and dependency minimization squarely in its sights.

Nina Kowalski3m read

Analysis

Rust's Ownership Model Makes Safe Concurrent Programming Practical and Reliable

Rust's borrow checker turns concurrency from a source of dread into a compile-time guarantee, preventing entire classes of race conditions before your code ever runs.

Nina Kowalski7m read

News

Developers Race to Build Rust Ports After Claude Code Source Leak

A 59.8 MB source map accidentally shipped in Claude Code's npm package exposed 512,000 lines of TypeScript; Rust ports hit 50k GitHub stars within hours of publication.

Jamie Taylor3m read

News

OpenClaw CVE Wave Sparks Demand for Rust-Based Agent Runtime Alternatives

Tens of thousands of exposed OpenClaw instances and a high-severity privilege escalation CVE are pushing infrastructure teams toward Rust-first agent runtimes with WASM sandboxing.

Jamie Taylor2m read

Releases

Microsoft Open-Sources Seven Rust Training Books for All Skill Levels

Microsoft open-sourced 3.1k-starred RustTraining on GitHub: seven internal books spanning bridge-level C/C++ migration to expert type-driven correctness proofs.

Jamie Taylor3m read

Releases

Oxichrome Lets Rust Developers Build Browser Extensions Without JavaScript

Oxichrome hit 100 GitHub stars in 2 days — a Rust framework that compiles browser extensions to WebAssembly with zero hand-written JavaScript and just four macros.

Nina Kowalski3m read

Releases

Tokio Introduces Dial9 Flight Recorder to Debug Async Runtime Latency

Russell Cohen's dial9 caught 10ms+ kernel scheduling delays on a live AWS service that no staging environment could replicate.

Sam Ortega2m read

Updates

Critical DoS Flaw in libp2p-rust Gossipsub Triggers Panics Before Version 0.49.3

CVE-2026-33040 lets unauthenticated attackers crash any libp2p-rust Gossipsub node by sending a single PRUNE message with a u64::MAX backoff value.

Sam Ortega2m read

Updates

Meta Ports React Compiler to Rust, Signaling Shift in JS Tooling

Meta's React team ported the React Compiler to Rust with AI assistance, joining a wave of JS tooling rewrites betting on Rust's performance gains.

Sam Ortega2m read

Updates

Ubuntu VP Pushes Rust-First Rewrites, Accepting Breakage for Safety Gains

Canonical's Ubuntu VP is pushing Rust-first rewrites across the stack, openly accepting breakage as a worthwhile trade-off for safety gains over Python.

Jamie Taylor2m read

News

Five Malicious Rust Crates Disguised as Time Utilities Stole Developer Secrets

Five Rust crates posing as time utilities silently harvested .env secrets, posting them to a lookalike domain that mimicked a trusted time API service.

Nina Kowalski3m read

Releases

JetBrains RustRover 2026.1 Adds Rust-Aware Call Hierarchy for Large Codebases

RustRover 2026.1 resolves trait-object indirection in its new Call Hierarchy view, giving Rust developers a real call tree instead of dispatch noise.

Sam Ortega2m read

Releases

Rust 1.94.1 Patch Release Brings Stability and Security Improvements

Two CVEs patched and three regressions squashed: Rust 1.94.1 fixes a security hole in Cargo's tar handling just three weeks after the 1.94.0 feature release.

Nina Kowalski1m read

Analysis

Rust App Optimization Uses Napkin Math to Crush Lock Contention and Memory Pressure

Napkin math plus data-oriented redesign is how engineers at PlanetScale and ex-Cloudflare are actually killing lock contention in production Rust apps.

Sam Ortega5m read

Analysis

Mastering Rust Ownership and Borrowing, Core Concepts for Systems Developers

Rust's ownership model eliminates entire classes of memory bugs at compile time — here's how to actually internalize it and stop fighting the borrow checker.

Sam Ortega6m read

Analysis

Practical Strategies to Speed Up Rust Builds Locally and in CI

Slow Rust builds drain CI budgets and developer patience; these actionable strategies tackle both with cargo-native tools and workspace-level thinking.

Nina Kowalski6m read