The Wire · Showcase
CARGO PATCHES LIBGIT2 VULNERABILITIES, NIGHTLY BUILD LAYOUT SHIPS
By RepoJournal · Filed · About Rust
Cargo bumped libgit2-sys to pull in v1.9.6 vulnerability fixes [ref:10], while nightly users get the new build-dir layout v2 by default [ref:12].
The libgit2 security patches [1] land at a critical time for anyone using Cargo's git operations, addressing multiple upstream issues that could impact supply chain tooling. On the compiler side, a rollup of 14 PRs [4] merged improvements across bootstrap metadata handling, trait solver universes, and rustfmt module discovery. Separately, the distcheck job now uses dylib builds instead of static ones, "reducing disk usage, and thus avoiding the distcheck job running out of disk space" [3], a pragmatic fix for CI infrastructure strain. Cargo's nightly branch [2] enables the new build-dir layout v2 by default, making it the path forward for the majority of Rust users as it stabilizes. On the registry side, five new crate publications and updates rolled through crates.io-index [5][6][7][8][9], while annotate-snippets-rs bumped Prek to v0.4.11 [10].
One email a day. Unsubscribe in one click.
Keep up with Rust in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Update to cargo with [email protected]+1.9.6 at next release cycle rust-lang/cargo [plan]
- → Test nightly projects with build-dir layout v2 enabled; report incompatibilities rust-lang/cargo [monitor]
- → Remove any cargo-prefetch plugin dependencies from your CI rust-lang/cargo [plan]
References
- [1] chore: bump to `[email protected]+1.9.6` (#17259) rust-lang/cargo
- [2] Enable build-dir layout v2 on nightly by default (#17258) rust-lang/cargo
- [3] Auto merge of #159847 - nikic:distcheck-shared, r=Kobzol rust-lang/rust
- [4] Rollup of 14 pull requests ↗ rust-lang/rust
- [5] Create crate `human_mortality_database` rust-lang/crates.io-index
- [6] Update crate `timeglyph` rust-lang/crates.io-index
- [7] Update crate `systemproxy` rust-lang/crates.io-index
- [8] Update crate `ddss-sys` rust-lang/crates.io-index
- [9] Create crate `port-authority` rust-lang/crates.io-index
- [10] chore(deps): Update Prek to v0.4.11 ↗ rust-lang/annotate-snippets-rs