$ cat rust-lang/week/2026-10-26.log
the week in review · Oct 26 – Nov 1, 2026
crates.io rejects NUL bytes in publish metadata
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Three rust-lang/rust rollups landed during the week, and rustup patched a toolchain proxy bug that redirected to itself.
publish: Reject NUL characters in crate metadata rust-lang/crates.io
Postgres rejects NUL characters in text columns, so a README or free-form Cargo.toml field containing one returned a 500 from the publish endpoint instead of an error. A crate that hit this surfaced it via a literal 'AMQP\x00\x00\t\x01' byte string in its README; the endpoint now rejects the payload up front.
fix(toolchain): don't fall back to external RA redirecting to rustup rust-lang/rustup
rustup's fallback that looked for rust-analyzer outside the toolchain could pick up an executable that was itself a rustup proxy, sending the call back where it started. The fix stops that loop, which matters if your RA is installed via a non-rustup path.
perf(windows): delay-load system DLLs the proxies don't use rust-lang/rustup
user32, shell32, ole32, oleaut32, crypt32, secur32 and ws2_32 move onto the delay-load list for rustup-init, so proxied cargo and rustc calls no longer map them plus their dependencies at startup. They still load from System32 on first use.
Rollup merge of #164303 - fallible-algebra:at-removal/remove-sub, r=lcnr rust-lang/rust
The 'sub' method is gone from 'At', with callers migrated to 'sub_raw', continuing the earlier at-removal work. This is unstable internal API surface, so it only shifts code that touches the compiler's fallible-algebra internals.
Rollup of 21 pull requests rust-lang/rust
Twenty-one merges landed, including a rejection of cfg on expressions that cannot be safely removed and a raise of ambiguity errors. The cfg change tightens what the compiler accepts on expressions, so expect new errors on attributes you may have been leaning on.
Rollup of 20 pull requests rust-lang/rust
A 20-PR rollup carried fd-views coverage for BorrowedFd (AsRef<File> and friends) and rustdoc fixes for reexport handling. Also included were a set of reborrow ICE fixes, the kind that show up as a compiler crash rather than a diagnostic.
adjust how we handle c-style arrays rust-lang/miri
Miri gained a projection helper so C-style arrays are dereferenced first and then indexed, replacing deref_pointer_and_read and deref_pointer_and_write with other helpers. The result is fewer bespoke paths in the interpreter, which is where Miri's array handling has been leaned on hardest.
Rename splat attribute to rustc_splat rust-lang/rustc-demangle
The splat attribute becomes rustc_splat to avoid a name resolution clash, with new tests for comma placement and splat coverage under legacy mangling. Anyone parsing demangled symbols against the old name needs the rename; the legacy path needed no code changes.
$ ls rust-lang/week/ # the briefings behind this review
Keep up with Rust in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.