Ferrocene 24.11.0 (upcoming)¶
Caution
This version of Ferrocene has not been released yet. The contents of this page might change before the release, and they should not be relied upon.
Ferrocene 24.11.0 is the fourth major release of Ferrocene.
The highlights of this release are the inclusion of Rust 1.81.0, medical qualification,
qualification of the rustfmt
code formatter, and qualification of the
Armv8-A QNX 7.1.0 and
x86-64 QNX 7.1.0 targets.
New features¶
Ferrocene is now supported and qualified for use in medical devices (IEC 62304).
The
rustfmt
code formatter is now supported and qualified for safety critical use.Two new targets are now supported and qualified for safety critical use.
Armv8-A QNX 7.1.0 (
aarch64-unknown-nto-qnx710
)x86-64 QNX 7.1.0 (
x86_64-pc-nto-qnx710
)
New experimental features¶
Experimental features are not qualified for safety critical use, and are shipped as a preview.
Experimental support has been added for a new host platform. Note that experimental targets are not qualified for safety critical use. The new target is:
Armv8-A Linux (glibc) (
aarch64-unknown-linux-gnu
)
Rust changes¶
This release includes the following changes introduced by the upstream Rust project. Note that this changelog is maintained by upstream. The target support changes described here describe Rust’s support levels, and have no correlation to the targets and platforms supported by Ferrocene.
Rust 1.79.0¶
Language¶
Prevent opaque types being instantiated twice with different regions within the same function.
Stabilize WebAssembly target features that are in phase 4 and 5.
Add the
redundant_lifetimes
lint to detect lifetimes which are semantically redundant.Stabilize the
unnameable_types
lint for public types that can’t be named.Enable debuginfo in macros, and stabilize
-C collapse-macro-debuginfo
and#[collapse_debuginfo]
.Propagate temporary lifetime extension into
if
andmatch
expressions.Warn against refining impls of crate-private traits with
refining_impl_trait
lint.
Compiler¶
Define
-C strip
to only affect binaries, not artifacts like.pdb
.Stabilize
-Crelro-level
for controlling runtime link hardening.Stabilize checking of
cfg
names and values at compile-time with--check-cfg
. Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.Add
aarch64-apple-visionos
andaarch64-apple-visionos-sim
tier 3 targets.Promote several Windows targets to tier 2:
aarch64-pc-windows-gnullvm
,i686-pc-windows-gnullvm
, andx86_64-pc-windows-gnullvm
.
Refer to Rust’s platform support page for more information on Rust’s tiered platform support.
Libraries¶
Stabilized APIs¶
These APIs are now stable in const contexts:
Cargo¶
Rustdoc¶
Misc¶
Compatibility Notes¶
The
wasm_c_abi
future-incompatibility lint will warn about use of the non-spec-compliant C ABI. Usewasm-bindgen v0.2.88
to generate forward-compatible bindings.
Rust 1.80.0¶
Language¶
Compiler¶
Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets
Add a lint against never type fallback affecting unsafe code
Expand
for_loops_over_fallibles
lint to lint on fallibles behind references.self-contained linker: retry linking without
-fuse-ld=lld
on CCs that don’t support itFor the wasm32-wasip2 target default to PIC and do not use
-fuse-ld=lld
Lint on
foo.into_iter()
resolving to&Box<[T]>: IntoIterator
Libraries¶
Stabilized APIs¶
These APIs are now stable in const contexts:
Cargo¶
Rustdoc¶
Compatibility Notes¶
rustfmt estimates line lengths differently when using non-ascii characters
Warn (or error) when
Self
constructor from outer item is referenced in inner nested itemTurn
indirect_structural_match
andpointer_structural_match
lints into hard errorsMake
where_clause_object_safety
lint a regular object safety violationstd::sync::ReentrantLockGuard<T>
is no longerSync
ifT: !Sync
which meansstd::io::StdoutLock
andstd::io::StderrLock
are no longer SyncType inference will fail in some cases due to new implementations of
FromIterator for Box<str>
. Notably, this breaks versions of thetime
crate before 0.3.35, due to no longer inferring the implementation forBox<[_]>
.
Internal Changes¶
These changes do not affect any public interfaces of Rust, but they represent significant improvements to the performance or internals of rustc and related tools.
Rust 1.80.1¶
Rust 1.81.0¶
Language¶
Stabilize
#[expect]
for lints (RFC 2383), like#[allow]
with a warning if the lint is not fulfilled.Change method resolution to constrain hidden types instead of rejecting method candidates.
offset_from
: always allow pointers to point to the same address.Allow constraining opaque types during subtyping in the trait system.
Allow constraining opaque types during various unsizing casts.
Compiler¶
Check alias args for well-formedness even if they have escaping bound vars.
Ensure the interpreter checks bool/char for validity when they are used in a cast.
Improve coverage instrumentation for functions containing nested items.
Target changes:
Add Tier 3
no_std
Xtensa targets:xtensa-esp32-none-elf
,xtensa-esp32s2-none-elf
,xtensa-esp32s3-none-elf
Add Tier 3
std
Xtensa targets:xtensa-esp32-espidf
,xtensa-esp32s2-espidf
,xtensa-esp32s3-espidf
Add Tier 3 i686 Redox OS target:
i686-unknown-redox
Promote
loongarch64-unknown-linux-musl
to Tier 2 with host tools.Unconditionally warn on usage of
wasm32-wasi
. (see compatibility note below)Refer to Rust’s platform support page for more information on Rust’s tiered platform support.
Libraries¶
Split core’s
PanicInfo
and std’sPanicInfo
. (see compatibility note below)Replace sort implementations with stable
driftsort
and unstableipnsort
. Allslice::sort*
andslice::select_nth*
methods are expected to see significant performance improvements. See the research project for more details.Document behavior of
create_dir_all
with respect to empty paths.Fix interleaved output in the default panic hook when multiple threads panic simultaneously.
Stabilized APIs¶
These APIs are now stable in const contexts:
char::from_u32_unchecked
(function)char::from_u32_unchecked
(method)
Cargo¶
Compatibility Notes¶
Usage of the
wasm32-wasi
target will now issue a compiler warning and request users switch to thewasm32-wasip1
target instead. Both targets are the same,wasm32-wasi
is only being renamed, and this change to the WASI target is being done to enable removingwasm32-wasi
in January 2025.We have renamed
std::panic::PanicInfo
tostd::panic::PanicHookInfo
. The old name will continue to work as an alias, but will result in a deprecation warning starting in Rust 1.82.0.core::panic::PanicInfo
will remain unchanged, however, as this is now a different type.The reason is that these types have different roles:
std::panic::PanicHookInfo
is the argument to the panic hook in std context (where panics can have an arbitrary payload), whilecore::panic::PanicInfo
is the argument to the#[panic_handler]
in no_std context (where panics always carry a formatted message). Separating these types allows us to add more useful methods to these types, such asstd::panic::PanicHookInfo::payload_as_str()
andcore::panic::PanicInfo::message()
.The new sort implementations may panic if a type’s implementation of
Ord
(or the given comparison function) does not implement a total order as the trait requires.Ord
’s supertraits (PartialOrd
,Eq
, andPartialEq
) must also be consistent. The previous implementations would not “notice” any problem, but the new implementations have a good chance of detecting inconsistencies, throwing a panic rather than returning knowingly unsorted data.
Internal Changes¶
These changes do not affect any public interfaces of Rust, but they represent significant improvements to the performance or internals of rustc and related tools.