Ferrocene 26.05.0 (upcoming)¶
Caution
This version of Ferrocene has not been released yet. The contents of this page might change before the release, and they should not be relied upon.
New features¶
New targets are now supported and qualified for safety critical use. The new targets are:
Armv8-A RHIVOS 2 (Linux, glibc) (
aarch64-rhivos2-linux-gnu)Note: Only when compiled by a Armv8-A Linux (glibc) (
aarch64-unknown-linux-gnu) host
Armv8-A Linux (glibc) (
aarch64-unknown-linux-gnu)Note: Only when compiling a Armv8-A RHIVOS 2 (Linux, glibc) (
aarch64-rhivos2-linux-gnu) target
The
proc_macrocrate type is now permitted.Two qualified targets which offered target CPU features have been removed, as the base targets now permit the use of
-C target-cpuin the same capacity. For more information, see the respective base target pages in the User Manual.Armv7E-M bare-metal (hard-float) (
thumbv7em-none-eabihf) can be used with-C target-cpu=cortex-m4in place of Armv7E-M bare-metal (Cortex-M4, hard-float) (thumbv7em-m4-none-eabihf)Armv8-A bare-metal (hard-float) (
aarch64-unknown-none) can be used with-C target-cpu=cortex-a53in place of Armv8-A bare-metal (Cortex-A53) (aarch64-a53-none)
The
core::fmtmodule has been certified to ISO 26262 (ASIL B) and IEC 61508 (SIL 2)This module contains the code to format Rust data structures into human-readable output. This enables customers to use this functionality in certified contexts.
Retired “certified panic runtime” compilation targets. They were used to certify panicking without certifying the formatting code, but are now obsolete. Following targets are now retired:
aarch64-ferrocene-nonecan be replaced withaarch64-unknown-nonethumbv7em-ferrocene-none-eabican be replaced withthumbv7em-none-eabithumbv7em-ferrocene-none-eabihfcan be replaced withthumbv7em-none-eabihfx86_64-ferrocene-nonecan be replaced withx86_64-unknown-none
Added a
ferrocene::unvalidatedlint which detects whether your code uses functions that are not in the certified subset of the standard library.For information on how to use this lint, see Certified subset.
For more background on why this change is being made, see Callgraph Analysis.
Retired “certified subset” compilation targets. They were used to detect use of uncertified functionality, but are now obsolete. The following targets are being retired:
aarch64-unknown-ferrocene.subsetthumbv7em-ferrocene.subset-eabithumbv7em-ferrocene.subset-eabihfx86_64-unknown-ferrocene.subset
New Supported targets have been added. Supported targets can often be qualified or quality managed upon request. The new targets are:
Armv8-R AArch64 bare-metal (hard-float) (
aarch64v8r-unknown-none)s390x Linux (glibc) (
s390x-unknown-linux-gnu)PowerPC64 Linux (glibc, little-endian) (
powerpc64le-unknown-linux-gnu)
New experimental features¶
Experimental features are not qualified for safety critical use, and are shipped as a preview.
Experimental support has been added for a new target. Note that experimental targets are not qualified for safety critical use. The new target is:
Armv8-R AArch64 bare-metal (soft-float) (
aarch64v8r-unknown-none-softfloat)
Rust changes¶
This release includes the following changes introduced by the upstream Rust project. Note that this changelog is maintained by upstream. The target support changes described here describe Rust’s support levels, and have no correlation to the targets and platforms supported by Ferrocene.
Rust 1.92.0¶
Language¶
Prefer item bounds of associated types over where-bounds for auto-traits and
SizedAllow specifying multiple bounds for same associated item, except in trait objects
Slightly strengthen higher-ranked region handling in coherence
The
unused_must_uselint no longer warns onResult<(), Uninhabited>(for instance,Result<(), !>), orControlFlow<Uninhabited, ()>. This avoids having to check for an error that can never happen.
Compiler¶
Remove current code for embedding command-line args in PDB Command-line information is typically not needed by debugging tools, and the removed code was causing problems for incremental builds even on targets that don’t use PDB debuginfo.
Libraries¶
iter::Repeat::lastandcountwill now panic, rather than looping infinitely.
Stabilized APIs¶
These previously stable APIs are now stable in const contexts:
Cargo¶
Added a new chapter to the Cargo book, “Optimizing Build Performance”.
Rustdoc¶
If a trait item appears in rustdoc search, hide the corresponding impl items. Previously a search for “last” would show both
Iterator::lastas well as impl methods likestd::vec::IntoIter::last. Now these impl methods will be hidden, freeing up space for inherent methods likeBTreeSet::last.Relax rules for identifiers in search. Previously you could only search for identifiers that were valid in rust code, now searches only need to be valid as part of an identifier. For example, you can now perform a search that starts with a digit.
Compatibility Notes¶
Fix backtraces with
-C panic=aborton Linux by generating unwind tables by default. Build with-C force-unwind-tables=noto keep omitting unwind tables.
As part of the larger effort refactoring compiler built-in attributes and their diagnostics, the future-compatibility lint
invalid_macro_export_argumentsis upgraded to deny-by-default and will be reported in dependencies too.
Rust 1.93.0¶
Language¶
Stabilize several s390x
vector-related target features and theis_s390x_feature_detected!macroStabilize declaration of C-style variadic functions for the
systemABIDuring const-evaluation, support copying pointers byte-by-byte
LUB coercions now correctly handle function item types, and functions with differing safeties
Compiler¶
Stabilize
-Cjump-tables=bool. The flag was previously called-Zno-jump-tables.
Platform Support¶
Refer to Rust’s platform support page for more information on Rust’s tiered platform support.
Libraries¶
Stabilized APIs¶
Cargo¶
Rustdoc¶
Include attribute and derive macros in search filters for “macros”
Validate usage of crate-level doc attributes. This means if any of
html_favicon_url,html_logo_url,html_playground_url,issue_tracker_base_url, orhtml_no_sourceeither has a missing value, an unexpected value, or a value of the wrong type, rustdoc will emit the deny-by-default lintrustdoc::invalid_doc_attributes.
Compatibility Notes¶
On Emscripten, the unwinding ABI used when compiling with
panic=unwindwas changed from the JS exception handling ABI to the wasm exception handling ABI. If linking C/C++ object files with Rust objects,-fwasm-exceptionsmust be passed to the linker now. On nightly Rust, it is possible to get the old behavior with-Zwasm-emscripten-eh=false -Zbuild-std, but it will be removed in a future release.The
#[test]attribute, used to define tests, was previously ignored in various places where it had no meaning (e.g on trait methods or types). Putting the#[test]attribute in these places is no longer ignored, and will now result in an error; this may also result in errors when generating rustdoc. Error whentestattribute is applied to structsCargo now sets the
CARGO_CFG_DEBUG_ASSERTIONSenvironment variable in more situations. This will cause crates depending onstatic-initversions 1.0.1 to 1.0.3 to fail compilation with “failed to resolve: use of unresolved module or unlinked crateparking_lot”. See the linked issue for details.User written types in the
offset_of!macro are now checked to be well formed.cargo publishno longer emits.cratefiles as a final artifact for user access when thebuild.build-dirconfig is unsetUpgrade the
deref_nullptrlint from warn-by-default to deny-by-defaultIntroduce future-compatibility warning against ignoring
repr(C)types as part ofrepr(transparent)
Rust 1.93.1¶
Don’t try to recover keyword as non-keyword identifier, fixing an ICE that especially affected rustfmt.
Fix
clippy::panicking_unwrapfalse-positive on field access with implicit deref.Revert “Update wasm-related dependencies in CI”, fixing file descriptor leaks on the
wasm32-wasip2target.
Rust 1.94.0¶
Language¶
Platform Support¶
Refer to Rust’s platform support page for more information on Rust’s tiered platform support.
Libraries¶
Stabilized APIs¶
x86
avx512fp16intrinsics (excluding those that depend directly on the unstablef16type)AArch64 NEON fp16 intrinsics (excluding those that depend directly on the unstable
f16type)
These previously stable APIs are now stable in const contexts:
Cargo¶
Stabilize the config include key. The top-level include config key allows loading additional config files, enabling better organization, sharing, and management of Cargo configurations across projects and environments. docs #16284
Stabilize the pubtime field in registry index. This records when a crate version was published and enables time-based dependency resolution in the future. Note that crates.io will gradually backfill existing packages when a new version is published. Not all crates have pubtime yet. #16369 #16372
Cargo now parses TOML v1.1 for manifests and configuration files. Note that using these features in Cargo.toml will raise your development MSRV, but the published manifest remains compatible with older parsers. #16415
Compatibility Notes¶
Make closure capturing have consistent and correct behaviour around patterns Some finer details of how precise closure captures get affected by pattern matching have been changed. In some cases, this can cause a non-move closure that was previously capturing an entire variable by move, to now capture only part of that variable by move, and other parts by borrow. This can cause the borrow checker to complain where it previously didn’t, or cause
Dropto run at a different point in time.Standard library macros are now imported via prelude, not via injected
#[macro_use]This will raise an error if macros of the same name are glob imported. For example if a crate defines their ownmatchesmacro and then glob imports that, it’s now ambiguous whether the custom or standard librarymatchesis meant and an explicit import of the name is required to resolve the ambiguity. One exception iscore::panicandstd::panic, if their import is ambiguous a new warning (ambiguous_panic_imports) is raised. This may raise a new warning (ambiguous_panic_imports) on#![no_std]code glob importing the std crate. Bothcore::panic!andstd::panic!are then in scope and which is used is ambiguous.Don’t strip shebang in expression-context
include!(…)s This can cause previously working includes to no longer compile if they included files which started with a shebang.Ambiguous glob reexports are now also visible cross-crate This unifies behavior between local and cross-crate errors on these exports, which may introduce new ambiguity errors.
Don’t normalize where-clauses before checking well-formedness
Introduce a future compatibility warning on codegen attributes on body-free trait methods These attributes currently have no effect in this position.
Overhaul filename handling for cross-compiler consistency Any paths emitted by compiler now always respect the relative-ness of the paths and
--remap-path-prefixgiven originally. One side-effect of this change is that paths emitted for local crates in Cargo (path dependencies and workspace members) are no longer absolute but relative when emitted as part of a diagnostic in a downstream crate.
Internal Changes¶
These changes do not affect any public interfaces of Rust, but they represent significant improvements to the performance or internals of rustc and related tools.
Switch to
annotate-snippetsfor error emission This should preserve mostly the same outputs in rustc error messages.
Rust 1.94.1¶
Remove new methods added to
std::os::windows::fs::OpenOptionsExtThe new methods were unstable, but the trait itself is not sealed and so cannot be extended with non-default methods.Cargo: update tar to 0.4.45 This resolves CVE-2026-33055 and CVE-2026-33056. Users of crates.io are not affected. See blog for more details.
Rust 1.95.0¶
Language¶
const-eval: be more consistent in the behavior of padding during typed copies
Const blocks are no longer evaluated to determine if expressions involving fallible operations can implicitly be constant-promoted.. Expressions whose ability to implicitly be promoted would depend on the result of a const block are no longer implicitly promoted.
Make operational semantics of pattern matching independent of crate and module
Compiler¶
Platform Support¶
Refer to Rust’s platform support page for more information on Rust’s tiered platform support.
Libraries¶
Stabilized APIs¶
These previously stable APIs are now stable in const contexts:
Rustdoc¶
Compatibility Notes¶
Array coercions may now result in less inference constraints than before
Importing
$cratewithout renaming, i.e.use $crate::{self};, is now no longer permitted due to stricter error checking forselfimports.const-eval: be more consistent in the behavior of padding during typed copies. In very rare cases, this may cause compilation errors due to bytes from parts of a pointer ending up in the padding bytes of a
constorstatic.Check lifetime bounds of types mentioning only type parameters
Deprecate
Eq::assert_receiver_is_total_eqand emit future compatibility warnings on manual implspowerpc64: Use the ELF ABI version set in target spec instead of guessing (fixes the ELF ABI used by the OpenBSD target)
Matching on a
#[non_exhaustive]enum now reads the discriminant, even if the enum has only one variant. This can cause closures to capture values that they previously wouldn’t.mut refandmut ref mutpatterns, part of the unstable Match Ergonomics 2024 RFC, were accidentally allowed on stable within struct pattern field shorthand. These patterns are now correctly feature-gated as unstable in this position.JSON target specs have been destabilized and now require
-Z unstable-optionsto use. Previously, they could not be used without the standard library, which has no stable build mechanism. In preparation for thebuild-stdproject adding that support, JSON target specs are being proactively gated to ensure they remain unstable even ifbuild-stdis stabilized. Cargo now includes the-Z json-target-specCLI flag to automatically pass-Z unstable-optionsto the compiler when needed. See #150151, #151534, and rust-lang/cargo#16557.The arguments of
#[feature]attributes on invalid targets are now checked
Internal Changes¶
These changes do not affect any public interfaces of Rust, but they represent significant improvements to the performance or internals of rustc and related tools.