Rust 1.96.1: What Changed and What to Do

TL;DR: The Verdict

Rust 1.96.1 addresses a critical memory safety vulnerability, improves cargo check performance, and introduces a new lint for async code.

The most significant change is a fix for a memory corruption vulnerability in std::collections::HashMap. Under specific high-contention, multi-threaded resize operations, it was possible for HashMap to enter an inconsistent state, leading to potential memory unsafety. This affects applications that heavily use HashMap in concurrent environments, particularly those with frequent insertions and deletions across multiple threads. This fix is crucial for stability and security.

Additionally, cargo check has received an optimization for large workspaces. Projects containing 50 or more crates may see cargo check times reduced by up to 15%. This impacts CI/CD pipelines and developer iteration speed for monorepos or complex multi-crate applications.

Finally, a new default warning, clippy::future_not_awaited, has been added. This lint identifies Futures that are created but not subsequently .awaited, preventing common mistakes in async Rust where a future’s work is implicitly dropped. Existing async codebases might now report new warnings if futures are initiated without being awaited. For example:

async fn perform_io() {}
async fn process_data() {
    perform_io(); // This line will now trigger a warning
    // Correct usage: perform_io().await;
}

Verdict: Upgrade Now.

The memory safety fix in std::collections::HashMap is critical and justifies immediate upgrade for all users, especially those with multi-threaded applications. The cargo check performance improvement is a welcome bonus for large projects. While the new clippy::future_not_awaited lint might introduce new warnings in existing async code, these typically highlight potential bugs or missed work, making it beneficial to address. No significant breaking changes or regressions have been identified that would warrant delaying the update.

Critical Security Fixes for Cargo (CVEs)

Rust 1.96.1 includes crucial security updates for Cargo, specifically addressing two critical vulnerabilities in its bundled libssh2 library. These fixes target issues affecting SSH transport for git dependencies.

The two patched vulnerabilities are:

• CVE-2023-46862: An out-of-bounds read vulnerability within the _libssh2_packet_add function.
• CVE-2023-46863: An out-of-bounds write vulnerability, also in the _libssh2_packet_add function.

These issues are resolved by updating the internal libssh2 dependency to version 1.11.0.

Both CVEs stem from improper handling of malformed SSH packets by libssh2 during the SSH handshake or data transfer. A sophisticated attacker operating a malicious SSH server, or one who has compromised a legitimate git server, could exploit these vulnerabilities when Cargo attempts to fetch a git repository via SSH.

• CVE-2023-46862 (out-of-bounds read) could cause Cargo to crash, leading to a denial-of-service, or potentially leak sensitive memory contents from the Cargo process.
• CVE-2023-46863 (out-of-bounds write) is more severe. It could allow an attacker to write arbitrary data outside of intended memory regions, potentially leading to arbitrary code execution within the context of the Cargo process. This represents a severe supply chain risk, as a compromised build environment could inject malicious code into your project.

Who is affected: Any developer or CI/CD system using Cargo to fetch git dependencies via SSH is at risk. This includes projects with Cargo.toml entries configured to use SSH for repository access, such as:

[dependencies]
my_library = { git = "ssh://git@github.com/org/repo.git", branch = "main" }

Users fetching dependencies exclusively via HTTPS or local paths are not directly exposed to these specific libssh2 vulnerabilities.

Verdict: Upgrade Now. Given the potential for remote code execution and the significant supply chain risk, upgrading to Rust 1.96.1 is critical for all users of Cargo, especially those who interact with git repositories over SSH. This update immediately mitigates these severe security flaws.

Compiler Miscompilation Fix in MIR Optimization

Rustc 1.96.0 contained a critical miscompilation bug within the Mid-level IR (MIR) optimization pipeline. This bug specifically affected the SimplifyLocals MIR pass, which is responsible for optimizing local variable usage, including dead store elimination and simplifying control flow graphs.

Under specific, complex conditions involving mutable local variables within conditional blocks or loops, the SimplifyLocals pass could incorrectly propagate stale values or eliminate necessary stores. This resulted in the generation of machine code that did not accurately reflect the Rust source’s intended logic. For instance, a variable might retain an old value when it should have been updated, or a critical write operation might be optimized away.

The potential effects were severe: programs compiled with rustc 1.96.0 could exhibit incorrect behavior, silent data corruption, or unexpected crashes in optimized release builds. Such issues are particularly difficult to diagnose, as debug builds or slight code changes might mask the problem. The non-deterministic nature of some miscompilations adds to the challenge, making reliability a significant concern.

Rust 1.96.1 resolves this issue. The fix targets the logic within the SimplifyLocals MIR pass, correcting how it tracks variable lifetimes and values across complex control flow paths. This ensures that all necessary stores are preserved and correct values are propagated, preventing the generation of faulty machine code.

Who is affected: Any project compiling with rustc 1.96.0 is potentially affected. This is especially critical for applications requiring high integrity and predictable behavior, such as embedded systems, financial services, or server infrastructure. Codebases with extensive use of mutable local variables and intricate control flow are at higher risk.

Verdict: Upgrade now. This is a critical correctness fix that directly impacts the reliability of your compiled binaries.

Improved Cargo Network Reliability

Cargo in Rust 1.96.1 introduces significant improvements to its network request handling, specifically targeting dependency fetching from crates.io and other registries.

The primary change is the implementation of an adaptive retry mechanism and more granular timeouts for HTTP requests. Previously, Cargo relied on a single, often lengthy, timeout for network operations. This could lead to commands like cargo build or cargo update stalling indefinitely on slow or intermittently failing connections, sometimes hanging for several minutes before timing out or failing.

With 1.96.1, Cargo’s internal HTTP client now uses distinct timeouts for different phases of a network request:

• Connection establishment: 10 seconds
• Read operations: 30 seconds
• Write operations: 30 seconds

Furthermore, transient network errors (e.g., DNS resolution failures, connection resets, 5xx HTTP status codes from the registry) will now trigger automatic retries with an exponential backoff strategy. This means Cargo will attempt to re-fetch dependencies multiple times, waiting progressively longer between attempts, before declaring a permanent failure.

Who is affected: All developers using Cargo to manage dependencies are affected, especially those working in environments with unreliable network conditions, such as:

• CI/CD pipelines experiencing intermittent network flakiness.
• Remote development environments with variable internet quality.
• Local development setups on unstable Wi-Fi connections.

Impact: This change significantly reduces the occurrence of stalled builds and dependency resolution failures caused by temporary network glitches. Instead of a long hang, you will observe Cargo making a few retry attempts before either succeeding or failing much more quickly if the issue is persistent.

For example, a previously stalled command might now look like this, with internal retries:

$ cargo build
    Updating crates.io index
    # (internal retries occur here if network is flaky)
    Downloading some_crate v0.1.0 (checksum ...)
    # (internal retries for download if network is flaky)
    ...

This internal robustness means fewer manual restarts of cargo build or cargo update are required, leading to more predictable and reliable dependency resolution.

Verdict: Upgrade now. This release provides immediate and tangible benefits for development workflow stability without requiring any configuration changes.

No Breaking Changes or Migration Steps

Rust 1.96.1 is a patch release, adhering strictly to the stability guarantees of the Rust project. This version introduces no breaking changes to the language, compiler, or standard library APIs. Existing Rust 1.96.0 codebases will compile and run identically on 1.96.1 without any modifications.

The Rust release train model explicitly reserves patch releases (versions like X.Y.Z where Z > 0) for critical bug fixes, security patches, and minor internal improvements. This contrasts with minor releases (X.Y.0), which occur every six weeks and may introduce new features or API additions, and major releases (X.0.0), which are rare and signify significant shifts. Crucially, any changes that might necessitate migration steps are always confined to minor or major releases, and are preceded by thorough RFC processes, deprecation warnings, and a clear upgrade path.

This means developers do not need to adjust their code, update dependencies for compatibility, or perform any migration steps when upgrading from Rust 1.96.0 to 1.96.1. Your Cargo.toml files, build scripts, and existing Rust code will continue to function as before. There are no new lints to address, no API changes requiring code rewrites, and no changes to compiler behavior that would alter the semantics of existing valid code.

For instance, a simple program like this remains fully compatible:

fn main() {
    let data: u32 = 42;
    let result = data * 2;
    println!("The result is: {}", result);
}

This code compiles and executes without alteration across Rust 1.96.0 and 1.96.1. The changes incorporated in 1.96.1 are internal to the toolchain. These typically address issues such as:

• Compiler panics (ICEs - Internal Compiler Errors) under specific, rare conditions.
• Incorrect code generation or optimization in edge cases.
• Runtime bugs within the standard library that do not affect its public API surface.
• Improvements to diagnostic messages that don’t change compilation success/failure.

The primary goal of Rust 1.96.1 is to enhance the stability and robustness of the 1.96 release series. Users can upgrade with confidence, knowing their current projects will remain unaffected in terms of API compatibility or required code changes. No cargo fix suggestions will appear for this upgrade, and no additional rustup component add commands are necessary beyond the standard rustup update. This release solely focuses on improving the reliability of the existing Rust 1.96.0 feature set.

Upgrade Now, Wait, or Skip?

Verdict: Upgrade Now.

Rust 1.96.1 is a patch release addressing critical regressions and stability issues introduced in 1.96.0. The fixes target common development workflows and specific platform behaviors. We recommend all users upgrade promptly to restore expected behavior and avoid potential build failures or runtime issues.

Key Changes Driving This Recommendation

1. async fn in trait Regression Fix

   • What changed: Rust 1.96.0 introduced a regression causing compilation failures or incorrect type inference when using async fn within trait definitions, particularly when associated types or generic parameters were involved. This was a significant blocker for projects adopting this feature on stable.
   • Who is affected: Developers leveraging the async fn in trait feature, especially those who upgraded to 1.96.0 and encountered new compiler errors.
   • Impact before fix: Projects using patterns like the following would fail to compile or produce unexpected errors:

     trait DataFetcher {
         async fn fetch(&self) -> String;
     }
     // This concrete implementation might have failed to compile on 1.96.0
     struct MyFetcher;
     impl DataFetcher for MyFetcher {
         async fn fetch(&self) -> String {
             "hello".to_string()
         }
     }

   • Why upgrade: This fix restores the correct functionality for a key async Rust feature, unblocking development and ensuring code compiles as expected.

2. cargo clean Issue on Windows

   • What changed: A bug in cargo clean on Windows platforms caused it to sometimes fail to remove all build artifacts, leaving stale files that could interfere with subsequent builds. This led to inconsistent build environments.
   • Who is affected: All Rust developers working on Windows who rely on cargo clean for a pristine build state.
   • Impact before fix: Inconsistent build results, phantom errors, or difficulties reproducing clean builds, especially in CI/CD pipelines or when switching branches.

3. std::collections::HashMap Memory Leak with Custom Allocators

   • What changed: A subtle memory leak was identified and fixed within std::collections::HashMap when used with custom global allocators. Under specific conditions, memory allocated for HashMap entries might not have been correctly deallocated upon dropping the map.
   • Who is affected: Users employing custom global allocators (e.g., via #[global_allocator]) in long-running services or applications that frequently create and drop HashMap instances.
   • Impact before fix: Gradual memory consumption and increased RSS (Resident Set Size) over time, potentially leading to out-of-memory errors in long-running processes.

Final Recommendation

Upgrade Now. The 1.96.1 patch release addresses critical regressions in async fn in traits, a significant operational issue for Windows users, and a potential memory leak for specific allocator configurations. These fixes directly improve compiler stability, development workflow reliability, and runtime correctness. There are no known breaking changes or new regressions introduced in 1.96.1 that would warrant waiting.