Rust news and engineering summaries

The Zed team has released version 1.0 of their AI-native code editor. Unlike Electron-based predecessors, Zed is built with Rust and the GPUI framework, leveraging GPU acceleration for high performance. It integrates advanced AI agents and collaboration tools, with future plans for DeltaDB to enhance real-time synchronization between developers and AI agents.

The Ladybird browser project has begun transitioning parts of its codebase from C++ to Rust, starting with the LibJS JavaScript engine. This decision prioritizes memory safety and leverages the mature Rust ecosystem. Using AI-assisted translation, developers achieved identical byte-for-byte performance and output without regressions, aiming for a phased, stable integration which will eventually replace the C++ pipeline.

WhatsApp has successfully integrated and rolled out a significant security layer built with the Rust programming language, marking a major milestone in production-grade software engineering. This initiative, known as Kaleidoscope, replaces a legacy C++ library with 90,000 lines of Rust code to monitor and validate media files across billions of devices. By leveraging Rust's memory-safe properties, WhatsApp aims to proactively neutralize vulnerabilities like the 2015 Stagefright exploit, which targeted media parsing libraries. This rollout spans Android, iOS, Windows, Mac, and web platforms, proving Rust's scalability and performance advantages in a diverse, global environment. The transition highlights a broader shift toward memory-safe languages to mitigate high-severity vulnerabilities common in C and C++ implementations. WhatsApp's strategy underscores a defense-in-depth approach, ensuring end-to-end encryption is complemented by robust protection against sophisticated malware hidden in seemingly benign file types.

Bun has successfully migrated parts of its codebase to Rust. This transition improves memory safety, fixes existing leaks, reduces binary size, and maintains performance parity. The core architecture remains identical, with further optimizations planned before the official release. Users can test the improvements immediately via the Bun canary channel.

A developer successfully used the Logitech MX Vertical mouse as a tiny, persistent storage device by hacking its HID++ protocol. By writing arbitrary two-byte data into the DPI register, they demonstrated that the mouse maintains state across devices. The project highlights reverse engineering, firmware communication, and understanding OS-level hardware management through experimental technical exploration.

The Zig Software Foundation reflects on its complex history with Bun, citing concerns over management practices, poor code quality, and technical debt. Ultimately, the Zig team celebrates Bun's rewrite into Rust, as it alleviates friction between project visions, distances Zig from criticized engineering habits, and clarifies community boundaries after the project's acquisition.

Bun has transitioned from a Zig-based runtime to Rust, leveraging AI-driven workflows with Anthropic’s Claude to complete the rewrite in just 11 days. The migration systematically addresses memory leaks and stability issues using Rust’s memory safety guarantees, resulting in improved performance, smaller binary sizes, and reduced memory usage while maintaining feature parity.

Bloomberg and Igalia spearheaded a nine-year effort to introduce Temporal, a modern, immutable date and time API for JavaScript. Replacing the flawed Date object, Temporal reached Stage 4 in TC39 and is featured in ES2026. It offers nanosecond precision, time zone awareness, and calendar support, utilizing a unique cross-engine Rust implementation named temporal_rs.

Canonical disclosed 44 vulnerabilities in uutils, a Rust-based GNU coreutils replacement. These bugs highlight that while Rust prevents memory-safety issues, logic flaws—specifically TOCTOU and system boundary errors—remain critical. Canonical’s audit underscores the importance of anchoring operations on file descriptors, avoiding panics, handling raw bytes, and ensuring bug-for-bug compatibility in systems programming.

The author advocates for using color-coded hex editors to enhance pattern recognition in raw data. By assigning colors to byte value ranges, developers can more easily identify structures, bitstreams, and file formats, similar to syntax highlighting in code editors. The author encourages adopting tools like 'hexyl' and highlights their custom Rust-based project, 'hexapoda'.

F3 is a next-generation open-source columnar data file format designed for efficiency, extensibility, and interoperability. It addresses layout limitations in formats like Parquet by embedding Wasm decoders within files, ensuring future-proof compatibility and platform-agnostic performance. The project provides a research prototype and API for developers, enabling adaptable data encoding schemes for evolving analytics workloads.

Riddle is an open-source project for the reMarkable Paper Pro that transforms the device into an interactive digital diary. Using vision LLMs, it reads handwritten input, processes it, and streams AI-generated responses back in real-time. It features a high-performance e-ink backend, low-latency ink rendering, and requires developer mode access for installation.

Mitchell Hashimoto, creator of HashiCorp tools and the Ghostty terminal, discusses his philosophy on software development. He emphasizes the value of understanding fundamentals over high-level abstractions, the importance of personal taste and vision in open-source projects, and his preference for Zig for systems programming, advocating for more holistic, user-driven software design.

Mullvad uses a deterministic algorithm to assign exit IPs based on a user's WireGuard key. Due to how Rust's random number generation handles bounds, users are assigned IPs with a consistent percentile across servers. This allows for correlation attacks that can deanonymize users by linking different exit IPs to the same account with over 99% accuracy.

The Servo team has released v0.1.0 of the servo crate, enabling its use as a library. This milestone reflects increased confidence in the embedding API. The team also announced a new long-term support (LTS) version to assist embedders requiring stability, with regular security updates and migration support.

The Bun project is undergoing a massive rewrite from C++ to Rust, achieving 99.8% test suite compatibility on Linux. This 960,000 LOC migration aims to improve memory safety, stability, and maintainability by leveraging Rust’s borrow checker and destructors, effectively reducing manual debugging for crashes and memory leaks.

The Asahi Linux project released a new progress report detailing M3 chip support, including audio, power management, and M3 series driver integration. Technical highlights include fixing boot issues caused by macOS 27 metadata, developing custom firmware for the Apple Video Decoder, and the transition of m1n1 to Rust for enhanced hardware initialization.

The yt-dlp project has announced the deprecation and limitation of Bun support due to security concerns and instability. Support is now restricted to Bun versions 1.2.11 through 1.3.14. The maintainers cited potential supply chain vulnerabilities in older versions and concerns regarding the project's transition from Zig to Rust.

The author discusses the challenge of balancing complex research with practical project execution. By analyzing their experiences with tools like difftastic and Emacs file searching, they emphasize prioritizing minimal, actionable success criteria over feature bloat. The post advocates for 'learning by doing' to avoid the productivity trap of over-engineering and endless research.

Cilly is a new Rust compiler backend that translates Rust code into C, enabling Rust development on obscure hardware or platforms that lack native LLVM or GCC support. By generating platform-specific C code through intelligent introspection, it bridges the gap for architectures like Plan9, offering a solution to the bootstrap paradox and expanding Rust's reach.