Tessera
Folgen

Predrag Gruevski

@predr.ag

Querying (Almost) Everything // Frontier Systems @ OpenAI // Author of cargo-semver-checks & Trustfall // https://predr.ag/blog // ex Kensho // MIT alum // https://hachyderm.io/@predrag // not from around here 🇲🇰 // he-him

622 Posts1883 Follower378 Folgt
Predrag Gruevski@predr.ag · 4d ago

With any luck, this is the cargo-semver-checks release that will start scanning the Rust standard library for breakage. Enjoy v0.50.0! What a fitting moment for a nice round number 🎉 Expect a blog post soon!

cargo-semver-checks v0.50.0 release notes. - Support for rustdoc JSON v61 for the latest nightly Rust - One new lint: `auto_trait_impl_added` - Bugfix in `constructible_struct_adds_field` to properly account for existing `pub` but `#[doc(hidden)]` fields. - Support for parsing rustdocflags from `.cargo/config.toml` and some minor bugfixes - Thanks to @taiki-e for accepting our upstream patches and promptly releasing them in `cargo-config2` so we can use them!
Predrag Gruevski@predr.ag · 6d ago

If you use the Trustfall query engine via Python, please upgrade to v0.3.2. In v0.1.6 - 0.3.1, using the exposed APIs in a sufficiently contrived manner could trigger use-after-free. Your code *probably didn't do this*, but I yanked the affected versions to be safe. github.com/obi1kenobi/t...

Fix unsound `Opaque` in Python bindings. by obi1kenobi · Pull Request #960 · obi1kenobi/trustfall

Python adapters that broke the API contract in copying contexts and returning them more than once could cause a use-after-free / double-free bug. With this fix, this is explicitly checked for and w...

github.com

Chris Krycho@chriskrycho.com · last wk.

As I just told a colleague: it’s a shame how little traction this has ever gotten, but part of it is probably tooling. If I had a few months of dedicated funding, I’d build a TS version of cargo-semver-checks – @predr.ag and I have talked about how the underlying infra would Just Work™. If only!

Chris Krycho@chriskrycho.com · last wk.

HEYO I just got to link to one of the discussions in semver-ts.org to explain something internally. Nice to have that actually be useful! 😂

Predrag Gruevski@predr.ag · 3w ago

Happy cargo-semver-checks release day 🎉 After 30+ PRs and 15kLoC, we can now lint the Rust standard library for accidental breakage! I'll work with Rust maintainers to get that plugged in, then it's blog post time to tell you how it works! Stay tuned 🦀 github.com/obi1kenobi/c...

Release v0.49.0 · obi1kenobi/cargo-semver-checks

In this release Unstable --stability-aware mode for detecting breakage in the Rust standard library. False-positive fix: correctly propagate #[doc(hidden)] through glob re-exports when determining...

github.com

imperio@imperioworld.bsky.social · 3w ago

Hi everyone. I need your help! I recently added support to get system GPU usage in the Rust sysinfo crate. Next step was to get this info per-process. However, I'm now facing a very annoying Apple issue: undocumented API changing each version. So I can only test my own macOS version: 12.6. 1/4

Ethan Mollick@emollick.bsky.social · 3w ago

Fable: "Pitch Odysseus as a management consultant, arguing that he has found product-market fit, and he should just stick with Trojan Horse making as opposed to going home to Ithaca in a powerpoint" I like the 1 star review from Cassandra where "0 of 10,000 readers found this helpful." Pretty funny

BildBildBildBild
Predrag Gruevski@predr.ag · last mo.

Day 5, a picture worth a thousand words 👇 I put an API-breaking `#[doc(hidden)]` in my local build of the Rust standard library, and asked cargo-semver-checks to find it. See for yourself!

cargo-semver-checks output where the "function now doc hidden" lint is triggered, warning that the "black_box" function in library/core/src/hint.rs is now #[doc(hidden)] and no longer public API. The run took 6.7s total.
Predrag Gruevski@predr.ag · last mo.

It's Thursday, day 4. Today's haul so far is ~2500 LoC. First, making use of default-value stability which we previously exposed in rustdoc JSON. Codex caught a subtle edge case that affects which traits are considered sealed. Copious test cases are standard, of course. github.com/obi1kenobi/t...

Support default-value stability in rustdoc JSON v60. by obi1kenobi · Pull Request #1087 · obi1kenobi/trustfall-rustdoc-adapter

Unstable default values, such as provided function bodies in trait definitions, associated type defaults, and default values for associated constants, are treated as not present when indexing rustd...

github.com

Predrag Gruevski@predr.ag · last mo.

I had to take a brief detour to triage a surprising new class of SemVer breakage. It's always *a time* when the net result is "8 issues across 5 repos" 😅 The net result is the same: even more lints! github.com/obi1kenobi/c...

Breakage in items of reachable but not nameable supertrait · Issue #1658 · obi1kenobi/cargo-semver-checks

Example minified from time-rs/time#793 mod sealed { pub trait Sealed { fn example(&self) { ... } } } pub trait Visible: sealed::Sealed {} Now modify: mod sealed { pub trait Sealed { - fn example(&s...

github.com

Peter Clines@peterclines.com · last mo.

Okay, yes it's PRIME DAY. We're all very excited, but let's take a moment to make sure we're getting the most out of it. We don't want to waste this opportunity. 1/4

Predrag Gruevski@predr.ag · 2mo ago

I wear many hats in the #rustlang community — today I get another one. OpenAI is contributing $600,000 to the Rust Foundation, to become a Platinum Member and support both Rust development and the broader ecosystem. As part of this, I'll have the honor of joining the Foundation board 🙇‍♂️

The Rust Foundation@rustfoundation.org · 2mo ago

[NEWS] OpenAI has joined the Rust Foundation as a Platinum Member & committed additional funding to programs across the Rust ecosystem. Sustaining a language like Rust requires this kind of support, and we are grateful to OpenAI for stepping up! 🎉 rustfoundation.org/media/rust-f... #rustlang #openai

The Rust Foundation@rustfoundation.org · 2mo ago

Read the latest blog post by @joelmarcey.com (Rust Foundation Director of Technology) to learn more about new AI Security Engineer in Residence, Jacob Finkelman. This role was made possible for the #rustlang ecosystem with support from Alpha-Omega. rustfoundation.org/media/an-ai-...

An AI Security Engineer in Residence for the Rust Ecosystem

Read Alpha-Omega's blog post about this exciting news here: https://alpha-omega.dev/blog/an-ai-security-engineer-in-residence-for-the-rust-ecosystem/ Since 2022, the Rust Foundation has run a…

rustfoundation.org

rain 🌦️@sunshowers.io · 2mo ago

Update: iddqd is now formally verified*! * with limitations that are fundamental to this kind of formal verification, making it a complement to the existing layers of validation For more, see: oxide.computer/blog/iddqd-u...

Update 2026-06-16: Since publication, we’ve used Soteria to verify that iddqd's no-duplicate-index invariant holds under arbitrarily adversarial Hash and Ord implementations. Soteria is similar to Kani in spirit, though with different internals that make it more compatible with iddqd. Soteria is implemented as a symbolic execution engine that lets you declare points of nondeterminism in your code. (For example, within iddqd, we represent an adversarial Hash or Ord return value as nondeterministic, since we want to model adversarially bad user code.) Then, it: Compiles the Rust program into a form suitable for formal verification. Interprets this form until it reaches a point of nondeterminism, treating each such point as a symbol rather than a concrete value. Branches at each point where control flow depends on a symbol, validating that there is no UB and that the invariants specified by the program are upheld. A lot of the cleverness lies in how the possibility space is collapsed down to something manageable. For example, Soteria doesn’t have to enumerate every possible Hash value; rather, it only has to fork in places where control flow depends on the Hash value.
rain 🌦️@sunshowers.io · 2mo ago

iddqd, or the hardest kind of unsafe Rust. My first post for the @oxide.computer blog! Goes deep into the pitfalls of unsafe Rust and how to reason about it. A lot of labor went into the post -- please have a read! oxide.computer/blog/iddqd-u...

Predrag Gruevski@predr.ag · 2mo ago

I am so mad about this. AI coding tools can be put to *great* use, and THIS ISN'T IT. Great AI use case: "help me find my bugs before my users find them" Not great AI use case: "half-ass my job for me"

Hillel is on Social Media Break@hillelwayne.com · 2mo ago

The exploit: 1. Change your IP address to the target's geolocation and tell the support you've been hacked, asking them to send a reset to attacker email 2. No step 2. Meta's CISO immediately resigned. Gergely had inside contacts: the code was written by AI, reviewed by AI, while tokenmaxxing

Hillel is on Social Media Break@hillelwayne.com · 2mo ago

The exploit: 1. Change your IP address to the target's geolocation and tell the support you've been hacked, asking them to send a reset to attacker email 2. No step 2. Meta's CISO immediately resigned. Gergely had inside contacts: the code was written by AI, reviewed by AI, while tokenmaxxing