iiinova — where your digital self keeps evolving

I keep saying, big SemVer is always hard at work adding more SemVer 😆 Little-known fact, I wrote a cargo-semver-checks equivalent for Python, and it could handle both positional and keyword arguments, including their "only / both" flavors. It was kind of amazing how many footguns were in there.

1101

This security issue, and ones yet to come, all require a team effort. I'm proud of Rustaceans' willingness to lead with urgency and repeatedly choose a "fall into the pit of success" approach. Knowing that the language, toolchain, and community have my back is why I love being here 🦀

060

In response, the Codex team and I have been working to equip the defenders with the best tools. On top of Codex for OSS with our latest models, we've also extended tens of thousands of dollars' worth of API credits to Rust's security professionals. As a start. There's more to be done.

180

GitHub Actions leaking secrets when Miri output is cached | Rust Blog

Lately I've been doing Rust ecosystem security work. GPT-6 Astra is an extraordinary tool for detecting bugs, unsoundness, and security vulnerabilities. *Everything* is buggy, it turns out. blog.rust-lang.org/2026/09/21/g...

blog.rust-lang.org

Empowering everyone to build reliable and efficient software.

181

GitHub Actions + Rust's Miri can leak your secrets in CI 🧵 If you run Miri in CI: - upgrade to the 2026-09-22 nightly - clear caches - rotate any secrets that the `cargo miri` CI job had access to GPT-6 Astra helped find this 🦀

GitHub Actions makes it possible to cache directories between runs. Typical setups allow CI runs on main (and other branches) to write to cache, and PRs can only read from cache (preventing cache poisoning). Rust projects tend to speed up CI by caching binaries built by cargo install and sometimes the contents of target/.

PR CI can be triggered by anyone who can open PRs on your repository. GitHub requires maintainer approval for the first PR, but future PRs will rerun CI on every push. Anyone who has previously landed a change can trigger a CI run extracting information from cached target/ and then cover their tracks by pushing a second commit to the PR.

GitHub sometimes hides overwritten commits in its UI, making this kind of attack harder to detect. CI run logs and overwritten commits are also deleted after a few months.

When cargo miri is invoked, Miri needs to retain build-relevant environment variables between runs. The current code to do so achieves this by storing all environment variables to target/. This, of course, persists when target/ is cached.

If your environment contained secrets, these can now be accessed by PRs via the cache.

1389

Jokes aside, genuinely happy for you. Good luck in the new role!

If that's the only blocker I'm paging a hiring manager right now :)

120

pixelwood-adoption-center.malenagruevski.chatgpt.site

We could! The pets API is pluggable, and my wife made a whole personalized collection of them pixelwood-adoption-center.malenagruevski.chatgpt.site

Pixelwood Adoption Center

Meet, play with, and adopt a ChatGPT pet from a cozy retro pixel-art adoption center.

120

Congrats! But we have crab too, you could have called 😆

it's not devoops unless it has 9 5s of availability

020

I'm lazy and just make the agent make the representative local setup on its own when needed. I've got other things to do etc. YMMV of course.

000

A good agent (Sol, Astra, etc.) can do this on its own in my experience.

If this wouldn't burn all my GitHub Actions credits I totally would. Or is there a way to do it that won't do that? 👀

200

When this works perfectly 2-3 times in a row: - have it automatically open a PR with the fix - have it watch CI and trigger this automatically on flaky-looking failures You made an AI loop to eliminate flaky tests. Congratulations!

Predrag Gruevski @predr.ag · 12/09/2026

AI loops 101 in two posts: When CI fails with on a flaky test, send this to your agent: "a test failed in a flaky fashion, please figure out why and propose a pragmatic path forward: <CI link>"

220

I would have loved to, but sadly no. Flying the other way next week for a different event.

100

Predrag Gruevski @predr.ag · 12/09/2026

RustConf was great 🎉 Now Rust ➡️ Rest, at least for 36h or so. Then, Rust again 🦀

1150

Predrag Gruevski @predr.ag · 05/09/2026

My 2c: genuinely caring is brutal but it's also one's greatest strength. People who genuinely care about both people and quality are irreplaceable and in short supply. No amount of AI will fix that.

040

Predrag Gruevski @predr.ag · 05/09/2026

Easy yes. Improving them is a one-off that saves tokens for everyone, indefinitely.

0140

Predrag Gruevski @predr.ag · 01/09/2026

New programming book arrived in the mail 👀 There's never been a better time to think deeply about the structure behind the code we cause to exist.

Logic for Programmers, a book by Hillel Wayne

1446

Also, I can confirm the hero was properly wined and dined, the two of us met up for dinner last night 😆

170

I have about half a dozen PRs with `[perf]` in the title if you'd like to see concrete examples. I have about 30 more things sitting in local branches, waiting for me to clean up the code and make a PR.

140

I got a shout out in the weekly post on next trait solver progress for an up to 7.5% speedup ... by deleting one unnecessary line of code 😆 There are absolutely more of these opportunities, and I've built a method for finding them at some scale. Need. More. Time. 😅

140

I use unit for true and never for false. Why would I write code that's false? Do I look like a liar?

How I made Rustdoc 25% faster in one week - Noah Lev Bartell-Mangel

This change by Noah Lev will probably save a zillion dollars in docs\.rs and CI jobs everywhere. Really nice work! noahlev.org/blog/2026/08...

noahlev.org

From a "weird bug" to massive speedups

1354

Predrag Gruevski @predr.ag · 27/08/2026

More good news: Jess Izen is stepping into an Engineer in Residence role with the Rust Foundation! She's done so much good work for the ecosystem already (see the post!) and I can't think of a better person to wear this hat 🦀 rustfoundation.org/media/welcom...

rustfoundation.org

Welcoming Jess Izen as Engineer in Residence at the Rust Foundation

The Rust Foundation is pleased to welcome Jess Izen (@jlizen) as our new Engineer in Residence. For the next year, Jess will work full time as part of the Foundation’s engineering team, taking directi...

0213

Predrag Gruevski @predr.ag · 26/08/2026

I would also read that! @mattkeeter.com I'll bring some `unsafe` to RustConf if you need help getting it out of Steve 🤣

Predrag Gruevski @predr.ag · 26/08/2026

The first batch of Rust maintainers in residence has been announced! A lot of Rust will get even more love and attention: clippy, rustup, rustdoc, Windows support, standard library, and compiler internals 💖🦀

0171

Reposted by Predrag Gruevski

The Rust Foundation @rustfoundation.org · 26/08/2026

Announcing the 1st cohort of Rust Maintainers in Residence! Thanks to contributions from Google, AWS, & OpenAI, the Rust Foundation and Rust Project have raised $350K to fund 6 contributors on Rustup, Clippy, compiler, stdlib, & rustdoc 🦀 Read announcement: rustfoundation.org/media/rust-p...

rustfoundation.org

Rust Project and Rust Foundation Announce First Maintainers in Residence

New program directs $350,000 toward maintainers supporting critical Rust infrastructure DOVER, Delaware, USA – August 26, 2026 – The Rust Project and Rust Foundation today announced the inaugural coho...

1286

Yes, I would strongly support a mechanism like this being built upstream!

000

Np, happy to help! Please feel free to ping me with any follow-up questions too — security improvements help everyone so I'll do anything I can do to help.

011

I iterated on this with GPT-5.6 Sol to try to close as many gaps as I could. It came up with a lot of interesting ways to sneak changes in, and we then plugged everything we could. I've found it really helpful to have a "please do an adversarial review of this change" ability available on-demand!

260

Add a build-script policy with hashes for allowed build scripts. by obi1kenobi · Pull Request #1706 · obi1kenobi/cargo-semver-checks

Adding a build script now requires adding an exception line to a special file, including a hash and path to the build script. `[package] build = ..` values are banned under this policy, so all build scripts must be `build.rs` and therefore subject to the hash check. github.com/obi1kenobi/c...

github.com

Adding a build script anywhere in the repo requires registering an exception, which will make that change much more obvious during code review and will make it harder for malicious changes to &quot...

120

For the repos only. I'd be interested in similar functionality in cargo for deps though. My repos like cargo-semver-checks and trustfall-rustdoc-adapter have hundreds of test crates, with more added for ~every new lint. I want to make it maximally "loud" if a PR adds a build script in one of them.

Pete 🙆‍♂️ @petelevasseur.com · 16/08/2026

I'm updating my Rust projects to harden them against supply chain attacks: - explicit allowlist of hashes for build scripts in the project - `min-publish-age` of 7 days for deps updates, using the nightly cargo feature - ensure no jobs that could run a build script have GH tokens

2430

Reposted by Predrag Gruevski

super duper cool to have @nia.is.fckn.gay of Hexcat to the @sdv.eclipse.org's @rust-lang.org special interest group this tuesday! chattin bout "Stable allocators, one unsoundness at a time" it's at 7am PDT / 10am EDT / 6pm CEST / 11pm JST =) wanna join? `.ics` is below

screenshot showing Nia Deckers' chat this on August 18, 2026 for "Stable allocators, one unsoundness at a time"

1153

Predrag Gruevski @predr.ag · 16/08/2026

Rust CI now runs cargo-semver-checks to prevent accidental breakage in the standard library 🦀 If you're wondering why that's important and why it took 15kLoC+, this post is for you. predr.ag/blog/protect...

predr.ag

Protecting the Rust standard library from accidental breakage

How & why we're running cargo-semver-checks in Rust's CI

06011

Predrag Gruevski @predr.ag · 14/08/2026

no no I think you meant why doesn't rust simply *just* add comptime gotta pair up the load-bearing words so they don't get lonely