LanceDB fixes a table-name path traversal in its Cloud client that could cross tenants
Before 0.40.0, LanceDB's Cloud client put table names into REST URLs unencoded, so a name with ../ could reach another table or tenant. Upgrade.
Topic · 104 stories · page 1 of 5
104 stories tagged rust on AI Tamer, newest first.
Before 0.40.0, LanceDB's Cloud client put table names into REST URLs unencoded, so a name with ../ could reach another table or tenant. Upgrade.
goose's code mode now runs agent scripts on Boa with no file, shell or network access. The PR reports a smaller binary and fewer tokens in a small test.
The php-rust README claims parity on WordPress core tests, Composer and Doctrine. It is still slower than PHP, and recent commits list Claude as co-author.
fastembed-rs 7.4.0 puts ONNX Runtime behind a default onnx feature and splits qwen3 into text and VL features. Default builds are unchanged.
One developer rewrote NVIDIA's streaming RE-USE model in Rust and measured 8.4 ms per 20 ms frame on an M3 CPU, against 16.9 ms through WebGPU.
NVIDIA posted Flare, an Apache-2.0 local inference server for SM120/SM121 GPUs such as DGX Spark. Python prepares each model; a Rust runtime serves it.
tsrs, a Rust port of the TypeScript type checker, joins the Oxc toolchain. Cloudflare plans a merge with tsc-rs and agent-run upstream sync.
rmcp 3.6.0 enforces the 2026-07-28 rule that servers must not send requests to clients, cancels abandoned calls, and bounds the stdio line buffer.
pyke's ort 2.0.0-rc.15 fixes what it calls over 30 cases of undefined behavior and adds no features. It breaks a few APIs, including run_async inputs.
On 17 and 18 October Codewhale fixed deny-list, sub-agent, and sandbox gaps on main. They are not in the 8 October v0.10.1 release.
Lexmount's Moli is a Rust headless browser for agents, public since August. The 17 October v1.1.18 tag is a compatibility pass. Scores are Lexmount's.
Respan's 15 October post releases Span-02. The card says the weights run only on its Rust and CUDA engine, on Blackwell GPUs.
Mirai's 16 October post points at uzu.run, a browser preview of local models over WebGPU. The engine's WebGPU backend is still an unmerged draft.
XERJ published v1.0.0-rc.96 on 16 October, a Rust engine for local search. Corpus Hub is not enabled in this build.
crates.io listed 127 of 136 zip versions yanked on 16 October. Nine remain, including 8.6.0, which one advisory names.
pingdotgg/ts-rust published tsc-rs 0.7.0 on 14 October. The note says the wasm32 build runs the checker with less memory. npm latest is 0.7.0.
Mirai published @trymirai/uzu-pi-extension 0.6.8 on 15 October. It adds uzu as a local provider for Pi on Apple Silicon Macs.
Sonos published tract 0.23.9 on 15 October with a tract_moe_ffn operator. The deploy runtime is marked WIP. crates.io still lists 0.21.19 as newest.
Pull request 2771 merged a terminal coding agent into Rig on 15 October. The agent crates are unpublished. crates.io rig 0.44.0 does not include them.
Niko Matsakis's 14 October essay says Rust fits agentic coding and that types need proof tools. A Meta growth line in it is Tolnay's.
warpfront tagged hipfire 0.4.2 and a same-day 0.4.2.1 patch. The notes add a Strix Halo NPU trunk, opt-in expert parallel, and a calibration fix.
pyke shipped ort 2.0.0-rc.14. Sessions take an explicit Environment. Older ort can fail on Rust 1.100 when copy-dylibs is enabled.
Map a JSON event stream with a "type" field onto a Rust enum using #[serde(tag = "type")], handle unknown event types, and see why tuple variants fail to compile.
Run cargo miri test on a crate with unsafe code to catch out-of-bounds reads, use-after-free and aliasing violations that pass ordinary tests.