Overview
The Rust team has officially rolled out version 1.94.1, a point release aimed at addressing several regressions introduced in the previous stable version, 1.94.0. This update focuses on enhancing stability, fixing critical issues in the standard library, and patching a security vulnerability. Rust, a systems programming language designed for performance and reliability, continues to evolve with community-driven improvements.
Key Fixes in Rust 1.94.1
Version 1.94.1 resolves three regressions that were present in 1.94.0. These fixes touch core components of the language, including the standard library, Clippy, and Cargo.
Standard Library Fixes
- Thread spawning on wasm32-wasip1-threads: A regression affecting
std::thread::spawnon the WebAssembly targetwasm32-wasip1-threadshas been fixed. This allows developers using WebAssembly with threading support to spawn threads reliably. - Removal of unstable Windows API methods: New methods added to
std::os::windows::fs::OpenOptionsExtin 1.94.0 have been removed. These methods were marked as unstable but were added to a trait that is not sealed, meaning the trait cannot be extended with non-default methods. The removal prevents potential API instability issues.
Clippy: Fix for Internal Compiler Error
The Clippy linting tool received a fix for an internal compiler error (ICE) that occurred when analyzing match_same_arms patterns. This resolves crashes for users relying on Clippy for code quality checks.
Cargo: Downgrade and Security Fix
Cargo, Rust's package manager, benefits from two important updates:
- curl-sys downgrade to 0.4.83: This change addresses a certificate validation error experienced by some FreeBSD users. The issue caused cargo to fail when verifying SSL/TLS certificates. See the related issue for more details.
- tar update to 0.4.45: This version patches two security vulnerabilities: CVE-2026-33055 and CVE-2026-33056. Users of crates.io are not affected by these CVEs. For further information, consult the security advisory section below.
Security Update
The most critical change in Rust 1.94.1 is the security fix applied to the tar crate, which is used by Cargo to handle tar archives. The update to version 0.4.45 mitigates two Common Vulnerabilities and Exposures (CVEs):
- CVE-2026-33055 – details not publicly disclosed, but the update resolves the issue.
- CVE-2026-33056 – similarly addressed in the new tar version.
It is important to note that these vulnerabilities do not affect users who only interact with Cargo through crates.io, as the exploit path relies on specific tar archive handling not triggered by the registry. However, all users are encouraged to update to maintain the highest security posture.
How to Update to Rust 1.94.1
If you already have Rust installed via rustup, updating is straightforward:
- Open your terminal or command prompt.
- Run the command:
rustup update stable - Verify the installation with:
rustc --version
If you don't have Rust installed yet, you can obtain rustup from the official Rust website.
Acknowledgments
The Rust team extends its gratitude to the many contributors who helped make this release possible. From identifying regressions to submitting patches and reviewing code, the community's collaboration is invaluable. Rust 1.94.1 would not exist without the dedication of volunteers and professionals alike.
For a complete list of contributors, please see the official release blog post.